Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    20-05-2021 01:51

General

  • Target

    7A6C8CE1E4A64866A8E1341F135544AEB2B7CA4B27D78.exe

  • Size

    7.3MB

  • MD5

    925852828704fb5328b96342fb6ac8bf

  • SHA1

    32cb9126f5d990ffcb7f410418f2521f4dad33f3

  • SHA256

    7a6c8ce1e4a64866a8e1341f135544aeb2b7ca4b27d784885dc75df7a96e56f8

  • SHA512

    5202d91be53bcaebbb2b8b608cd9a843253d1c5b26937910546b3f72ce3807c975e7dd36ba51bf9231da4135544d9f373d04a4e73c41071353bf883bfef57dd7

Malware Config

Extracted

Family

vidar

Version

38.3

Botnet

827

C2

https://api.faceit.com/core/v1/nicknames/vyh62lapin

Attributes
  • profile_id

    827

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 2 IoCs
  • Executes dropped EXE 15 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • autoit_exe 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Modifies registry class 9 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
      PID:1064
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Themes
      1⤵
        PID:1224
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s UserManager
        1⤵
          PID:1296
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
          1⤵
            PID:1992
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2464
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2544
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Browser
                1⤵
                  PID:2740
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                  1⤵
                    PID:2724
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                    1⤵
                      PID:2700
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s SENS
                      1⤵
                        PID:1440
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                        1⤵
                          PID:1108
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                          1⤵
                            PID:340
                          • C:\Users\Admin\AppData\Local\Temp\7A6C8CE1E4A64866A8E1341F135544AEB2B7CA4B27D78.exe
                            "C:\Users\Admin\AppData\Local\Temp\7A6C8CE1E4A64866A8E1341F135544AEB2B7CA4B27D78.exe"
                            1⤵
                            • Drops file in Program Files directory
                            • Suspicious use of WriteProcessMemory
                            PID:652
                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe"
                              2⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Suspicious use of WriteProcessMemory
                              PID:1460
                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                3⤵
                                • Executes dropped EXE
                                PID:4764
                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                3⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4648
                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe"
                              2⤵
                              • Executes dropped EXE
                              PID:2892
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 1148
                                3⤵
                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                • Program crash
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4824
                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe"
                              2⤵
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Drops file in Program Files directory
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3520
                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:3000
                              • C:\Users\Admin\AppData\Local\Temp\is-HCQTM.tmp\LabPicV3.tmp
                                "C:\Users\Admin\AppData\Local\Temp\is-HCQTM.tmp\LabPicV3.tmp" /SL5="$10200,136934,53248,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:824
                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:944
                              • C:\Users\Admin\AppData\Local\Temp\is-U3N8T.tmp\lylal220.tmp
                                "C:\Users\Admin\AppData\Local\Temp\is-U3N8T.tmp\lylal220.tmp" /SL5="$10202,298214,214528,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2356
                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\JoSetp.exe
                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\JoSetp.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2736
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 2736 -s 1472
                                3⤵
                                • Program crash
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:864
                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LOQn7WyBrhly.exe
                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LOQn7WyBrhly.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:2100
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                3⤵
                                  PID:4112
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                  3⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4512
                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\sskiper.exe
                                "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\sskiper.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4032
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\sskiper.exe & exit
                                  3⤵
                                    PID:4184
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping 0
                                      4⤵
                                      • Runs ping.exe
                                      PID:4264
                                • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe
                                  "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1244
                                  • C:\Windows\system32\WerFault.exe
                                    C:\Windows\system32\WerFault.exe -u -p 1244 -s 1468
                                    3⤵
                                    • Program crash
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:8
                                • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe
                                  "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:196
                                • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
                                  "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:3136
                              • \??\c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                1⤵
                                • Suspicious use of SetThreadContext
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:1104
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                  2⤵
                                  • Modifies registry class
                                  PID:4128
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3988
                                • C:\Windows\SysWOW64\rundll32.exe
                                  "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                  2⤵
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:2288

                              Network

                              MITRE ATT&CK Matrix ATT&CK v6

                              Persistence

                              Registry Run Keys / Startup Folder

                              1
                              T1060

                              Defense Evasion

                              Modify Registry

                              1
                              T1112

                              Credential Access

                              Credentials in Files

                              1
                              T1081

                              Discovery

                              Query Registry

                              1
                              T1012

                              System Information Discovery

                              2
                              T1082

                              Remote System Discovery

                              1
                              T1018

                              Collection

                              Data from Local System

                              1
                              T1005

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe
                                MD5

                                c7dc028b47ab92ca5453f939825cf367

                                SHA1

                                e13033f7711de668b09ca555df985cb62e56d12e

                                SHA256

                                9f34d20254c87d8f9c732df75eb5b707c41fd6cd5153f5e4733a0126ed304f0d

                                SHA512

                                49f9db82dbc9be1a00605d20c576dd56284cb734e4468bb693506112f0b03ca4c8f204b1d3a41c6527779e8871b182975477cf996567a4617eae695053f0fd0a

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe
                                MD5

                                c7dc028b47ab92ca5453f939825cf367

                                SHA1

                                e13033f7711de668b09ca555df985cb62e56d12e

                                SHA256

                                9f34d20254c87d8f9c732df75eb5b707c41fd6cd5153f5e4733a0126ed304f0d

                                SHA512

                                49f9db82dbc9be1a00605d20c576dd56284cb734e4468bb693506112f0b03ca4c8f204b1d3a41c6527779e8871b182975477cf996567a4617eae695053f0fd0a

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\JoSetp.exe
                                MD5

                                d2f9b038e689ac9fc99352bd766690e4

                                SHA1

                                19380ac92419895626cc9b9d7b6ecdd183a81e30

                                SHA256

                                8b6be03e0a14f193dd33c6dfdc1a1c27d3d59044ea246b3a12eb4a7d790dd4ed

                                SHA512

                                0d9b801661eea6c0499b46e8acc929196bf8130d989bb4e5e8d94c19bef3412c4c43b9c232f462a4c28a90786c6af21bfd2d8d611e3b7820b5c7a01e668ce3eb

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\JoSetp.exe
                                MD5

                                d2f9b038e689ac9fc99352bd766690e4

                                SHA1

                                19380ac92419895626cc9b9d7b6ecdd183a81e30

                                SHA256

                                8b6be03e0a14f193dd33c6dfdc1a1c27d3d59044ea246b3a12eb4a7d790dd4ed

                                SHA512

                                0d9b801661eea6c0499b46e8acc929196bf8130d989bb4e5e8d94c19bef3412c4c43b9c232f462a4c28a90786c6af21bfd2d8d611e3b7820b5c7a01e668ce3eb

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LOQn7WyBrhly.exe
                                MD5

                                054daf924a5537dea562d6b1bea7ebd7

                                SHA1

                                5ca2df89fa45d5fe8544033cad2e5116417761b6

                                SHA256

                                4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175

                                SHA512

                                a118c2a0d4056d611c90d9c16bafde79799afdba01adcf905c8c044facf78ed36e630e6bda8323c23a7331a14cf15a2a3c9226fb3e559e466896123c025b8e25

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LOQn7WyBrhly.exe
                                MD5

                                054daf924a5537dea562d6b1bea7ebd7

                                SHA1

                                5ca2df89fa45d5fe8544033cad2e5116417761b6

                                SHA256

                                4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175

                                SHA512

                                a118c2a0d4056d611c90d9c16bafde79799afdba01adcf905c8c044facf78ed36e630e6bda8323c23a7331a14cf15a2a3c9226fb3e559e466896123c025b8e25

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
                                MD5

                                a5e356d8cc0b55e0653d995a626fae90

                                SHA1

                                5515b37818785b96218880d199144336f8f3d962

                                SHA256

                                6cae92665b23b4bccccd25fad925b745ad83e700b1775a6cabae079b5741accd

                                SHA512

                                e425a5f6ede8f57529fe88ab2cc04cd614d8286d0447ad48701747fec8b8b9a7aa68b9d3fabad026e3943aa74e6a8c9037cb81af069fe3bf1ab05e54cfa9b935

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
                                MD5

                                a5e356d8cc0b55e0653d995a626fae90

                                SHA1

                                5515b37818785b96218880d199144336f8f3d962

                                SHA256

                                6cae92665b23b4bccccd25fad925b745ad83e700b1775a6cabae079b5741accd

                                SHA512

                                e425a5f6ede8f57529fe88ab2cc04cd614d8286d0447ad48701747fec8b8b9a7aa68b9d3fabad026e3943aa74e6a8c9037cb81af069fe3bf1ab05e54cfa9b935

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
                                MD5

                                9af6219e731b854966b85d001c4b5148

                                SHA1

                                ca7112b83f69c7624f662db47cfd3a0e9b161654

                                SHA256

                                b130e4f675b2ef7722dbfa22c9491cd1077af47957c0411c4d6a8e3d4f8b2620

                                SHA512

                                f460e73eb23004d41bca4bbe960cc1775e6f815ecd480ff85e65286b35c18824be6e1ff9300963eef74a4032e98b16e705f44aa9212634d1afa17137433275be

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
                                MD5

                                9af6219e731b854966b85d001c4b5148

                                SHA1

                                ca7112b83f69c7624f662db47cfd3a0e9b161654

                                SHA256

                                b130e4f675b2ef7722dbfa22c9491cd1077af47957c0411c4d6a8e3d4f8b2620

                                SHA512

                                f460e73eb23004d41bca4bbe960cc1775e6f815ecd480ff85e65286b35c18824be6e1ff9300963eef74a4032e98b16e705f44aa9212634d1afa17137433275be

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe
                                MD5

                                eceff2a609e8a7e4fd459a38f28e5148

                                SHA1

                                ca07579aa9c9b0a95bf757d40a77fb9ed591adbf

                                SHA256

                                61935cfb53dcf1cd5a8c7c8449daf78f68ab53243fca0e715f7eb0940155acfe

                                SHA512

                                08cd0776a05fb756443c51a2af38f0811e20ff0151f14c75b2720471527a11f5d70359f802ca2e8a62dfbb6aeed9a1fef0c23b0ff7631844ae7208cd95293f8a

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe
                                MD5

                                eceff2a609e8a7e4fd459a38f28e5148

                                SHA1

                                ca07579aa9c9b0a95bf757d40a77fb9ed591adbf

                                SHA256

                                61935cfb53dcf1cd5a8c7c8449daf78f68ab53243fca0e715f7eb0940155acfe

                                SHA512

                                08cd0776a05fb756443c51a2af38f0811e20ff0151f14c75b2720471527a11f5d70359f802ca2e8a62dfbb6aeed9a1fef0c23b0ff7631844ae7208cd95293f8a

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
                                MD5

                                300955d4464b65c8e70e69aed0d349c4

                                SHA1

                                5c3c55482549c07d3be6f52f92291bdcec365465

                                SHA256

                                483d120901c099b3004dd2b287e3f376cd0a70ba60ad173c6fdc964a19f5c242

                                SHA512

                                a8ae18177f4331a2e7e404e9ebf3d4b341a16b77759cc0bd3a694320449c55973f6b7985f50a17fc7f8d83ba3ef57c26f4b0db144a05d098a161073efc7725f9

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
                                MD5

                                300955d4464b65c8e70e69aed0d349c4

                                SHA1

                                5c3c55482549c07d3be6f52f92291bdcec365465

                                SHA256

                                483d120901c099b3004dd2b287e3f376cd0a70ba60ad173c6fdc964a19f5c242

                                SHA512

                                a8ae18177f4331a2e7e404e9ebf3d4b341a16b77759cc0bd3a694320449c55973f6b7985f50a17fc7f8d83ba3ef57c26f4b0db144a05d098a161073efc7725f9

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
                                MD5

                                0a427bb1c7e314e0225d73690ae697ee

                                SHA1

                                34e83125b0a48abebd6ebc1292b5baa0a697c846

                                SHA256

                                0d0f05d54c10ee2c1dad908972bbec3427ebbe2c15d2e73ad1c1aed9572eb93c

                                SHA512

                                245f9733a8c6bf64372fa42c21bf5b4ccf89099566a528f8f8bc7c9f574e985a682a9f51d41ee5fdc876684843d9e8849cc455ad3de066101840e70106340ae9

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
                                MD5

                                0a427bb1c7e314e0225d73690ae697ee

                                SHA1

                                34e83125b0a48abebd6ebc1292b5baa0a697c846

                                SHA256

                                0d0f05d54c10ee2c1dad908972bbec3427ebbe2c15d2e73ad1c1aed9572eb93c

                                SHA512

                                245f9733a8c6bf64372fa42c21bf5b4ccf89099566a528f8f8bc7c9f574e985a682a9f51d41ee5fdc876684843d9e8849cc455ad3de066101840e70106340ae9

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
                                MD5

                                36ba42b02621b4dae2335286fbea60d8

                                SHA1

                                5cec6fe37a4cfba188328ae4d328d938ab33c647

                                SHA256

                                58aaf8e5a42a7e06df4a9b179a495d8dde5f657d47fd81fbb2234f3457af3d24

                                SHA512

                                ad6cf15728f84f5fafddc3c350fcf387e406b51fc2217d2e1d032c8d30cd0a895af736c1b4b309152c4a429cd33d0b92403d75c8dae0cb093dd507f3368617bc

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
                                MD5

                                36ba42b02621b4dae2335286fbea60d8

                                SHA1

                                5cec6fe37a4cfba188328ae4d328d938ab33c647

                                SHA256

                                58aaf8e5a42a7e06df4a9b179a495d8dde5f657d47fd81fbb2234f3457af3d24

                                SHA512

                                ad6cf15728f84f5fafddc3c350fcf387e406b51fc2217d2e1d032c8d30cd0a895af736c1b4b309152c4a429cd33d0b92403d75c8dae0cb093dd507f3368617bc

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
                                MD5

                                5d26d0386032fc7572ae05b2250aa929

                                SHA1

                                fac05348d973dee4ca7ccddd578d9849237b6700

                                SHA256

                                f2d5134592f0824332a666e93dad4612289077bb6bd6d961993d1322d2396918

                                SHA512

                                ad0c5936ad06dcca36b49a98f7306cb224ca4045e720300a739af44982ad91a0ba47995971220efa940c5522447d64772416cc0f481839612fdb707d1cfad166

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
                                MD5

                                5d26d0386032fc7572ae05b2250aa929

                                SHA1

                                fac05348d973dee4ca7ccddd578d9849237b6700

                                SHA256

                                f2d5134592f0824332a666e93dad4612289077bb6bd6d961993d1322d2396918

                                SHA512

                                ad0c5936ad06dcca36b49a98f7306cb224ca4045e720300a739af44982ad91a0ba47995971220efa940c5522447d64772416cc0f481839612fdb707d1cfad166

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\sskiper.exe
                                MD5

                                12b58609913285e9a1106023c90b263f

                                SHA1

                                d2f436c54641fa90db416d414c35fe562a2a6d46

                                SHA256

                                754cc1366ca6cafb84d2ea3cb8207238feb5da59a53708781c0029b29e3553aa

                                SHA512

                                0ee6ab09f57cbf50b397762d4dcd5c90b719afac251a7ddbc7cf9ae1e6f772f0c54a990bb1aeab948650a2981939d0ade80a3e2c2cf9dd35b407bd80689180b5

                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\sskiper.exe
                                MD5

                                12b58609913285e9a1106023c90b263f

                                SHA1

                                d2f436c54641fa90db416d414c35fe562a2a6d46

                                SHA256

                                754cc1366ca6cafb84d2ea3cb8207238feb5da59a53708781c0029b29e3553aa

                                SHA512

                                0ee6ab09f57cbf50b397762d4dcd5c90b719afac251a7ddbc7cf9ae1e6f772f0c54a990bb1aeab948650a2981939d0ade80a3e2c2cf9dd35b407bd80689180b5

                              • C:\Program Files\unins.vbs
                                MD5

                                6074e379e89c51463ee3a32ff955686a

                                SHA1

                                0c2772c9333bb1fe35b7e30584cefabdf29f71d1

                                SHA256

                                3d4716dfe7a52575a064590797413b4d00f2366a77af43cf83b131ab43df145e

                                SHA512

                                0522292e85b179727b62271763eecb23a2042f46023336034ae8f477cd25a65e12519582d08999116d193e6e105753685356b0244c451139a21d4174fb4f6933

                              • C:\Program Files\unins0000.dat
                                MD5

                                66aa1d295133c473056df37204705394

                                SHA1

                                615468268bad6eb324a843c721860668922a9c78

                                SHA256

                                25c2dd1628cb23bd89be30b0cea72711d37641e84ed31d2077189af27d8bfbe5

                                SHA512

                                ccb01aa2b6b40e79cff66f97e0cecdb05300457ea2c1c018c6420ce78d5ab7199267bc0eec6bbb9eb1c2f23bf3afab9bdfe3954e0ca1d6647bbc65f3ef8d8780

                              • C:\Program Files\unins0000.dll
                                MD5

                                466f323c95e55fe27ab923372dffff50

                                SHA1

                                b2dc4328c22fd348223f22db5eca386177408214

                                SHA256

                                6bfb49245a5a92113a71f731fc22fbb8397f836a123b3267196a2a4f8dd70c5c

                                SHA512

                                60e242f873d76f77ec7486460d1181468ed060113f6331ab0a4bb540531e0526177819b1413edb316e1d133bd467cfcaacbbe6eb6f63f5b9a9777f50de39cbb6

                              • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                MD5

                                b7161c0845a64ff6d7345b67ff97f3b0

                                SHA1

                                d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                SHA256

                                fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                SHA512

                                98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                              • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                MD5

                                b7161c0845a64ff6d7345b67ff97f3b0

                                SHA1

                                d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                SHA256

                                fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                SHA512

                                98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQTM.tmp\LabPicV3.tmp
                                MD5

                                5673a015df77da85e62eca635678ea81

                                SHA1

                                ee444a69a5ce6d71b3db701cdb2101c9b3b70855

                                SHA256

                                c8f753e1b7045856846f59e08d69d816c2831f054b3ea52e5737996e1b475034

                                SHA512

                                d710519f6d1f885b8a339792443cb4bdb7c33954429ba096093dee4ed7f01a48611537eb880c671dd11a714005b72f9d25050f29c9a0b677ff0359c260a17246

                              • C:\Users\Admin\AppData\Local\Temp\is-U3N8T.tmp\lylal220.tmp
                                MD5

                                b6237bb0a4e88d9833afe473b6154137

                                SHA1

                                d1b264dcf21b222e45481532bd1012cd5efb5452

                                SHA256

                                c7f86ad3e310b1d0958c77dc51d5f1f5f6fc4cdc39a05c5050b6ed08b3b2925d

                                SHA512

                                840429b78cfc8352632595b22dea82b455f94f188b5d190ebc9cc3017aeb945c2e151bc65b82729f484d73b26ddebb54317661abe4f44fe0e64528f5700e7fb3

                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                MD5

                                a6279ec92ff948760ce53bba817d6a77

                                SHA1

                                5345505e12f9e4c6d569a226d50e71b5a572dce2

                                SHA256

                                8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                SHA512

                                213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                MD5

                                a6279ec92ff948760ce53bba817d6a77

                                SHA1

                                5345505e12f9e4c6d569a226d50e71b5a572dce2

                                SHA256

                                8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                SHA512

                                213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                MD5

                                7fee8223d6e4f82d6cd115a28f0b6d58

                                SHA1

                                1b89c25f25253df23426bd9ff6c9208f1202f58b

                                SHA256

                                a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                SHA512

                                3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                MD5

                                7fee8223d6e4f82d6cd115a28f0b6d58

                                SHA1

                                1b89c25f25253df23426bd9ff6c9208f1202f58b

                                SHA256

                                a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                SHA512

                                3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                              • \Program Files\unins0000.dll
                                MD5

                                466f323c95e55fe27ab923372dffff50

                                SHA1

                                b2dc4328c22fd348223f22db5eca386177408214

                                SHA256

                                6bfb49245a5a92113a71f731fc22fbb8397f836a123b3267196a2a4f8dd70c5c

                                SHA512

                                60e242f873d76f77ec7486460d1181468ed060113f6331ab0a4bb540531e0526177819b1413edb316e1d133bd467cfcaacbbe6eb6f63f5b9a9777f50de39cbb6

                              • \Users\Admin\AppData\Local\Temp\is-B4L4A.tmp\idp.dll
                                MD5

                                8f995688085bced38ba7795f60a5e1d3

                                SHA1

                                5b1ad67a149c05c50d6e388527af5c8a0af4343a

                                SHA256

                                203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                                SHA512

                                043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                              • \Users\Admin\AppData\Local\Temp\is-SQ90N.tmp\idp.dll
                                MD5

                                8f995688085bced38ba7795f60a5e1d3

                                SHA1

                                5b1ad67a149c05c50d6e388527af5c8a0af4343a

                                SHA256

                                203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                                SHA512

                                043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                              • memory/196-157-0x000000001B790000-0x000000001B792000-memory.dmp
                                Filesize

                                8KB

                              • memory/196-126-0x0000000000000000-mapping.dmp
                              • memory/196-133-0x0000000000C30000-0x0000000000C31000-memory.dmp
                                Filesize

                                4KB

                              • memory/340-227-0x000001A14E380000-0x000001A14E3E7000-memory.dmp
                                Filesize

                                412KB

                              • memory/824-176-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                Filesize

                                4KB

                              • memory/824-148-0x0000000000000000-mapping.dmp
                              • memory/944-130-0x0000000000000000-mapping.dmp
                              • memory/944-137-0x0000000000400000-0x000000000043B000-memory.dmp
                                Filesize

                                236KB

                              • memory/1064-235-0x000001E1F2B70000-0x000001E1F2BD7000-memory.dmp
                                Filesize

                                412KB

                              • memory/1104-190-0x00000246356E0000-0x0000024635724000-memory.dmp
                                Filesize

                                272KB

                              • memory/1104-193-0x0000024635A70000-0x0000024635AD7000-memory.dmp
                                Filesize

                                412KB

                              • memory/1108-233-0x000001FE3EC70000-0x000001FE3ECD7000-memory.dmp
                                Filesize

                                412KB

                              • memory/1224-241-0x00000220C3B70000-0x00000220C3BD7000-memory.dmp
                                Filesize

                                412KB

                              • memory/1244-169-0x0000000000F70000-0x0000000000F8F000-memory.dmp
                                Filesize

                                124KB

                              • memory/1244-173-0x0000000000F90000-0x0000000000F91000-memory.dmp
                                Filesize

                                4KB

                              • memory/1244-165-0x0000000000F50000-0x0000000000F51000-memory.dmp
                                Filesize

                                4KB

                              • memory/1244-156-0x0000000000840000-0x0000000000841000-memory.dmp
                                Filesize

                                4KB

                              • memory/1244-179-0x0000000001060000-0x0000000001062000-memory.dmp
                                Filesize

                                8KB

                              • memory/1244-139-0x0000000000000000-mapping.dmp
                              • memory/1296-243-0x0000021A3CEC0000-0x0000021A3CF27000-memory.dmp
                                Filesize

                                412KB

                              • memory/1440-237-0x0000029F58ED0000-0x0000029F58F37000-memory.dmp
                                Filesize

                                412KB

                              • memory/1460-114-0x0000000000000000-mapping.dmp
                              • memory/1460-140-0x0000000000950000-0x0000000000FA6000-memory.dmp
                                Filesize

                                6.3MB

                              • memory/1992-239-0x000001B4ED2B0000-0x000001B4ED317000-memory.dmp
                                Filesize

                                412KB

                              • memory/2100-170-0x0000000000D50000-0x0000000000D51000-memory.dmp
                                Filesize

                                4KB

                              • memory/2100-175-0x0000000005680000-0x0000000005681000-memory.dmp
                                Filesize

                                4KB

                              • memory/2100-144-0x0000000000000000-mapping.dmp
                              • memory/2100-194-0x0000000005B20000-0x0000000005B21000-memory.dmp
                                Filesize

                                4KB

                              • memory/2100-178-0x0000000005C20000-0x0000000005C21000-memory.dmp
                                Filesize

                                4KB

                              • memory/2100-181-0x0000000005650000-0x0000000005651000-memory.dmp
                                Filesize

                                4KB

                              • memory/2288-187-0x0000000004730000-0x0000000004786000-memory.dmp
                                Filesize

                                344KB

                              • memory/2288-186-0x0000000000DD0000-0x0000000000E0A000-memory.dmp
                                Filesize

                                232KB

                              • memory/2288-182-0x0000000000000000-mapping.dmp
                              • memory/2356-152-0x0000000000000000-mapping.dmp
                              • memory/2356-174-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                Filesize

                                4KB

                              • memory/2464-231-0x000001EFDC930000-0x000001EFDC997000-memory.dmp
                                Filesize

                                412KB

                              • memory/2544-229-0x000001E8ED360000-0x000001E8ED3C7000-memory.dmp
                                Filesize

                                412KB

                              • memory/2700-245-0x000001A596F10000-0x000001A596F77000-memory.dmp
                                Filesize

                                412KB

                              • memory/2724-247-0x000001C9017D0000-0x000001C901837000-memory.dmp
                                Filesize

                                412KB

                              • memory/2736-164-0x0000000000C20000-0x0000000000C21000-memory.dmp
                                Filesize

                                4KB

                              • memory/2736-177-0x000000001B160000-0x000000001B162000-memory.dmp
                                Filesize

                                8KB

                              • memory/2736-172-0x0000000000C50000-0x0000000000C51000-memory.dmp
                                Filesize

                                4KB

                              • memory/2736-134-0x0000000000000000-mapping.dmp
                              • memory/2736-155-0x0000000000500000-0x0000000000501000-memory.dmp
                                Filesize

                                4KB

                              • memory/2736-168-0x0000000000C30000-0x0000000000C4F000-memory.dmp
                                Filesize

                                124KB

                              • memory/2740-224-0x000002812EB30000-0x000002812EB97000-memory.dmp
                                Filesize

                                412KB

                              • memory/2892-117-0x0000000000000000-mapping.dmp
                              • memory/2892-192-0x0000000000400000-0x000000000088D000-memory.dmp
                                Filesize

                                4.6MB

                              • memory/2892-188-0x00000000023E0000-0x0000000002474000-memory.dmp
                                Filesize

                                592KB

                              • memory/3000-129-0x0000000000000000-mapping.dmp
                              • memory/3000-132-0x0000000000400000-0x0000000000413000-memory.dmp
                                Filesize

                                76KB

                              • memory/3136-121-0x0000000000000000-mapping.dmp
                              • memory/3520-265-0x00000000052F0000-0x00000000052F8000-memory.dmp
                                Filesize

                                32KB

                              • memory/3520-252-0x0000000003C10000-0x0000000003C20000-memory.dmp
                                Filesize

                                64KB

                              • memory/3520-258-0x0000000003DB0000-0x0000000003DC0000-memory.dmp
                                Filesize

                                64KB

                              • memory/3520-264-0x0000000004FB0000-0x0000000004FB8000-memory.dmp
                                Filesize

                                32KB

                              • memory/3520-119-0x0000000000000000-mapping.dmp
                              • memory/3988-153-0x0000000000000000-mapping.dmp
                              • memory/4032-149-0x0000000000000000-mapping.dmp
                              • memory/4128-226-0x00000200DE9D0000-0x00000200DEA37000-memory.dmp
                                Filesize

                                412KB

                              • memory/4128-196-0x00007FF7C8764060-mapping.dmp
                              • memory/4184-270-0x0000000000000000-mapping.dmp
                              • memory/4264-271-0x0000000000000000-mapping.dmp
                              • memory/4512-268-0x000000000041654E-mapping.dmp
                              • memory/4512-269-0x0000000004ED0000-0x00000000054D6000-memory.dmp
                                Filesize

                                6.0MB

                              • memory/4648-272-0x0000000000000000-mapping.dmp
                              • memory/4764-248-0x0000000000000000-mapping.dmp