Analysis

  • max time kernel
    128s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2022 19:22

General

  • Target

    4e911cde-47d4-4af4-84f8-4657bc577f8a.exe

  • Size

    675.0MB

  • MD5

    59cbf13e42daafef1f261a7fe0e9f330

  • SHA1

    ff94b79ad98737b1ae710360f5998b314342cd4c

  • SHA256

    92728090380c9a3d28d44bb5eac3c0527c675798979d02d5d85ddf296076fce0

  • SHA512

    e20c5277181688746fe8dbc00b03b48b0df94a2e5e13a4251b0774d094ba89ccc623cc3073ea00923d757366e75e62ad7f11a730ce9449d17179cde96335cee4

  • SSDEEP

    12582912:r0MytlNbY7EkSKwCTPsnzVH3KnjmIKPDCImTnDbgka+OsghoM4w9R/WMhUbjXUAL:YYDwCTPUBXyjmIzrMkZHghB4qupXp

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e911cde-47d4-4af4-84f8-4657bc577f8a.exe
    "C:\Users\Admin\AppData\Local\Temp\4e911cde-47d4-4af4-84f8-4657bc577f8a.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\NexViewPlayer.exe
      "C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\NexViewPlayer.exe" --vidfile "C:\Users\Admin\AppData\Local\Temp\4e911cde-47d4-4af4-84f8-4657bc577f8a.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:1128
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 412 -p 8 -ip 8
    1⤵
      PID:3116
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 8 -s 2468
      1⤵
      • Program crash
      PID:3600

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\GMap.NET\DllCache\SQLite_v84_NET4_x64\System.Data.SQLite.DLL

      Filesize

      1.2MB

      MD5

      4fee1e7ec3ee882c08a617305fe5408c

      SHA1

      9f6d20625bf0a3f2c71486838b87ed8738fda53e

      SHA256

      387cf86773b9ddfcfd3029cf8512ea6eb33d391254eeedda49ed9afab0b860db

      SHA512

      4def9d8d32c37ddb065e7c7db7ba3a5b8617ed90c8a96f734e39357ff8c40dc359fb9082c510ecd89a802b72931f29a8c24144035b5242e94ef06fe79dd05bb2

    • C:\Users\Admin\AppData\Local\GMap.NET\DllCache\SQLite_v84_NET4_x64\System.Data.SQLite.DLL

      Filesize

      1.2MB

      MD5

      4fee1e7ec3ee882c08a617305fe5408c

      SHA1

      9f6d20625bf0a3f2c71486838b87ed8738fda53e

      SHA256

      387cf86773b9ddfcfd3029cf8512ea6eb33d391254eeedda49ed9afab0b860db

      SHA512

      4def9d8d32c37ddb065e7c7db7ba3a5b8617ed90c8a96f734e39357ff8c40dc359fb9082c510ecd89a802b72931f29a8c24144035b5242e94ef06fe79dd05bb2

    • C:\Users\Admin\AppData\Local\GMap.NET\DllCache\SQLite_v84_NET4_x64\System.Data.SQLite.DLL

      Filesize

      1.2MB

      MD5

      4fee1e7ec3ee882c08a617305fe5408c

      SHA1

      9f6d20625bf0a3f2c71486838b87ed8738fda53e

      SHA256

      387cf86773b9ddfcfd3029cf8512ea6eb33d391254eeedda49ed9afab0b860db

      SHA512

      4def9d8d32c37ddb065e7c7db7ba3a5b8617ed90c8a96f734e39357ff8c40dc359fb9082c510ecd89a802b72931f29a8c24144035b5242e94ef06fe79dd05bb2

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\CSCore.dll

      Filesize

      519KB

      MD5

      94a312a6fcec0e78808bcea3d8ff67f5

      SHA1

      fe760487d13f9a6f5f359036561105d4aca88a1f

      SHA256

      e835139171eb0d63b6b4e02b0997cac040c02d295648a275d4c8d28b234c8e94

      SHA512

      ecdedeee1ee4e35e4fbd2dea3a4dd8b0805166a9610a63affbfb673f2644588eacecba6b3a5a0052c202ab14c321800997512abc318d36a50b00cc86dc83ec1c

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\GMap.NET.Core.dll

      Filesize

      2.3MB

      MD5

      b30385fb1303687abefdb49c3b1a55be

      SHA1

      dd45d99d943ccdc07a971eabc5ab49712356eda9

      SHA256

      a84872432a309be7cfdb90e9b359fad448422797edae3d40cedfb913e4e8cabc

      SHA512

      1f49eecbe4aaa7ffc89865abc9416d139b4fee69138ea8ae4232a7deff9313918fb06331e6762ba40b7ecbc5f04eebb75e97ec29cedcbd40cd618dea294c88f1

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\GMap.NET.WindowsForms.dll

      Filesize

      147KB

      MD5

      feb9a6afe113994dd6b5b6ef190b571a

      SHA1

      7ff52909c1578cd03886b596bd651dcc772849f5

      SHA256

      391fb994fa6ada92ad4b46e627a929db12dbd35a96e44f919da117608e1658c4

      SHA512

      6843509cbca3ced2eebb9b316e06660e22941d14dda7ad0ab89f19e262562ea53cf19cec1500edb85cdbc0f193ffdeb0ed4c659dd8ce027e63c9584adb776e97

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\Ionic.Zlib.dll

      Filesize

      100KB

      MD5

      fe97d9b3df7a6255bea12b249b967bcf

      SHA1

      baa8cf8a1cf1eb510161a3201480ad6e4f913041

      SHA256

      a00488bddb432bf963ce4c304f97b229218e2f2269aaaa0108db1034699ed6b3

      SHA512

      eafc04e6764c4b41c74f17c441e69dc8116454322ccb4a08f14b97d7343828da6ac75d3c6c8206b581bc08f378a68f679c710c1c4aba741001a0fe1307452b4b

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\NexViewPlayer.exe

      Filesize

      44KB

      MD5

      a6707cb06f43eb2357e23a83a78a77d2

      SHA1

      e82c1fc3f277b59cfb45b0fda7ff437da79dca74

      SHA256

      a9cfec3a51dfae35230bb040b7a60184f2c63bb3118faa4472ca3294f2607faf

      SHA512

      31c64e7bc25796500d231ee6a6f1284b58a84dc37654c161d98d728ebc96508c07e91d1bb5eeac4add3aebf27f9bf0217e813573707ab3aab4ecd5b20a5f0a18

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\NexViewPlayer.exe

      Filesize

      44KB

      MD5

      a6707cb06f43eb2357e23a83a78a77d2

      SHA1

      e82c1fc3f277b59cfb45b0fda7ff437da79dca74

      SHA256

      a9cfec3a51dfae35230bb040b7a60184f2c63bb3118faa4472ca3294f2607faf

      SHA512

      31c64e7bc25796500d231ee6a6f1284b58a84dc37654c161d98d728ebc96508c07e91d1bb5eeac4add3aebf27f9bf0217e813573707ab3aab4ecd5b20a5f0a18

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\SQLite.Interop.dll

      Filesize

      1.4MB

      MD5

      be061c3806fd219cbb5cc59933fa832c

      SHA1

      14b30781a22aaa373ad6841afef5603bd9623ee6

      SHA256

      57bd20d330834cda1c14a980754581309888d9a86ad9661bf0f3900b8aed1c0b

      SHA512

      67383936dadddfa5e08c6e659ed255def35677b2096bdf35215c1cc2be1da3a81660ae6782c39e554ee5135eff9dca804d01bb84fd65c9d89258b0e2be18d18f

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\SQLite.Interop.dll

      Filesize

      1.4MB

      MD5

      be061c3806fd219cbb5cc59933fa832c

      SHA1

      14b30781a22aaa373ad6841afef5603bd9623ee6

      SHA256

      57bd20d330834cda1c14a980754581309888d9a86ad9661bf0f3900b8aed1c0b

      SHA512

      67383936dadddfa5e08c6e659ed255def35677b2096bdf35215c1cc2be1da3a81660ae6782c39e554ee5135eff9dca804d01bb84fd65c9d89258b0e2be18d18f

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\SharpDX.DXGI.dll

      Filesize

      144KB

      MD5

      6ef1660fa72ae938408ccab4d2e1fb1c

      SHA1

      404c817da3e7d87e0559eb9ce2bf4748ade01f0d

      SHA256

      b056b7a36a2455921cdfcfb93f98dbd55bc157fe2df0dd23421ea35baec93e83

      SHA512

      294bfd3e5a8a8b503bd62addb2124927dec60138d06b2ba771b3310a94632b96ed41e80adbad8f0d19ae68ab41f8c7a03160ccb0aa6aa798e448a92c4e3ad979

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\SharpDX.Direct2D1.dll

      Filesize

      483KB

      MD5

      a78511f4eeefcaa3f24acc897d3a0a19

      SHA1

      ab887d51cfd191a0ded7af22e8815a259ff60ffa

      SHA256

      54eccc750908a6759c94a2bcc63d11faa5efb592de068a44a4c465805a2df5a5

      SHA512

      ecfcf6d4390365f02900c5d12846c5f3efb16541ad4805841aae41680289a7f772f69d2c4b0086f7d4325fc412b26748af84b7ab625be7c522cbbd780f180808

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\SharpDX.Direct3D11.dll

      Filesize

      276KB

      MD5

      7e962965b63f0cdcc79e9f7b3aeb03d2

      SHA1

      dc83be1eabfa0e0b3513b43b041f8ef825b832ee

      SHA256

      6b877340391410aea1c0657595ba47b1079fc8e76fda1305bec568a494f9c6a9

      SHA512

      9b1c1e22edf4014546d0ca895e0d171bb926481db7797cc70ebdb67f795de5f69c617fc749f56076a04a1971e4652f864a000c3ee5ae1617e89894983cd6354a

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\SharpDX.Direct3D9.dll

      Filesize

      331KB

      MD5

      f08ebb8c487125ebca8df081f050510b

      SHA1

      e0a28ba87d3c627a6d5024b97887e28f24fd697e

      SHA256

      5ee7451bd6d5a59701f0427ab56b58323b56be80af0bb01e62ef1d32e2614451

      SHA512

      3fffc88b7463a0b4fb580d90e8d8857ecd3de0844b696178b3766138cd899ce79847ccaf844bec58378f863d9745561a3b288af2f4e496248c61bc81cbe1773a

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\SharpDX.dll

      Filesize

      269KB

      MD5

      28f953a0985f1be3f5df7ab776cdca46

      SHA1

      2dad619e3831253c1699e1bb21a110b8815b9244

      SHA256

      04a9e6726924f3f29c0c67b979044374c2c251b7a95b0fd43f1d7b237bc50b3e

      SHA512

      60c4f7809014c2673415ff196f8e9a43758214739c75384e1aa0aae71d04b9b2b530c4f82ca65264961c6b6be3ab4e3a74e94c5e8809d86f577905fcc6bdc6f1

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\System.Data.SQLite.dll

      Filesize

      355KB

      MD5

      fd3874b6c0733eabe7e9c8df6cfb4d6b

      SHA1

      8f75a506baea72293485bfa3f77d221957011cb2

      SHA256

      93bb35bb3bc74bfa8016eb335a18fd89a8b3678bd4073108122d5d9af94e655e

      SHA512

      169a1eb4952f037d6dbd53a9b74e6671770a2c6d000776c497c34586c494f616c3b9325e1fe75fea00bc23268d02a8c5f895bb05290f9d159c8e7d8087d3f80d

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Codec.H264GopDecoder.dll

      Filesize

      100KB

      MD5

      1e8f899462a7c291a7e54800d9320873

      SHA1

      2dc63b6cd0e176b2d2f0da3c2041d8fc04f09494

      SHA256

      bea3c659363f9d48938b41bd798e2110478bfa41efff44add2464ad76eb67480

      SHA512

      6960bf684c6ef73fc99bcc8b9c24fa3982246eeae09599e9edb7f279855c3a9ba00d2c7c976643dd8243c0ff1cc4518b966ada66523507e5b5748317172928ed

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Codec.H264GopDecoder.dll

      Filesize

      100KB

      MD5

      1e8f899462a7c291a7e54800d9320873

      SHA1

      2dc63b6cd0e176b2d2f0da3c2041d8fc04f09494

      SHA256

      bea3c659363f9d48938b41bd798e2110478bfa41efff44add2464ad76eb67480

      SHA512

      6960bf684c6ef73fc99bcc8b9c24fa3982246eeae09599e9edb7f279855c3a9ba00d2c7c976643dd8243c0ff1cc4518b966ada66523507e5b5748317172928ed

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Codec.H264GopDecoder.dll

      Filesize

      100KB

      MD5

      1e8f899462a7c291a7e54800d9320873

      SHA1

      2dc63b6cd0e176b2d2f0da3c2041d8fc04f09494

      SHA256

      bea3c659363f9d48938b41bd798e2110478bfa41efff44add2464ad76eb67480

      SHA512

      6960bf684c6ef73fc99bcc8b9c24fa3982246eeae09599e9edb7f279855c3a9ba00d2c7c976643dd8243c0ff1cc4518b966ada66523507e5b5748317172928ed

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Codec.H264GopDecoder.dll

      Filesize

      100KB

      MD5

      1e8f899462a7c291a7e54800d9320873

      SHA1

      2dc63b6cd0e176b2d2f0da3c2041d8fc04f09494

      SHA256

      bea3c659363f9d48938b41bd798e2110478bfa41efff44add2464ad76eb67480

      SHA512

      6960bf684c6ef73fc99bcc8b9c24fa3982246eeae09599e9edb7f279855c3a9ba00d2c7c976643dd8243c0ff1cc4518b966ada66523507e5b5748317172928ed

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Common.DataHub.dll

      Filesize

      66KB

      MD5

      c652bacea238142c3b1367ba2414bbfc

      SHA1

      76b33aacf032276f099b10152fed1c32fcb79ce9

      SHA256

      b7b4d83119e40babffba8a6ab830e365edc797b53e9201f0a2b5b75f1973870f

      SHA512

      2691aa59bc2409de1729797070ad6db61162d1a38c341e2df2591f11aa7578ac7b277c9e256a89521dcf2f696cfd78dd5591eec1d6e8c7c9baed9780d31d0404

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Common.DataHub.dll

      Filesize

      66KB

      MD5

      c652bacea238142c3b1367ba2414bbfc

      SHA1

      76b33aacf032276f099b10152fed1c32fcb79ce9

      SHA256

      b7b4d83119e40babffba8a6ab830e365edc797b53e9201f0a2b5b75f1973870f

      SHA512

      2691aa59bc2409de1729797070ad6db61162d1a38c341e2df2591f11aa7578ac7b277c9e256a89521dcf2f696cfd78dd5591eec1d6e8c7c9baed9780d31d0404

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Common.DataHub.dll

      Filesize

      66KB

      MD5

      c652bacea238142c3b1367ba2414bbfc

      SHA1

      76b33aacf032276f099b10152fed1c32fcb79ce9

      SHA256

      b7b4d83119e40babffba8a6ab830e365edc797b53e9201f0a2b5b75f1973870f

      SHA512

      2691aa59bc2409de1729797070ad6db61162d1a38c341e2df2591f11aa7578ac7b277c9e256a89521dcf2f696cfd78dd5591eec1d6e8c7c9baed9780d31d0404

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Common.dll

      Filesize

      146KB

      MD5

      8adb6e36af05f5465bc1e15664ec56f9

      SHA1

      ef536bff046a611f3baeac124a3f8fc64d3e00c6

      SHA256

      8b1389d5361fb61f337a279c5e59f573e065e78a894f16d5acb0f9197d49bdb0

      SHA512

      4f2b8f7a1c67a7b82c6b140047836544e66a98d5bdf7a50db272dadc8a9ca8987f4e36a98035a00898da280056471a1baba6ec771744ffeaabed37cca1892ff6

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Common.dll

      Filesize

      146KB

      MD5

      8adb6e36af05f5465bc1e15664ec56f9

      SHA1

      ef536bff046a611f3baeac124a3f8fc64d3e00c6

      SHA256

      8b1389d5361fb61f337a279c5e59f573e065e78a894f16d5acb0f9197d49bdb0

      SHA512

      4f2b8f7a1c67a7b82c6b140047836544e66a98d5bdf7a50db272dadc8a9ca8987f4e36a98035a00898da280056471a1baba6ec771744ffeaabed37cca1892ff6

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Common.dll

      Filesize

      146KB

      MD5

      8adb6e36af05f5465bc1e15664ec56f9

      SHA1

      ef536bff046a611f3baeac124a3f8fc64d3e00c6

      SHA256

      8b1389d5361fb61f337a279c5e59f573e065e78a894f16d5acb0f9197d49bdb0

      SHA512

      4f2b8f7a1c67a7b82c6b140047836544e66a98d5bdf7a50db272dadc8a9ca8987f4e36a98035a00898da280056471a1baba6ec771744ffeaabed37cca1892ff6

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.ImageControl.dll

      Filesize

      541KB

      MD5

      fb9fae3cbc5759ae6a8b0c23b77b967a

      SHA1

      bb6acc4d453097f103a8d9ef3eddeb18b09d4552

      SHA256

      3c09066a82ffe69edcb2a457cbf09b87e5613f6096d5a55e4237ebc94d1a804a

      SHA512

      f529e62a965073766defe4a2d6d90e4a0ad5e0f6fd52f010bcdc5693c0e8746066feaae44980ca65bd725ae6422de907952810439fb16de0ccfa3c8d9b869b51

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.ImageControl.dll

      Filesize

      541KB

      MD5

      fb9fae3cbc5759ae6a8b0c23b77b967a

      SHA1

      bb6acc4d453097f103a8d9ef3eddeb18b09d4552

      SHA256

      3c09066a82ffe69edcb2a457cbf09b87e5613f6096d5a55e4237ebc94d1a804a

      SHA512

      f529e62a965073766defe4a2d6d90e4a0ad5e0f6fd52f010bcdc5693c0e8746066feaae44980ca65bd725ae6422de907952810439fb16de0ccfa3c8d9b869b51

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.ImageControl.dll

      Filesize

      541KB

      MD5

      fb9fae3cbc5759ae6a8b0c23b77b967a

      SHA1

      bb6acc4d453097f103a8d9ef3eddeb18b09d4552

      SHA256

      3c09066a82ffe69edcb2a457cbf09b87e5613f6096d5a55e4237ebc94d1a804a

      SHA512

      f529e62a965073766defe4a2d6d90e4a0ad5e0f6fd52f010bcdc5693c0e8746066feaae44980ca65bd725ae6422de907952810439fb16de0ccfa3c8d9b869b51

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.MetaDataDisplay.dll

      Filesize

      270KB

      MD5

      5697e00f780532690391a34f77b15937

      SHA1

      cf58682c13b02855fa176b62a8bbdc46153f0ad8

      SHA256

      9e7735edba25b738f230b8671378169d68e9bf71710799fd8f4a01191a2346ea

      SHA512

      f449f3f932b29470dbe303e466f9271035382572e46f9553e4d19a6ac9f4d775908fceb714ab451b3bdc94a13b8bf5af29303e69f07fbc5481215f8d4cca217e

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.MetaDataDisplay.dll

      Filesize

      270KB

      MD5

      5697e00f780532690391a34f77b15937

      SHA1

      cf58682c13b02855fa176b62a8bbdc46153f0ad8

      SHA256

      9e7735edba25b738f230b8671378169d68e9bf71710799fd8f4a01191a2346ea

      SHA512

      f449f3f932b29470dbe303e466f9271035382572e46f9553e4d19a6ac9f4d775908fceb714ab451b3bdc94a13b8bf5af29303e69f07fbc5481215f8d4cca217e

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.MetaDataDisplay.dll

      Filesize

      270KB

      MD5

      5697e00f780532690391a34f77b15937

      SHA1

      cf58682c13b02855fa176b62a8bbdc46153f0ad8

      SHA256

      9e7735edba25b738f230b8671378169d68e9bf71710799fd8f4a01191a2346ea

      SHA512

      f449f3f932b29470dbe303e466f9271035382572e46f9553e4d19a6ac9f4d775908fceb714ab451b3bdc94a13b8bf5af29303e69f07fbc5481215f8d4cca217e

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.Timeline.dll

      Filesize

      44KB

      MD5

      94d9f6dbd2fa9e7e4e706dd941ad4f0e

      SHA1

      9cfb3be11d647337f7947555c00b38d26d2e5add

      SHA256

      79c6b7f896927dbd5af96b0c3d5e7f1a9478d1e6a5c0cd547c731638120bf3ad

      SHA512

      0966387b6a44fa51b1533de55bd966e93c7394bcebe7fefb79656d6ba29771528d12395ea09334b42468a23f777758b7f3dfcc272c6172d3e9cbd3841c26bec6

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.Timeline.dll

      Filesize

      44KB

      MD5

      94d9f6dbd2fa9e7e4e706dd941ad4f0e

      SHA1

      9cfb3be11d647337f7947555c00b38d26d2e5add

      SHA256

      79c6b7f896927dbd5af96b0c3d5e7f1a9478d1e6a5c0cd547c731638120bf3ad

      SHA512

      0966387b6a44fa51b1533de55bd966e93c7394bcebe7fefb79656d6ba29771528d12395ea09334b42468a23f777758b7f3dfcc272c6172d3e9cbd3841c26bec6

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.Timeline.dll

      Filesize

      44KB

      MD5

      94d9f6dbd2fa9e7e4e706dd941ad4f0e

      SHA1

      9cfb3be11d647337f7947555c00b38d26d2e5add

      SHA256

      79c6b7f896927dbd5af96b0c3d5e7f1a9478d1e6a5c0cd547c731638120bf3ad

      SHA512

      0966387b6a44fa51b1533de55bd966e93c7394bcebe7fefb79656d6ba29771528d12395ea09334b42468a23f777758b7f3dfcc272c6172d3e9cbd3841c26bec6

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.VideoAudioReview.dll

      Filesize

      225KB

      MD5

      d5170094843a3bfb1a9be225788df6b9

      SHA1

      0d547ec744668f599b616df8ffb5361dc1f049a3

      SHA256

      106737c4927d75c110713efea384dc5413f07ddd6b7709cbd2d531043258cdf6

      SHA512

      ea336c2c6b5373f7e5181390320c6a7c0744b26bf8dc3a70ff11068b2735f187d0f0eaab5914ab73071d7b2cd1da7ad57b904d6d7e38fc07aad6295aec77d202

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.VideoAudioReview.dll

      Filesize

      225KB

      MD5

      d5170094843a3bfb1a9be225788df6b9

      SHA1

      0d547ec744668f599b616df8ffb5361dc1f049a3

      SHA256

      106737c4927d75c110713efea384dc5413f07ddd6b7709cbd2d531043258cdf6

      SHA512

      ea336c2c6b5373f7e5181390320c6a7c0744b26bf8dc3a70ff11068b2735f187d0f0eaab5914ab73071d7b2cd1da7ad57b904d6d7e38fc07aad6295aec77d202

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.VideoAudioReview.dll

      Filesize

      225KB

      MD5

      d5170094843a3bfb1a9be225788df6b9

      SHA1

      0d547ec744668f599b616df8ffb5361dc1f049a3

      SHA256

      106737c4927d75c110713efea384dc5413f07ddd6b7709cbd2d531043258cdf6

      SHA512

      ea336c2c6b5373f7e5181390320c6a7c0744b26bf8dc3a70ff11068b2735f187d0f0eaab5914ab73071d7b2cd1da7ad57b904d6d7e38fc07aad6295aec77d202

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.VideoDisplay.dll

      Filesize

      57KB

      MD5

      ddc9af9000a6358a29ee8481bcd06f65

      SHA1

      213850227adc2b9e965b028b9e0b331feab8338e

      SHA256

      fc7bc66ec97655cbdd24c01be5d90d99d1ddd77e6681fb6ee3f58777c2701d23

      SHA512

      430260923689cd95af38d932c794dd4c25ff1eedef25f3b5a9bf0c663684f36fd672de361ce65e946d82cf8c5e761d2d92ddaa0774ba5bd6b81dcd6084c1618a

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.VideoDisplay.dll

      Filesize

      57KB

      MD5

      ddc9af9000a6358a29ee8481bcd06f65

      SHA1

      213850227adc2b9e965b028b9e0b331feab8338e

      SHA256

      fc7bc66ec97655cbdd24c01be5d90d99d1ddd77e6681fb6ee3f58777c2701d23

      SHA512

      430260923689cd95af38d932c794dd4c25ff1eedef25f3b5a9bf0c663684f36fd672de361ce65e946d82cf8c5e761d2d92ddaa0774ba5bd6b81dcd6084c1618a

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Controls.VideoDisplay.dll

      Filesize

      57KB

      MD5

      ddc9af9000a6358a29ee8481bcd06f65

      SHA1

      213850227adc2b9e965b028b9e0b331feab8338e

      SHA256

      fc7bc66ec97655cbdd24c01be5d90d99d1ddd77e6681fb6ee3f58777c2701d23

      SHA512

      430260923689cd95af38d932c794dd4c25ff1eedef25f3b5a9bf0c663684f36fd672de361ce65e946d82cf8c5e761d2d92ddaa0774ba5bd6b81dcd6084c1618a

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Global.dll

      Filesize

      8KB

      MD5

      1fe5a2211694255a2f7e4a515bf85da5

      SHA1

      7668636bafd8a9a8cb5578d6e0c89e9a684e9523

      SHA256

      71bdaba634863e5c80e9f2f70edb51c9d352180949f8c57e2496bef4b6b8044e

      SHA512

      f9efee6c2d421e0d7195177fdb8067602e3451e5fc1dc8976ae8e0174bcd46c854085e369d90db26cf8ee83a68b3fb0497fec689f4cab86e36a2436567188200

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Global.dll

      Filesize

      8KB

      MD5

      1fe5a2211694255a2f7e4a515bf85da5

      SHA1

      7668636bafd8a9a8cb5578d6e0c89e9a684e9523

      SHA256

      71bdaba634863e5c80e9f2f70edb51c9d352180949f8c57e2496bef4b6b8044e

      SHA512

      f9efee6c2d421e0d7195177fdb8067602e3451e5fc1dc8976ae8e0174bcd46c854085e369d90db26cf8ee83a68b3fb0497fec689f4cab86e36a2436567188200

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Global.dll

      Filesize

      8KB

      MD5

      1fe5a2211694255a2f7e4a515bf85da5

      SHA1

      7668636bafd8a9a8cb5578d6e0c89e9a684e9523

      SHA256

      71bdaba634863e5c80e9f2f70edb51c9d352180949f8c57e2496bef4b6b8044e

      SHA512

      f9efee6c2d421e0d7195177fdb8067602e3451e5fc1dc8976ae8e0174bcd46c854085e369d90db26cf8ee83a68b3fb0497fec689f4cab86e36a2436567188200

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Helper.dll

      Filesize

      364KB

      MD5

      1ded367e20f9ed77b8d17a2008654951

      SHA1

      b154435eb6f82dad54ff14dbc3d8486de71a3df7

      SHA256

      b12e4e69790631ec525ef2cedf620a99e52194f838dce2cf7510fcc4d0fd0334

      SHA512

      cb86c0dcf846b0fe200a253515e0f4a4627092e342916d22a98ff8d4d4cd19b8e525bd5e30493e4212c08033634b7e87ba7ddeee50f50ab4506a0419a9acbb8f

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Helper.dll

      Filesize

      364KB

      MD5

      1ded367e20f9ed77b8d17a2008654951

      SHA1

      b154435eb6f82dad54ff14dbc3d8486de71a3df7

      SHA256

      b12e4e69790631ec525ef2cedf620a99e52194f838dce2cf7510fcc4d0fd0334

      SHA512

      cb86c0dcf846b0fe200a253515e0f4a4627092e342916d22a98ff8d4d4cd19b8e525bd5e30493e4212c08033634b7e87ba7ddeee50f50ab4506a0419a9acbb8f

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Helper.dll

      Filesize

      364KB

      MD5

      1ded367e20f9ed77b8d17a2008654951

      SHA1

      b154435eb6f82dad54ff14dbc3d8486de71a3df7

      SHA256

      b12e4e69790631ec525ef2cedf620a99e52194f838dce2cf7510fcc4d0fd0334

      SHA512

      cb86c0dcf846b0fe200a253515e0f4a4627092e342916d22a98ff8d4d4cd19b8e525bd5e30493e4212c08033634b7e87ba7ddeee50f50ab4506a0419a9acbb8f

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.R.OEM.dll

      Filesize

      192KB

      MD5

      82379e10d545703dfb0e024b856477d3

      SHA1

      83292598c2eff34040a9665140808eda47f4d5c7

      SHA256

      b233645f616c585494db9b88c14803103497a2c509041361498cfeab5ea52029

      SHA512

      3e20b26aa8982cc8364f034767a6564671168617c06e6946b3349af72b9513c880198a4432a2cbc87cee47f8d1a49c6f32ff1033d0f53607047bbc93b0c560d1

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.R.OEM.dll

      Filesize

      192KB

      MD5

      82379e10d545703dfb0e024b856477d3

      SHA1

      83292598c2eff34040a9665140808eda47f4d5c7

      SHA256

      b233645f616c585494db9b88c14803103497a2c509041361498cfeab5ea52029

      SHA512

      3e20b26aa8982cc8364f034767a6564671168617c06e6946b3349af72b9513c880198a4432a2cbc87cee47f8d1a49c6f32ff1033d0f53607047bbc93b0c560d1

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.R.OEM.dll

      Filesize

      192KB

      MD5

      82379e10d545703dfb0e024b856477d3

      SHA1

      83292598c2eff34040a9665140808eda47f4d5c7

      SHA256

      b233645f616c585494db9b88c14803103497a2c509041361498cfeab5ea52029

      SHA512

      3e20b26aa8982cc8364f034767a6564671168617c06e6946b3349af72b9513c880198a4432a2cbc87cee47f8d1a49c6f32ff1033d0f53607047bbc93b0c560d1

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.R.dll

      Filesize

      479KB

      MD5

      58b3580d018b970aaf02e47bb165296b

      SHA1

      6ca6c1ab45d38f718c5546a2bf980d90fe984210

      SHA256

      c800478e108b736124c1f5ba1f3d2ef6902ab8c15c7a129e246ec629ba161a67

      SHA512

      b81c51a9c76e7a51c37cfede8a4109ee298a1b1768321c40789431efb7b66d12489b8a6e216a98d77206a1800554a3c519b2d6c90f5ecd3e1d60b947b4ad16f1

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.R.dll

      Filesize

      479KB

      MD5

      58b3580d018b970aaf02e47bb165296b

      SHA1

      6ca6c1ab45d38f718c5546a2bf980d90fe984210

      SHA256

      c800478e108b736124c1f5ba1f3d2ef6902ab8c15c7a129e246ec629ba161a67

      SHA512

      b81c51a9c76e7a51c37cfede8a4109ee298a1b1768321c40789431efb7b66d12489b8a6e216a98d77206a1800554a3c519b2d6c90f5ecd3e1d60b947b4ad16f1

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.R.dll

      Filesize

      479KB

      MD5

      58b3580d018b970aaf02e47bb165296b

      SHA1

      6ca6c1ab45d38f718c5546a2bf980d90fe984210

      SHA256

      c800478e108b736124c1f5ba1f3d2ef6902ab8c15c7a129e246ec629ba161a67

      SHA512

      b81c51a9c76e7a51c37cfede8a4109ee298a1b1768321c40789431efb7b66d12489b8a6e216a98d77206a1800554a3c519b2d6c90f5ecd3e1d60b947b4ad16f1

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Storage.File.dll

      Filesize

      58KB

      MD5

      31eb98eee3afb8522bd4488ba7ad5121

      SHA1

      7d023ab9d44be27efe77fce62a62845ce9ac6ad7

      SHA256

      c2b56ca5f3ee979772776a8073c2a106427c69f9d7a3a0555c9690cf945776c4

      SHA512

      94a8b7b6762a42a759f532777ac17768d10c106b0b75f8b8d72d7a150d97d3a076c981b9a7626c903718f5912635f4abfcfd2a254c72fe41d00ac4a4d4f0ddda

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Storage.File.dll

      Filesize

      58KB

      MD5

      31eb98eee3afb8522bd4488ba7ad5121

      SHA1

      7d023ab9d44be27efe77fce62a62845ce9ac6ad7

      SHA256

      c2b56ca5f3ee979772776a8073c2a106427c69f9d7a3a0555c9690cf945776c4

      SHA512

      94a8b7b6762a42a759f532777ac17768d10c106b0b75f8b8d72d7a150d97d3a076c981b9a7626c903718f5912635f4abfcfd2a254c72fe41d00ac4a4d4f0ddda

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\VGN.Storage.File.dll

      Filesize

      58KB

      MD5

      31eb98eee3afb8522bd4488ba7ad5121

      SHA1

      7d023ab9d44be27efe77fce62a62845ce9ac6ad7

      SHA256

      c2b56ca5f3ee979772776a8073c2a106427c69f9d7a3a0555c9690cf945776c4

      SHA512

      94a8b7b6762a42a759f532777ac17768d10c106b0b75f8b8d72d7a150d97d3a076c981b9a7626c903718f5912635f4abfcfd2a254c72fe41d00ac4a4d4f0ddda

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\Xceed.Wpf.Toolkit.dll

      Filesize

      1.1MB

      MD5

      77e31ded089e5995f2a2950875c3d393

      SHA1

      7698e11ae0533cff7edf07bf50e636f74ce28882

      SHA256

      4bce43cc2a564fffd66d76bd34addc14ee552f753674addf24faf706911d9d16

      SHA512

      8e15e8379c7a75ec02e0a2da70e91af5ce0580524fa57cfa7602edbe5c890e427c2f1c3524c3b54542155d1796e1463008a838149c3b75a429ebfa8fcc82d03a

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\avcodec-57.dll

      Filesize

      3.0MB

      MD5

      199b0cfe4e38624cb5c31fe93a3307ce

      SHA1

      88abd78e1c96dd010a4ced184404db0151b46e42

      SHA256

      97a06c7a77f3350684bc9748f8a2b68ea541fe9119c5d26a4ed75e1a94bb4c27

      SHA512

      f30ca82468fc14afec29fe69cc86afa34ac5b1baf42253c2fdedebeee9cbfa2c2a2474b92e6171d49199500099ee4afa79fb8be4606d9bb523028068a20b4b91

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\avcodec-57.dll

      Filesize

      3.0MB

      MD5

      199b0cfe4e38624cb5c31fe93a3307ce

      SHA1

      88abd78e1c96dd010a4ced184404db0151b46e42

      SHA256

      97a06c7a77f3350684bc9748f8a2b68ea541fe9119c5d26a4ed75e1a94bb4c27

      SHA512

      f30ca82468fc14afec29fe69cc86afa34ac5b1baf42253c2fdedebeee9cbfa2c2a2474b92e6171d49199500099ee4afa79fb8be4606d9bb523028068a20b4b91

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\avutil-55.dll

      Filesize

      575KB

      MD5

      afb25b0979dc79bc2f118dc2b8bc1a55

      SHA1

      0a8742681f887bb712ac31aac75eb1a86c03884e

      SHA256

      2826b0971f1e2a24b63862267b70fdc8551492ae2f82d2024616ba7e8e51085c

      SHA512

      48bceffa83e83d3fc7a6aa290f9e86b3ef627dabce79544aa05aaf5e96a64f729db0ef12d6de9f37ee1d7f0d6de8a84ec6d2b4039be402d170425da1349c5295

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\avutil-55.dll

      Filesize

      575KB

      MD5

      afb25b0979dc79bc2f118dc2b8bc1a55

      SHA1

      0a8742681f887bb712ac31aac75eb1a86c03884e

      SHA256

      2826b0971f1e2a24b63862267b70fdc8551492ae2f82d2024616ba7e8e51085c

      SHA512

      48bceffa83e83d3fc7a6aa290f9e86b3ef627dabce79544aa05aaf5e96a64f729db0ef12d6de9f37ee1d7f0d6de8a84ec6d2b4039be402d170425da1349c5295

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\swscale-4.dll

      Filesize

      518KB

      MD5

      4e811706b2abb5a5a136ad41da829f39

      SHA1

      29c1f02c37c6d40c85668697d71f6ff9ea20913b

      SHA256

      4c89a0934befede067b499c8e87dc9efb5402b56ff4b0d39ccc283b2d48d19af

      SHA512

      2324bb9b9faefe51ebf6a5b298be999189640b5c1d767e3bce8ad017e26156607322374a4f939b4586ad40ad6c131f03d0bd8f7579b7e466506ae6f04849a5ec

    • C:\Users\Admin\AppData\Local\Temp\ncsw4v4p.yqx\swscale-4.dll

      Filesize

      518KB

      MD5

      4e811706b2abb5a5a136ad41da829f39

      SHA1

      29c1f02c37c6d40c85668697d71f6ff9ea20913b

      SHA256

      4c89a0934befede067b499c8e87dc9efb5402b56ff4b0d39ccc283b2d48d19af

      SHA512

      2324bb9b9faefe51ebf6a5b298be999189640b5c1d767e3bce8ad017e26156607322374a4f939b4586ad40ad6c131f03d0bd8f7579b7e466506ae6f04849a5ec

    • memory/1128-199-0x0000019D9C490000-0x0000019D9C4EA000-memory.dmp

      Filesize

      360KB

    • memory/1128-216-0x0000019DA1A30000-0x0000019DA1A5C000-memory.dmp

      Filesize

      176KB

    • memory/1128-235-0x0000019D9BC1A000-0x0000019D9BC1F000-memory.dmp

      Filesize

      20KB

    • memory/1128-195-0x0000019D9BFE0000-0x0000019D9C00A000-memory.dmp

      Filesize

      168KB

    • memory/1128-193-0x0000019D9C140000-0x0000019D9C18C000-memory.dmp

      Filesize

      304KB

    • memory/1128-201-0x0000019D9C390000-0x0000019D9C3DA000-memory.dmp

      Filesize

      296KB

    • memory/1128-202-0x00007FFF780D0000-0x00007FFF78B91000-memory.dmp

      Filesize

      10.8MB

    • memory/1128-158-0x0000019D81600000-0x0000019D8163C000-memory.dmp

      Filesize

      240KB

    • memory/1128-206-0x0000019DA0080000-0x0000019DA0094000-memory.dmp

      Filesize

      80KB

    • memory/1128-191-0x0000019D9C300000-0x0000019D9C38C000-memory.dmp

      Filesize

      560KB

    • memory/1128-187-0x0000019D9C0A0000-0x0000019D9C0E8000-memory.dmp

      Filesize

      288KB

    • memory/1128-153-0x0000019D815C0000-0x0000019D815F4000-memory.dmp

      Filesize

      208KB

    • memory/1128-208-0x0000019DA1960000-0x0000019DA19C0000-memory.dmp

      Filesize

      384KB

    • memory/1128-149-0x0000019D81530000-0x0000019D8155A000-memory.dmp

      Filesize

      168KB

    • memory/1128-234-0x0000019DA65B0000-0x0000019DA65CC000-memory.dmp

      Filesize

      112KB

    • memory/1128-211-0x0000019DA19C0000-0x0000019DA19FA000-memory.dmp

      Filesize

      232KB

    • memory/1128-212-0x0000019DA1A00000-0x0000019DA1A22000-memory.dmp

      Filesize

      136KB

    • memory/1128-162-0x0000019D81580000-0x0000019D81596000-memory.dmp

      Filesize

      88KB

    • memory/1128-214-0x0000019DA29C0000-0x0000019DA2C1C000-memory.dmp

      Filesize

      2.4MB

    • memory/1128-197-0x0000019D9C410000-0x0000019D9C490000-memory.dmp

      Filesize

      512KB

    • memory/1128-145-0x0000019D814F0000-0x0000019D814F6000-memory.dmp

      Filesize

      24KB

    • memory/1128-217-0x0000019DA1940000-0x0000019DA195C000-memory.dmp

      Filesize

      112KB

    • memory/1128-218-0x0000019DA1930000-0x0000019DA1938000-memory.dmp

      Filesize

      32KB

    • memory/1128-183-0x0000019D9C1D0000-0x0000019D9C2F2000-memory.dmp

      Filesize

      1.1MB

    • memory/1128-141-0x0000019D80FF0000-0x0000019D81000000-memory.dmp

      Filesize

      64KB

    • memory/1128-138-0x0000000000000000-mapping.dmp

    • memory/1128-222-0x0000019DA1A80000-0x0000019DA1A88000-memory.dmp

      Filesize

      32KB

    • memory/1128-167-0x0000019D9BF00000-0x0000019D9BF7C000-memory.dmp

      Filesize

      496KB

    • memory/1128-169-0x0000019D9C010000-0x0000019D9C096000-memory.dmp

      Filesize

      536KB

    • memory/1128-163-0x00007FFF780D0000-0x00007FFF78B91000-memory.dmp

      Filesize

      10.8MB

    • memory/1128-173-0x0000019D81640000-0x0000019D81652000-memory.dmp

      Filesize

      72KB

    • memory/1128-181-0x0000019D9BF80000-0x0000019D9BFE0000-memory.dmp

      Filesize

      384KB

    • memory/1128-177-0x0000019D815B0000-0x0000019D815C0000-memory.dmp

      Filesize

      64KB

    • memory/4816-134-0x00007FFF780D0000-0x00007FFF78B91000-memory.dmp

      Filesize

      10.8MB

    • memory/4816-135-0x000001DCE3D20000-0x000001DCE3D28000-memory.dmp

      Filesize

      32KB

    • memory/4816-136-0x000001DCE8900000-0x000001DCE8938000-memory.dmp

      Filesize

      224KB

    • memory/4816-137-0x000001DCE7C90000-0x000001DCE7C9E000-memory.dmp

      Filesize

      56KB

    • memory/4816-133-0x00007FFF780D0000-0x00007FFF78B91000-memory.dmp

      Filesize

      10.8MB

    • memory/4816-132-0x000001DCC9170000-0x000001DCC917A000-memory.dmp

      Filesize

      40KB

    • memory/4816-154-0x00007FFF780D0000-0x00007FFF78B91000-memory.dmp

      Filesize

      10.8MB