Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1533s
  • max time network
    1510s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    05/02/2023, 12:53

General

  • Target

    setup-istripper_LhZpt7k79Wju5Jv3wFDG.exe

  • Size

    66.3MB

  • MD5

    a7a38894dc913edd5171e17c0f8800e1

  • SHA1

    bf66472e4bf3a58efc3410710c6502789cee138a

  • SHA256

    4a57d5940821785386807be9f04626bbadaad9f009e858ebda5708a5cf2ecbfe

  • SHA512

    28c71f6e4fb0cf04882d71e1a6c56b834cb2e3a7f0359215457d72868ae44cac9a636f103e1c3a90d9775360daddb27ce2a1829766f93c3785c101837074771c

  • SSDEEP

    1572864:DFo9m8tLOWOjE7ABoK6agKOzALc66HvdxQ1leBs9WLl91ZI:DFoIvjCcoK6fzALczPMEs98pZ

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 27 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup-istripper_LhZpt7k79Wju5Jv3wFDG.exe
    "C:\Users\Admin\AppData\Local\Temp\setup-istripper_LhZpt7k79Wju5Jv3wFDG.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4392
    • C:\Users\Admin\AppData\Local\Temp\is-OKI83.tmp\setup-istripper_LhZpt7k79Wju5Jv3wFDG.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-OKI83.tmp\setup-istripper_LhZpt7k79Wju5Jv3wFDG.tmp" /SL5="$70060,68653392,798208,C:\Users\Admin\AppData\Local\Temp\setup-istripper_LhZpt7k79Wju5Jv3wFDG.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:2676
      • C:\Users\Admin\AppData\Local\vghd\bin\vghd.exe
        "C:\Users\Admin\AppData\Local\vghd\bin\vghd.exe" -fromSetup
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3920
        • C:\Users\Admin\AppData\Local\vghd\bin\crashpad\crashpad_handler.exe
          C:\Users\Admin\AppData\Local\vghd\bin\crashpad\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\vghd\bin\crashpad --metrics-dir=C:\Users\Admin\AppData\Local\vghd\bin\crashpad --url=https://submit.backtrace.io/vrparadise/4b77014f47baea5313294a7fecd87ff128d692457dd391e90fbcbe57ff2abdfe/minidump --annotation=appName=iStripper --annotation=appVersion=1.2.3.76 --annotation=format=minidump --annotation=token=4b77014f47baea5313294a7fecd87ff128d692457dd391e90fbcbe57ff2abdfe --annotation=userName=undefined --annotation=userPseudo=undefined --initial-client-data=0x378,0x37c,0x380,0x354,0x38c,0xfcbc24,0xfcbc34,0xfcbc44
          4⤵
          • Executes dropped EXE
          PID:2932
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 456 -p 1864 -ip 1864
    1⤵
      PID:2888
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1864 -s 1768
      1⤵
      • Program crash
      PID:1536
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf8ca5c14h9ec8h4e53hb98eh50207b0ceaa4
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3964
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffaf2a46f8,0x7fffaf2a4708,0x7fffaf2a4718
        2⤵
          PID:4492
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15959474583853123085,7492262457740374510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
          2⤵
            PID:2636
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,15959474583853123085,7492262457740374510,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1072
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,15959474583853123085,7492262457740374510,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
            2⤵
              PID:116
          • C:\Windows\System32\CompPkgSrv.exe
            C:\Windows\System32\CompPkgSrv.exe -Embedding
            1⤵
              PID:2012

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\is-OKI83.tmp\setup-istripper_LhZpt7k79Wju5Jv3wFDG.tmp

              Filesize

              3.0MB

              MD5

              89b9755fbe7c8175f99ef9069ef191ec

              SHA1

              7cc683ca1b732ffb032c0f18c7e899486d9e5b14

              SHA256

              c9d4b5ab87610e96f16bf1d515ac1a7d8098242693c136973baacd4ba663c91c

              SHA512

              7f432cd31ec6c37e336bb67b72cda3ac39affd9e9e5ccf5fabd0df98849b56ece2d61af698fd8ce27bda21660a4e9e0f17cbffc721c712d4dc6d317590a85bfc

            • C:\Users\Admin\AppData\Local\Temp\is-OKI83.tmp\setup-istripper_LhZpt7k79Wju5Jv3wFDG.tmp

              Filesize

              3.0MB

              MD5

              89b9755fbe7c8175f99ef9069ef191ec

              SHA1

              7cc683ca1b732ffb032c0f18c7e899486d9e5b14

              SHA256

              c9d4b5ab87610e96f16bf1d515ac1a7d8098242693c136973baacd4ba663c91c

              SHA512

              7f432cd31ec6c37e336bb67b72cda3ac39affd9e9e5ccf5fabd0df98849b56ece2d61af698fd8ce27bda21660a4e9e0f17cbffc721c712d4dc6d317590a85bfc

            • C:\Users\Admin\AppData\Local\vghd\bin\LIBEAY32.dll

              Filesize

              1.2MB

              MD5

              8c7f9f7040d518d323732de6fabe934e

              SHA1

              d5fc585b6670b0fd86539dfbaa958ec7564a470b

              SHA256

              4b3352c651968daac4c8d02033f4f1cd998cc03c3b2e6f51896586835820852f

              SHA512

              295c7e655ba275afb80b35134fb37f970e6a5d0d370553e6ad612d05de148010daff5372522a16a2567d7942e07233b9cb55a11dd895c7dc74f511e63ff9a3a9

            • C:\Users\Admin\AppData\Local\vghd\bin\MSVCP140.dll

              Filesize

              438KB

              MD5

              1fb93933fd087215a3c7b0800e6bb703

              SHA1

              a78232c352ed06cedd7ca5cd5cb60e61ef8d86fb

              SHA256

              2db7fd3c9c3c4b67f2d50a5a50e8c69154dc859780dd487c28a4e6ed1af90d01

              SHA512

              79cd448e44b5607863b3cd0f9c8e1310f7e340559495589c428a24a4ac49beb06502d787824097bb959a1c9cb80672630dac19a405468a0b64db5ebd6493590e

            • C:\Users\Admin\AppData\Local\vghd\bin\MSVCR120.dll

              Filesize

              948KB

              MD5

              034ccadc1c073e4216e9466b720f9849

              SHA1

              f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

              SHA256

              86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

              SHA512

              5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Concurrent.dll

              Filesize

              24KB

              MD5

              e34bcd3ddc59a08dca72c3ec843efc74

              SHA1

              35664b01345b79a3ac4bfdd2393258c4d056178d

              SHA256

              9cd21a548adde408c82f4204902a9cfe7a97bce02f1b6272ea6b3a3758441a34

              SHA512

              7cd36200571ecaa23a43ad045d7e3bc761bc05bda9b7cb4c30d739be03c699013d19e4673f4488a48fde0fdcc55cb20bcb4644889546c0e90cd1c11b5b8efad9

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Concurrent.dll

              Filesize

              24KB

              MD5

              e34bcd3ddc59a08dca72c3ec843efc74

              SHA1

              35664b01345b79a3ac4bfdd2393258c4d056178d

              SHA256

              9cd21a548adde408c82f4204902a9cfe7a97bce02f1b6272ea6b3a3758441a34

              SHA512

              7cd36200571ecaa23a43ad045d7e3bc761bc05bda9b7cb4c30d739be03c699013d19e4673f4488a48fde0fdcc55cb20bcb4644889546c0e90cd1c11b5b8efad9

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Core.dll

              Filesize

              4.9MB

              MD5

              db58c7e71aa35d2cc47b57828590f569

              SHA1

              ff55e851b2239f5f09bb455c869eeb697174b574

              SHA256

              4714f75569aba7cebd6b13466527b190adc1999aef5c8f1f73cb2472282faf6c

              SHA512

              0d73898d22906937a50fc4c68f3241484a6649dfcd4bf14e7462c381e376b0a86102898bd7728dadadb3ab90e081922f93c40eeb9359fc2a81a847dc3c27e2a5

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Core.dll

              Filesize

              4.9MB

              MD5

              db58c7e71aa35d2cc47b57828590f569

              SHA1

              ff55e851b2239f5f09bb455c869eeb697174b574

              SHA256

              4714f75569aba7cebd6b13466527b190adc1999aef5c8f1f73cb2472282faf6c

              SHA512

              0d73898d22906937a50fc4c68f3241484a6649dfcd4bf14e7462c381e376b0a86102898bd7728dadadb3ab90e081922f93c40eeb9359fc2a81a847dc3c27e2a5

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Gui.dll

              Filesize

              5.1MB

              MD5

              5581175e339938f80cafb164be0dc4b0

              SHA1

              f7badc086b65df6329a13c17fcbec349f2ab98a8

              SHA256

              78bca9c65600391ec4bb1fb0374169db13e7517ebd154a11d244248b25a7d939

              SHA512

              cf2ae95e01d139794b51913f73cd045727fffff439d499cf4b00648ff1d819c6325244544b54d5f544f181cee8e4f8359cd9f6c8ef83271880776d0823111c53

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Gui.dll

              Filesize

              5.1MB

              MD5

              5581175e339938f80cafb164be0dc4b0

              SHA1

              f7badc086b65df6329a13c17fcbec349f2ab98a8

              SHA256

              78bca9c65600391ec4bb1fb0374169db13e7517ebd154a11d244248b25a7d939

              SHA512

              cf2ae95e01d139794b51913f73cd045727fffff439d499cf4b00648ff1d819c6325244544b54d5f544f181cee8e4f8359cd9f6c8ef83271880776d0823111c53

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Multimedia.dll

              Filesize

              563KB

              MD5

              a0c00640e49e10774c1351052342f4d0

              SHA1

              619a092e549a2e01b0e37c06728b199b2a7e0264

              SHA256

              3076cbd7960621b3e679b348c55ccaa3db1203f83c8fefd7ddc4bce05faa860b

              SHA512

              6bb7bc82f00fc6257d8c599a91c7b0de03dcc8b047d970acd7ce6dea422ca83bec4fdf73910ee0e3cef61f4e9f8f165191623b8ecc9039759a8802d122801dc0

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Multimedia.dll

              Filesize

              563KB

              MD5

              a0c00640e49e10774c1351052342f4d0

              SHA1

              619a092e549a2e01b0e37c06728b199b2a7e0264

              SHA256

              3076cbd7960621b3e679b348c55ccaa3db1203f83c8fefd7ddc4bce05faa860b

              SHA512

              6bb7bc82f00fc6257d8c599a91c7b0de03dcc8b047d970acd7ce6dea422ca83bec4fdf73910ee0e3cef61f4e9f8f165191623b8ecc9039759a8802d122801dc0

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Network.dll

              Filesize

              1018KB

              MD5

              78932f74452bd17566e2e4fdcd8368d6

              SHA1

              1f27f27fa57a401e20d6bdcbb878a8a477f9df71

              SHA256

              e94054f7f5efebda73f2a075745b9391ff2ac1215b6bc55a6402bcc5aed880ff

              SHA512

              525405521ccbb3c61f39ebfa999fb5d97956140bc3c8937bef41b9e3279cd3ccfcf9be308a1a55c1896fb85f834f8b1a43fa35bb2147e827c9e85e001088ce2d

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Network.dll

              Filesize

              1018KB

              MD5

              78932f74452bd17566e2e4fdcd8368d6

              SHA1

              1f27f27fa57a401e20d6bdcbb878a8a477f9df71

              SHA256

              e94054f7f5efebda73f2a075745b9391ff2ac1215b6bc55a6402bcc5aed880ff

              SHA512

              525405521ccbb3c61f39ebfa999fb5d97956140bc3c8937bef41b9e3279cd3ccfcf9be308a1a55c1896fb85f834f8b1a43fa35bb2147e827c9e85e001088ce2d

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Positioning.dll

              Filesize

              254KB

              MD5

              30e9bb13166b08042a4fc6f7239845b6

              SHA1

              ff4283ed891a9b23b66e07f16c63f203e45125c4

              SHA256

              f31c3409c90124f1ac279a52dfe7c44a1220bf0f3027797420892786503887cf

              SHA512

              b48dca0cd30aac2311176e734baf2465d7818e801ed0483fe29cb2332e4e514148c9031aefd1f4730a7d86e4e96fd90416d165a2a0b516dd0dec629252c20851

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Positioning.dll

              Filesize

              254KB

              MD5

              30e9bb13166b08042a4fc6f7239845b6

              SHA1

              ff4283ed891a9b23b66e07f16c63f203e45125c4

              SHA256

              f31c3409c90124f1ac279a52dfe7c44a1220bf0f3027797420892786503887cf

              SHA512

              b48dca0cd30aac2311176e734baf2465d7818e801ed0483fe29cb2332e4e514148c9031aefd1f4730a7d86e4e96fd90416d165a2a0b516dd0dec629252c20851

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5PrintSupport.dll

              Filesize

              261KB

              MD5

              b2baa1d188be3816e54c5fbc2a31f48f

              SHA1

              80cb56b3ef29570e5a4abf3118e45210013b5df9

              SHA256

              696782041bb188c94655128dbfa125944b27d081e185924ba5b48e9a18cfe086

              SHA512

              6ec6dd653d81f3f8c856d2b4e49d4295e50784620a46ccc7d3f562938230d252031f1b7b5e1dd072f20535334de8025ab37c33c65bffbd96b7dc9b539cf0448c

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5PrintSupport.dll

              Filesize

              261KB

              MD5

              b2baa1d188be3816e54c5fbc2a31f48f

              SHA1

              80cb56b3ef29570e5a4abf3118e45210013b5df9

              SHA256

              696782041bb188c94655128dbfa125944b27d081e185924ba5b48e9a18cfe086

              SHA512

              6ec6dd653d81f3f8c856d2b4e49d4295e50784620a46ccc7d3f562938230d252031f1b7b5e1dd072f20535334de8025ab37c33c65bffbd96b7dc9b539cf0448c

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Qml.dll

              Filesize

              3.2MB

              MD5

              7adc1c79d553c4b03456fb9622ae0ce5

              SHA1

              11b51b946003025ee01bc8566c85518be1a08a87

              SHA256

              d90382c681441c926f971bbd587d184d94736a63e9d42caaea8128d4005ae655

              SHA512

              546805190cb516fbdba50a020e445b70f89bef51181f7a897921c22591f204048abc9d16b81b886d56cc2fc8e42f75c35e0c7d7fc8a27ee0c4691c3e9d246d6a

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Qml.dll

              Filesize

              3.2MB

              MD5

              7adc1c79d553c4b03456fb9622ae0ce5

              SHA1

              11b51b946003025ee01bc8566c85518be1a08a87

              SHA256

              d90382c681441c926f971bbd587d184d94736a63e9d42caaea8128d4005ae655

              SHA512

              546805190cb516fbdba50a020e445b70f89bef51181f7a897921c22591f204048abc9d16b81b886d56cc2fc8e42f75c35e0c7d7fc8a27ee0c4691c3e9d246d6a

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Quick.dll

              Filesize

              3.0MB

              MD5

              8ff4b094c60b296d76d293c0d97f2db0

              SHA1

              499af0ff76509fdc0aefc2cfd311ce6feeca9e32

              SHA256

              63684525da673a2ad0929956f332faa694702449fb42b4801f17fde533fc9ea6

              SHA512

              99865bd0342fb001c50dcedc5f4ba20e0f9e5924b00ef5c1f548947514791785de31d8a8d2e36d27103006a928d050742d1b9fdab419476df9280b5dc9fbf952

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Quick.dll

              Filesize

              3.0MB

              MD5

              8ff4b094c60b296d76d293c0d97f2db0

              SHA1

              499af0ff76509fdc0aefc2cfd311ce6feeca9e32

              SHA256

              63684525da673a2ad0929956f332faa694702449fb42b4801f17fde533fc9ea6

              SHA512

              99865bd0342fb001c50dcedc5f4ba20e0f9e5924b00ef5c1f548947514791785de31d8a8d2e36d27103006a928d050742d1b9fdab419476df9280b5dc9fbf952

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5QuickWidgets.dll

              Filesize

              58KB

              MD5

              9a5e6c98b785016ba0fa329b41a47d06

              SHA1

              6fc760ee0b82061bcded659d342f6ca4841632eb

              SHA256

              7c6eb33dfdab0b04563cfdd198adae802c153106fd2c8d4ac272c9f66da17e03

              SHA512

              5e8ee94d235b78fb08fd87f87983fa07f46153cace17a0995eaeb556dc433095e15787b0ef084c6e1b2c728898490b0ac383ae703e4aee51507b879359d44b0e

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5QuickWidgets.dll

              Filesize

              58KB

              MD5

              9a5e6c98b785016ba0fa329b41a47d06

              SHA1

              6fc760ee0b82061bcded659d342f6ca4841632eb

              SHA256

              7c6eb33dfdab0b04563cfdd198adae802c153106fd2c8d4ac272c9f66da17e03

              SHA512

              5e8ee94d235b78fb08fd87f87983fa07f46153cace17a0995eaeb556dc433095e15787b0ef084c6e1b2c728898490b0ac383ae703e4aee51507b879359d44b0e

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5WebChannel.dll

              Filesize

              88KB

              MD5

              ca13ebdc6bccb3a229e3c8983698f3e4

              SHA1

              efa24afebc55592e8a41245109b5e17dc8be26ed

              SHA256

              b3b89a4b3f82c84f4b28c73bf9718929ab4d4fbcc8609936839d050d0b6951a0

              SHA512

              c6aa8a90a44e51ea390975f2f587dcdf67eb69b9d504bea5e37e72a0c8e3869cea85bf174b367b92288e01567950e992c64f58255df521f85a0df45b2b303131

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5WebChannel.dll

              Filesize

              88KB

              MD5

              ca13ebdc6bccb3a229e3c8983698f3e4

              SHA1

              efa24afebc55592e8a41245109b5e17dc8be26ed

              SHA256

              b3b89a4b3f82c84f4b28c73bf9718929ab4d4fbcc8609936839d050d0b6951a0

              SHA512

              c6aa8a90a44e51ea390975f2f587dcdf67eb69b9d504bea5e37e72a0c8e3869cea85bf174b367b92288e01567950e992c64f58255df521f85a0df45b2b303131

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5WebEngineCore.dll

              Filesize

              56.6MB

              MD5

              322078ef4718f23a4ef0c180954b6b60

              SHA1

              57022e7c67acf440a2e6afe63bd8eb91f86d9111

              SHA256

              1b73e59786cc1e415d7c73eed83c173e920c3e26c134e828c780df7744ad2ef4

              SHA512

              2da4b55a7aaf7f4145cb0e0678cf799abda872dfc18753fc8601c92e9d76965f3c753d480063b5b1857ff2325540618fc4c045ac05eda9cd9af699e061a79c9c

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5WebEngineCore.dll

              Filesize

              56.6MB

              MD5

              322078ef4718f23a4ef0c180954b6b60

              SHA1

              57022e7c67acf440a2e6afe63bd8eb91f86d9111

              SHA256

              1b73e59786cc1e415d7c73eed83c173e920c3e26c134e828c780df7744ad2ef4

              SHA512

              2da4b55a7aaf7f4145cb0e0678cf799abda872dfc18753fc8601c92e9d76965f3c753d480063b5b1857ff2325540618fc4c045ac05eda9cd9af699e061a79c9c

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5WebEngineCore.dll

              Filesize

              56.6MB

              MD5

              322078ef4718f23a4ef0c180954b6b60

              SHA1

              57022e7c67acf440a2e6afe63bd8eb91f86d9111

              SHA256

              1b73e59786cc1e415d7c73eed83c173e920c3e26c134e828c780df7744ad2ef4

              SHA512

              2da4b55a7aaf7f4145cb0e0678cf799abda872dfc18753fc8601c92e9d76965f3c753d480063b5b1857ff2325540618fc4c045ac05eda9cd9af699e061a79c9c

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5WebEngineWidgets.dll

              Filesize

              183KB

              MD5

              020be7fb1535bea06b3d6adc0240a44e

              SHA1

              be5935450056ec14a5a2ac6b967b20c55a376a3d

              SHA256

              5cd141a009df3eaa797efab1096376458847e89f976370b9287a92d6a93746f6

              SHA512

              11f3045ac1e69604d1bf168debb5e123dda916415a6ad58c15f8524da7c7f6d629595db45e049a6037e421ff06a21f9109f70732bf651c3c6a598fb11d7e63c7

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5WebEngineWidgets.dll

              Filesize

              183KB

              MD5

              020be7fb1535bea06b3d6adc0240a44e

              SHA1

              be5935450056ec14a5a2ac6b967b20c55a376a3d

              SHA256

              5cd141a009df3eaa797efab1096376458847e89f976370b9287a92d6a93746f6

              SHA512

              11f3045ac1e69604d1bf168debb5e123dda916415a6ad58c15f8524da7c7f6d629595db45e049a6037e421ff06a21f9109f70732bf651c3c6a598fb11d7e63c7

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5WebSockets.dll

              Filesize

              122KB

              MD5

              583eb7b9b7e90901ef90eab652de34d8

              SHA1

              eada56ad02cb3cf0c1ed3195d85c7cd29b73cb02

              SHA256

              cfbfa7cfaa182b05d4738d0f059195a7ca5f39cdc98b962137320f55db80b4e6

              SHA512

              dc81d7e2e171ba47f84604ffa2f48f83d0fa3362a0e59aa11101c600c6e4655a7379c446e78f7c49b0fb23b132635c0163631ece3d4122fc5ae5baeac742eafb

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5WebSockets.dll

              Filesize

              122KB

              MD5

              583eb7b9b7e90901ef90eab652de34d8

              SHA1

              eada56ad02cb3cf0c1ed3195d85c7cd29b73cb02

              SHA256

              cfbfa7cfaa182b05d4738d0f059195a7ca5f39cdc98b962137320f55db80b4e6

              SHA512

              dc81d7e2e171ba47f84604ffa2f48f83d0fa3362a0e59aa11101c600c6e4655a7379c446e78f7c49b0fb23b132635c0163631ece3d4122fc5ae5baeac742eafb

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Widgets.dll

              Filesize

              4.3MB

              MD5

              4e44578216abf3654056015ef4c8a9c3

              SHA1

              731f56b8ccc14bc7ced833c059a2fe9be67d23f7

              SHA256

              91bb41088f847fb73641fa556eda6d67bacb67560b8abf6ea1f0c885390004f8

              SHA512

              c77f92786ccf1d1d604808580b0952df255bf16782436606d3be54cb46bbb49f298baf57fe30acd22f2bce8f487e8eeefdbe98117f57171b74337dc367fd1bb6

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Widgets.dll

              Filesize

              4.3MB

              MD5

              4e44578216abf3654056015ef4c8a9c3

              SHA1

              731f56b8ccc14bc7ced833c059a2fe9be67d23f7

              SHA256

              91bb41088f847fb73641fa556eda6d67bacb67560b8abf6ea1f0c885390004f8

              SHA512

              c77f92786ccf1d1d604808580b0952df255bf16782436606d3be54cb46bbb49f298baf57fe30acd22f2bce8f487e8eeefdbe98117f57171b74337dc367fd1bb6

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Xml.dll

              Filesize

              144KB

              MD5

              d6ce2679999ce4eba077310850897268

              SHA1

              5c9bb9323452639560a3b827fb0a2a1d2db9c803

              SHA256

              c6cff6af4bab546ca2ac2d6e7fd999899a411d8a861c125e6bd36778817c0428

              SHA512

              8f3c8cf6115aaf443451f09e68654eda826bacdc1afac5206d94425672e547d8c2153b6a26d53ebaa725a3a38f09b3a7bb0a90139b6a5c72998bdb31362cc907

            • C:\Users\Admin\AppData\Local\vghd\bin\Qt5Xml.dll

              Filesize

              144KB

              MD5

              d6ce2679999ce4eba077310850897268

              SHA1

              5c9bb9323452639560a3b827fb0a2a1d2db9c803

              SHA256

              c6cff6af4bab546ca2ac2d6e7fd999899a411d8a861c125e6bd36778817c0428

              SHA512

              8f3c8cf6115aaf443451f09e68654eda826bacdc1afac5206d94425672e547d8c2153b6a26d53ebaa725a3a38f09b3a7bb0a90139b6a5c72998bdb31362cc907

            • C:\Users\Admin\AppData\Local\vghd\bin\VCRUNTIME140.dll

              Filesize

              78KB

              MD5

              1b171f9a428c44acf85f89989007c328

              SHA1

              6f25a874d6cbf8158cb7c491dcedaa81ceaebbae

              SHA256

              9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c

              SHA512

              99a06770eea07f36abc4ae0cecb2ae13c3acb362b38b731c3baed045bf76ea6b61efe4089cd2efac27701e9443388322365bdb039cd388987b24d4a43c973bd1

            • C:\Users\Admin\AppData\Local\vghd\bin\crashpad\crashpad_handler.exe

              Filesize

              746KB

              MD5

              a46fb58f141ce7963c53ab3068b79548

              SHA1

              18e93d658afbd847fdc2710e543711d695c58f1c

              SHA256

              485a8a9cc0f2f275f85f78e4424a4200be554c46cfa393a70d89f49a8beb1679

              SHA512

              7b68244cfb3dbcdc799befe3ce30453cad60b5232f308a223a08ee2885a3137e7484e304420d8c0bc9568f6a200617438f57e6c00cc72b3565aac4c86abdecfe

            • C:\Users\Admin\AppData\Local\vghd\bin\crashpad\crashpad_handler.exe

              Filesize

              746KB

              MD5

              a46fb58f141ce7963c53ab3068b79548

              SHA1

              18e93d658afbd847fdc2710e543711d695c58f1c

              SHA256

              485a8a9cc0f2f275f85f78e4424a4200be554c46cfa393a70d89f49a8beb1679

              SHA512

              7b68244cfb3dbcdc799befe3ce30453cad60b5232f308a223a08ee2885a3137e7484e304420d8c0bc9568f6a200617438f57e6c00cc72b3565aac4c86abdecfe

            • C:\Users\Admin\AppData\Local\vghd\bin\crashpad\settings.dat

              Filesize

              40B

              MD5

              225d6aac2a2fe7b56b352064daa192ae

              SHA1

              3fd3d771abfe292dcf7c0441133f0877f2a2acfc

              SHA256

              51263c1ecdc4414a32b78546f9f0d10fe3738e4918e9fea9ec3988da90edbbb7

              SHA512

              edaddd3888fc4ba59b85f7acf537087589135121d20b86e63378dd4e4bbfa2d85de9710fa4633e38ddd6b3dd1bdaeef5bcb0392f059302c7e668d46bb8f1b965

            • C:\Users\Admin\AppData\Local\vghd\bin\libEGL.DLL

              Filesize

              15KB

              MD5

              0469918fc1e19fc3f198cd14be4e1e22

              SHA1

              4f062e90cd4700259022394a020e3b02b3363ee6

              SHA256

              5dd84a436f1bee9fc1fdf6285db21e4acb52bb63cd86c53c23b440f021e03401

              SHA512

              10a01905a56ad50dc017205d649f2ff3f885ee9111c9a75fb408c010fc9481e91fdc9c3685f1ed0c939222652ecf8f349a027eba79b18a6bf64083fea85958e0

            • C:\Users\Admin\AppData\Local\vghd\bin\libEGL.dll

              Filesize

              15KB

              MD5

              0469918fc1e19fc3f198cd14be4e1e22

              SHA1

              4f062e90cd4700259022394a020e3b02b3363ee6

              SHA256

              5dd84a436f1bee9fc1fdf6285db21e4acb52bb63cd86c53c23b440f021e03401

              SHA512

              10a01905a56ad50dc017205d649f2ff3f885ee9111c9a75fb408c010fc9481e91fdc9c3685f1ed0c939222652ecf8f349a027eba79b18a6bf64083fea85958e0

            • C:\Users\Admin\AppData\Local\vghd\bin\libGLESV2.dll

              Filesize

              2.7MB

              MD5

              d4a37250588e61e50ad7f9d129f0d37e

              SHA1

              a4a84807401ea4cae05b9cb3c6cececdb63baed8

              SHA256

              785768f643f00cc013fbab8d620f3c1d3abec8bbeca5942ba31834dea269774b

              SHA512

              6256890a8ebaf8801879281cea334247437c7163989d1a6d05643052944d891a79ac68f8eb7044f4edfd1f2b97f021a92fcc859c0646ac836e5924d80fee5ee5

            • C:\Users\Admin\AppData\Local\vghd\bin\libGLESv2.dll

              Filesize

              2.7MB

              MD5

              d4a37250588e61e50ad7f9d129f0d37e

              SHA1

              a4a84807401ea4cae05b9cb3c6cececdb63baed8

              SHA256

              785768f643f00cc013fbab8d620f3c1d3abec8bbeca5942ba31834dea269774b

              SHA512

              6256890a8ebaf8801879281cea334247437c7163989d1a6d05643052944d891a79ac68f8eb7044f4edfd1f2b97f021a92fcc859c0646ac836e5924d80fee5ee5

            • C:\Users\Admin\AppData\Local\vghd\bin\libeay32.dll

              Filesize

              1.2MB

              MD5

              8c7f9f7040d518d323732de6fabe934e

              SHA1

              d5fc585b6670b0fd86539dfbaa958ec7564a470b

              SHA256

              4b3352c651968daac4c8d02033f4f1cd998cc03c3b2e6f51896586835820852f

              SHA512

              295c7e655ba275afb80b35134fb37f970e6a5d0d370553e6ad612d05de148010daff5372522a16a2567d7942e07233b9cb55a11dd895c7dc74f511e63ff9a3a9

            • C:\Users\Admin\AppData\Local\vghd\bin\msvcp140.dll

              Filesize

              438KB

              MD5

              1fb93933fd087215a3c7b0800e6bb703

              SHA1

              a78232c352ed06cedd7ca5cd5cb60e61ef8d86fb

              SHA256

              2db7fd3c9c3c4b67f2d50a5a50e8c69154dc859780dd487c28a4e6ed1af90d01

              SHA512

              79cd448e44b5607863b3cd0f9c8e1310f7e340559495589c428a24a4ac49beb06502d787824097bb959a1c9cb80672630dac19a405468a0b64db5ebd6493590e

            • C:\Users\Admin\AppData\Local\vghd\bin\msvcp140.dll

              Filesize

              438KB

              MD5

              1fb93933fd087215a3c7b0800e6bb703

              SHA1

              a78232c352ed06cedd7ca5cd5cb60e61ef8d86fb

              SHA256

              2db7fd3c9c3c4b67f2d50a5a50e8c69154dc859780dd487c28a4e6ed1af90d01

              SHA512

              79cd448e44b5607863b3cd0f9c8e1310f7e340559495589c428a24a4ac49beb06502d787824097bb959a1c9cb80672630dac19a405468a0b64db5ebd6493590e

            • C:\Users\Admin\AppData\Local\vghd\bin\msvcr120.dll

              Filesize

              948KB

              MD5

              034ccadc1c073e4216e9466b720f9849

              SHA1

              f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

              SHA256

              86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

              SHA512

              5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

            • C:\Users\Admin\AppData\Local\vghd\bin\platforms\qwindows.dll

              Filesize

              1.1MB

              MD5

              8d82f89bca48d7de90c17ac37f754f16

              SHA1

              05e936237feaa1eea6a86a7d4e777749b269e3ba

              SHA256

              ac3a36b775ac8b9cd1e3c3a7ac9dd31e0cc0a12b84d5942e97d77da20992d005

              SHA512

              6266c8e7e85e81a9cfbc113eb761f6f0eb846b2bf545db42b2b1b7d461dbd7190cae8d10749df4bad54b08c9de39a880857b898fdf8ca3edd5baf5f85fdc07cf

            • C:\Users\Admin\AppData\Local\vghd\bin\platforms\qwindows.dll

              Filesize

              1.1MB

              MD5

              8d82f89bca48d7de90c17ac37f754f16

              SHA1

              05e936237feaa1eea6a86a7d4e777749b269e3ba

              SHA256

              ac3a36b775ac8b9cd1e3c3a7ac9dd31e0cc0a12b84d5942e97d77da20992d005

              SHA512

              6266c8e7e85e81a9cfbc113eb761f6f0eb846b2bf545db42b2b1b7d461dbd7190cae8d10749df4bad54b08c9de39a880857b898fdf8ca3edd5baf5f85fdc07cf

            • C:\Users\Admin\AppData\Local\vghd\bin\qt.conf

              Filesize

              44B

              MD5

              f513b3c7a4364514367bfe40c83d5848

              SHA1

              505db366d29768f6fef7b80aa3891e7bb55395cc

              SHA256

              7e3b97b14ae2963555e8bd9b08278bae54b67d4db405f0d608f317609dbcd147

              SHA512

              f399c0e70da580c224f37c7240413d9f612c5436a3c5a3caf0d967128f5e4953c9b16f112a563715125c0c7df8ece89442656a7c580d1e2fd00416bbfcb7c322

            • C:\Users\Admin\AppData\Local\vghd\bin\ssleay32.dll

              Filesize

              270KB

              MD5

              b9cafab9d39548dda98c9013c2450863

              SHA1

              afada50ab2ec72c4d6e604467cc609fe501aff2c

              SHA256

              769458c1ca2d45e9f1ad20431e4844fb1e460225aca34312e7ff6e9944a54343

              SHA512

              4d81a18aa39051e77654334bec770b0d4a55637b143d25a27cc18cbb7a710e181f61565f9fad6606fb7b8f00269d91951eb71ecdc51461d115dc973b6da95289

            • C:\Users\Admin\AppData\Local\vghd\bin\ssleay32.dll

              Filesize

              270KB

              MD5

              b9cafab9d39548dda98c9013c2450863

              SHA1

              afada50ab2ec72c4d6e604467cc609fe501aff2c

              SHA256

              769458c1ca2d45e9f1ad20431e4844fb1e460225aca34312e7ff6e9944a54343

              SHA512

              4d81a18aa39051e77654334bec770b0d4a55637b143d25a27cc18cbb7a710e181f61565f9fad6606fb7b8f00269d91951eb71ecdc51461d115dc973b6da95289

            • C:\Users\Admin\AppData\Local\vghd\bin\styles\qwindowsvistastyle.dll

              Filesize

              120KB

              MD5

              011f23a3f078e1fbffa7c408ae13a0cc

              SHA1

              bd2ba08c64bbc7c0f265491c846ede300fc12af7

              SHA256

              690655dbe1afff4ca1fd7f5170134af6f57d4ecb328ea12b696d568e1d4b84ff

              SHA512

              bb1b96345250ffee1c41fe31d49b8a97cb62dccaa8ee387cff7102f74e5df514003cdb9dfc73239343a3e010745f8c901130aeaee475b445fffda91df7378297

            • C:\Users\Admin\AppData\Local\vghd\bin\styles\qwindowsvistastyle.dll

              Filesize

              120KB

              MD5

              011f23a3f078e1fbffa7c408ae13a0cc

              SHA1

              bd2ba08c64bbc7c0f265491c846ede300fc12af7

              SHA256

              690655dbe1afff4ca1fd7f5170134af6f57d4ecb328ea12b696d568e1d4b84ff

              SHA512

              bb1b96345250ffee1c41fe31d49b8a97cb62dccaa8ee387cff7102f74e5df514003cdb9dfc73239343a3e010745f8c901130aeaee475b445fffda91df7378297

            • C:\Users\Admin\AppData\Local\vghd\bin\vcruntime140.dll

              Filesize

              78KB

              MD5

              1b171f9a428c44acf85f89989007c328

              SHA1

              6f25a874d6cbf8158cb7c491dcedaa81ceaebbae

              SHA256

              9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c

              SHA512

              99a06770eea07f36abc4ae0cecb2ae13c3acb362b38b731c3baed045bf76ea6b61efe4089cd2efac27701e9443388322365bdb039cd388987b24d4a43c973bd1

            • C:\Users\Admin\AppData\Local\vghd\bin\vghd.exe

              Filesize

              7.4MB

              MD5

              6b7be69c0bd1003cbe4f520f5824a516

              SHA1

              69c0d7dcf4b6ce45da4581146af59d98fb590f93

              SHA256

              7caf9e1792fcf593e8e2e558f09a3bf42dcb3b5bce3e7642836366c9b48c0cce

              SHA512

              3a0b47db43b025f5e3e64351e9134555beca39d4c3558fcc56cbf4da62b877e54734d3977ba5d3af2bb07a341d92857c21cfddfc1e407eb4c05ad5ca79efcebf

            • C:\Users\Admin\AppData\Local\vghd\bin\vghd.exe

              Filesize

              7.4MB

              MD5

              6b7be69c0bd1003cbe4f520f5824a516

              SHA1

              69c0d7dcf4b6ce45da4581146af59d98fb590f93

              SHA256

              7caf9e1792fcf593e8e2e558f09a3bf42dcb3b5bce3e7642836366c9b48c0cce

              SHA512

              3a0b47db43b025f5e3e64351e9134555beca39d4c3558fcc56cbf4da62b877e54734d3977ba5d3af2bb07a341d92857c21cfddfc1e407eb4c05ad5ca79efcebf

            • memory/3920-188-0x00000000008B0000-0x0000000001028000-memory.dmp

              Filesize

              7.5MB

            • memory/3920-187-0x00000000008B0000-0x0000000001028000-memory.dmp

              Filesize

              7.5MB

            • memory/4392-137-0x0000000000400000-0x00000000004D0000-memory.dmp

              Filesize

              832KB

            • memory/4392-136-0x0000000000400000-0x00000000004D0000-memory.dmp

              Filesize

              832KB

            • memory/4392-208-0x0000000000400000-0x00000000004D0000-memory.dmp

              Filesize

              832KB

            • memory/4392-132-0x0000000000400000-0x00000000004D0000-memory.dmp

              Filesize

              832KB