Analysis

  • max time kernel
    158s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-10-2023 17:02

General

  • Target

    clipgrab-3.9.7-dotinstaller.exe

  • Size

    2.8MB

  • MD5

    0f29445baa824f6729cbda3d90b15cec

  • SHA1

    572195b4193529d842653e678eeec7dc3544ee2f

  • SHA256

    f980e92af3341650819ca6c985294ebe0aa78d38bdfe249536d7ec7f2efc6ecf

  • SHA512

    a05bb0cb18d3c7e0ce5795397beeaee90078c272afccf5211d911eae4bc39078bed7da22c528e77ed4daea1c1b4e736c2f361cdb6e525e4132ba4793e433cc81

  • SSDEEP

    49152:9qe3f6PUk/4g+H98AHaCfu6rtWBu1SSmqOIzDamifOL9T9vEXv:MSiPUk/XE9vBugtL1SNaRLh9vEXv

Malware Config

Signatures

  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\clipgrab-3.9.7-dotinstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\clipgrab-3.9.7-dotinstaller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Users\Admin\AppData\Local\Temp\is-5GMLO.tmp\clipgrab-3.9.7-dotinstaller.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-5GMLO.tmp\clipgrab-3.9.7-dotinstaller.tmp" /SL5="$80170,1907617,1111552,C:\Users\Admin\AppData\Local\Temp\clipgrab-3.9.7-dotinstaller.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\clipgrab-3.9.7-portable.exe
        "C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\clipgrab-3.9.7-portable.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4316
        • C:\Users\Admin\AppData\Local\Temp\is-EJSVD.tmp\clipgrab-3.9.7-portable.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-EJSVD.tmp\clipgrab-3.9.7-portable.tmp" /SL5="$D0176,72952445,791040,C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\clipgrab-3.9.7-portable.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2452
          • C:\Users\Admin\AppData\Local\Temp\is-779B7.tmp\vc_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-779B7.tmp\vc_redist.x86.exe" /install /passive /silent /norestart
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4320
            • C:\Windows\Temp\{E5683510-DDC0-4A5B-8926-72614363830F}\.cr\vc_redist.x86.exe
              "C:\Windows\Temp\{E5683510-DDC0-4A5B-8926-72614363830F}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-779B7.tmp\vc_redist.x86.exe" -burn.filehandle.attached=692 -burn.filehandle.self=536 /install /passive /silent /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:3756
      • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod0_extract\saBSI.exe
        "C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=NL
        3⤵
          PID:1852
          • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod0_extract\installer.exe
            "C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod0_extract\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
            4⤵
              PID:1184
              • C:\Program Files\McAfee\Temp1983754736\installer.exe
                "C:\Program Files\McAfee\Temp1983754736\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
                5⤵
                  PID:2268
                  • C:\Windows\SYSTEM32\regsvr32.exe
                    regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
                    6⤵
                      PID:4608
                      • C:\Windows\SysWOW64\regsvr32.exe
                        /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
                        7⤵
                          PID:3764
                      • C:\Windows\SYSTEM32\sc.exe
                        sc.exe create "McAfee WebAdvisor" binPath= "\"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe\"" start= auto DisplayName= "McAfee WebAdvisor"
                        6⤵
                        • Launches sc.exe
                        PID:4968
                      • C:\Windows\SYSTEM32\regsvr32.exe
                        regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"
                        6⤵
                          PID:4448
                        • C:\Windows\SYSTEM32\sc.exe
                          sc.exe description "McAfee WebAdvisor" "McAfee WebAdvisor Service"
                          6⤵
                          • Launches sc.exe
                          PID:396
                        • C:\Windows\SYSTEM32\sc.exe
                          sc.exe failure "McAfee WebAdvisor" reset= 3600 actions= restart/1/restart/1000/restart/3000/restart/30000/restart/1800000//0
                          6⤵
                          • Launches sc.exe
                          PID:2332
                  • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod1.exe
                    "C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod1.exe" -ip:"dui=fa7f0b48-75de-4b27-a416-3c06e5f0c1af&dit=20231024170341&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=5efa&a=100&b=&se=true" -vp:"dui=fa7f0b48-75de-4b27-a416-3c06e5f0c1af&dit=20231024170341&oc=ZB_RAV_Cross_Tri_NCB&p=5efa&a=100&oip=26&ptl=7&dta=true" -dp:"dui=fa7f0b48-75de-4b27-a416-3c06e5f0c1af&dit=20231024170341&oc=ZB_RAV_Cross_Tri_NCB&p=5efa&a=100" -i -v -d -se=true
                    3⤵
                      PID:400
                      • C:\Users\Admin\AppData\Local\Temp\ja2pe144.exe
                        "C:\Users\Admin\AppData\Local\Temp\ja2pe144.exe" /silent
                        4⤵
                          PID:4916
                          • C:\Users\Admin\AppData\Local\Temp\nsy62D4.tmp\RAVEndPointProtection-installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\nsy62D4.tmp\RAVEndPointProtection-installer.exe" "C:\Users\Admin\AppData\Local\Temp\ja2pe144.exe" /silent
                            5⤵
                              PID:3392
                              • C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
                                "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
                                6⤵
                                  PID:1540
                          • C:\Program Files (x86)\ClipGrab\clipgrab.exe
                            "C:\Program Files (x86)\ClipGrab\clipgrab.exe"
                            3⤵
                              PID:1332
                              • C:\Program Files (x86)\ClipGrab\ffmpeg.exe
                                ffmpeg -v quiet
                                4⤵
                                  PID:3192
                                • C:\Program Files (x86)\ClipGrab\ffmpeg.exe
                                  ffmpeg -formats
                                  4⤵
                                    PID:1668
                            • C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
                              "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10
                              1⤵
                                PID:2312

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Program Files (x86)\ClipGrab\Qt5Core.dll

                                Filesize

                                4.9MB

                                MD5

                                357cf7f517757f0689030f196dd7edc0

                                SHA1

                                248ae43e160e80c81718a9f26544be4e535cf20a

                                SHA256

                                fd3dd9dcc286e6d36cb7b3fc90c8f7f683d2e9eb449e0433af70118e726d3fe1

                                SHA512

                                f938d4e81c46bb2d4cea587a9040e6a9eac44942654e07f6b17b3e4d27d31d03b3b5226004a2e981e6c9eaf0c2faf42957607f278c9978f6033c901c93217b7f

                              • C:\Program Files (x86)\ClipGrab\Qt5Core.dll

                                Filesize

                                4.9MB

                                MD5

                                357cf7f517757f0689030f196dd7edc0

                                SHA1

                                248ae43e160e80c81718a9f26544be4e535cf20a

                                SHA256

                                fd3dd9dcc286e6d36cb7b3fc90c8f7f683d2e9eb449e0433af70118e726d3fe1

                                SHA512

                                f938d4e81c46bb2d4cea587a9040e6a9eac44942654e07f6b17b3e4d27d31d03b3b5226004a2e981e6c9eaf0c2faf42957607f278c9978f6033c901c93217b7f

                              • C:\Program Files (x86)\ClipGrab\Qt5Gui.dll

                                Filesize

                                5.1MB

                                MD5

                                c8bb97d7265ae7327eab7432c6496cf3

                                SHA1

                                c8ecab5cc7872a08ebb81edd00e95db85d56d6b5

                                SHA256

                                bd149755a4b0b7d721f9a355717855f488b16d8cbe177d0d88d9990359f5d4d5

                                SHA512

                                ec8c71336ff97e54252b3f8558a0471f8a14821ae91f90a32f1e9284eddfba6106d85eff25d5cf19d5273acaedb9ec23daf84e273ec0d6939e3c694e5da47085

                              • C:\Program Files (x86)\ClipGrab\Qt5Gui.dll

                                Filesize

                                5.1MB

                                MD5

                                c8bb97d7265ae7327eab7432c6496cf3

                                SHA1

                                c8ecab5cc7872a08ebb81edd00e95db85d56d6b5

                                SHA256

                                bd149755a4b0b7d721f9a355717855f488b16d8cbe177d0d88d9990359f5d4d5

                                SHA512

                                ec8c71336ff97e54252b3f8558a0471f8a14821ae91f90a32f1e9284eddfba6106d85eff25d5cf19d5273acaedb9ec23daf84e273ec0d6939e3c694e5da47085

                              • C:\Program Files (x86)\ClipGrab\Qt5Network.dll

                                Filesize

                                1.0MB

                                MD5

                                08b5fcf0369a4923befb05a3e7b91998

                                SHA1

                                4d44449f027120d59bd0c9725dcfe02102acc82e

                                SHA256

                                de3ef3d9ac16b03a6da9cc076bba081142ccd4a306777b6d1bbaa60980e20723

                                SHA512

                                629a3c3b3fd6c36a0a9ec93bbd325bd78e5044279720a32eb79041b08989f575c99992f352d710c167b79c19498fa002ae85afbb080302fb001ed0b44465eb06

                              • C:\Program Files (x86)\ClipGrab\Qt5Network.dll

                                Filesize

                                1.0MB

                                MD5

                                08b5fcf0369a4923befb05a3e7b91998

                                SHA1

                                4d44449f027120d59bd0c9725dcfe02102acc82e

                                SHA256

                                de3ef3d9ac16b03a6da9cc076bba081142ccd4a306777b6d1bbaa60980e20723

                                SHA512

                                629a3c3b3fd6c36a0a9ec93bbd325bd78e5044279720a32eb79041b08989f575c99992f352d710c167b79c19498fa002ae85afbb080302fb001ed0b44465eb06

                              • C:\Program Files (x86)\ClipGrab\Qt5Positioning.dll

                                Filesize

                                259KB

                                MD5

                                92aa5c44793603758874f87ecc5c88ce

                                SHA1

                                f368193467f61e0edb4864422085e70770c88d76

                                SHA256

                                798cc99af70288093bfd09a5addfd55a80f9652e7dc79f0b51f7760c47de2c9e

                                SHA512

                                459b97983c236ad76438615dad7174aa64561c9a0d9fcda7f290411237d97411f503d2dbb2d90f0c61fc229a872971a96ab61bf7b9bfb8b1ea840f4621d10910

                              • C:\Program Files (x86)\ClipGrab\Qt5Positioning.dll

                                Filesize

                                259KB

                                MD5

                                92aa5c44793603758874f87ecc5c88ce

                                SHA1

                                f368193467f61e0edb4864422085e70770c88d76

                                SHA256

                                798cc99af70288093bfd09a5addfd55a80f9652e7dc79f0b51f7760c47de2c9e

                                SHA512

                                459b97983c236ad76438615dad7174aa64561c9a0d9fcda7f290411237d97411f503d2dbb2d90f0c61fc229a872971a96ab61bf7b9bfb8b1ea840f4621d10910

                              • C:\Program Files (x86)\ClipGrab\Qt5PrintSupport.dll

                                Filesize

                                267KB

                                MD5

                                c9d5c7d715bbf74c31aab14893698778

                                SHA1

                                ee62edb71acb9eda4cb5f213a0b94940b972d7b3

                                SHA256

                                12717098b4d3f5f09ec19d091d1beb26d6df35e586bee511b9138be42d644e4a

                                SHA512

                                ee67880a737d1ec7c14cf84f20994bd34d8c8e39fc1763b634c311bc200ab6153f2f6760b217517a6190ccdf8076f4f9055062a011b3115c653c0ae4c5837330

                              • C:\Program Files (x86)\ClipGrab\Qt5PrintSupport.dll

                                Filesize

                                267KB

                                MD5

                                c9d5c7d715bbf74c31aab14893698778

                                SHA1

                                ee62edb71acb9eda4cb5f213a0b94940b972d7b3

                                SHA256

                                12717098b4d3f5f09ec19d091d1beb26d6df35e586bee511b9138be42d644e4a

                                SHA512

                                ee67880a737d1ec7c14cf84f20994bd34d8c8e39fc1763b634c311bc200ab6153f2f6760b217517a6190ccdf8076f4f9055062a011b3115c653c0ae4c5837330

                              • C:\Program Files (x86)\ClipGrab\Qt5Qml.dll

                                Filesize

                                3.2MB

                                MD5

                                b92764b31b080972ad0682a0ba794db1

                                SHA1

                                a4b3b253da4078a0b9d536873a6e79a4ba070ad2

                                SHA256

                                4706a5ef8f1092da9d60af8722546ce8f23c98db7450c3f72521d4651aeb2a52

                                SHA512

                                077c7c285c038cec271fe21a2b77eaadf3ec7d6a288d24234d6e351bead294b7bb903ea2759cb852d8e3d0354fbac926292639375d82d4dbeb85e4c515ef4369

                              • C:\Program Files (x86)\ClipGrab\Qt5Qml.dll

                                Filesize

                                3.2MB

                                MD5

                                b92764b31b080972ad0682a0ba794db1

                                SHA1

                                a4b3b253da4078a0b9d536873a6e79a4ba070ad2

                                SHA256

                                4706a5ef8f1092da9d60af8722546ce8f23c98db7450c3f72521d4651aeb2a52

                                SHA512

                                077c7c285c038cec271fe21a2b77eaadf3ec7d6a288d24234d6e351bead294b7bb903ea2759cb852d8e3d0354fbac926292639375d82d4dbeb85e4c515ef4369

                              • C:\Program Files (x86)\ClipGrab\Qt5Qml.dll

                                Filesize

                                3.2MB

                                MD5

                                b92764b31b080972ad0682a0ba794db1

                                SHA1

                                a4b3b253da4078a0b9d536873a6e79a4ba070ad2

                                SHA256

                                4706a5ef8f1092da9d60af8722546ce8f23c98db7450c3f72521d4651aeb2a52

                                SHA512

                                077c7c285c038cec271fe21a2b77eaadf3ec7d6a288d24234d6e351bead294b7bb903ea2759cb852d8e3d0354fbac926292639375d82d4dbeb85e4c515ef4369

                              • C:\Program Files (x86)\ClipGrab\Qt5Quick.dll

                                Filesize

                                3.0MB

                                MD5

                                7a517d5ee706c979876b97c789be8968

                                SHA1

                                7efc77f592389f94aa6980ecd3da7d39c960765f

                                SHA256

                                beb08a06b24ae1668441d47fbd434daa40ef6c4c45963351a0a6acdcd550bc31

                                SHA512

                                2656d980b31c5f6c34fae8b9ea719c06481195af6ff8b93a6297cae74783a2eaf6b808d539add7a1490e159ee19d2889308adb48491d719097d5459a7f798287

                              • C:\Program Files (x86)\ClipGrab\Qt5Quick.dll

                                Filesize

                                3.0MB

                                MD5

                                7a517d5ee706c979876b97c789be8968

                                SHA1

                                7efc77f592389f94aa6980ecd3da7d39c960765f

                                SHA256

                                beb08a06b24ae1668441d47fbd434daa40ef6c4c45963351a0a6acdcd550bc31

                                SHA512

                                2656d980b31c5f6c34fae8b9ea719c06481195af6ff8b93a6297cae74783a2eaf6b808d539add7a1490e159ee19d2889308adb48491d719097d5459a7f798287

                              • C:\Program Files (x86)\ClipGrab\Qt5QuickWidgets.dll

                                Filesize

                                64KB

                                MD5

                                42ce360f532e7e835ee94ee1226e1c19

                                SHA1

                                6c596c32575f081c86524742fcb11aa5e44ad213

                                SHA256

                                6b12b555d3bc465e106a26603b4bead895134ecd90b3201773415eab64cc69ac

                                SHA512

                                8f2772be5a6e375f06439f58c4b26277f93b8b777c950640c4699de6e0b0a99f7f33ebc6eac4b3a87a1e1b644c573b7ae5de9289d399fa41d732867c1bf95508

                              • C:\Program Files (x86)\ClipGrab\Qt5QuickWidgets.dll

                                Filesize

                                64KB

                                MD5

                                42ce360f532e7e835ee94ee1226e1c19

                                SHA1

                                6c596c32575f081c86524742fcb11aa5e44ad213

                                SHA256

                                6b12b555d3bc465e106a26603b4bead895134ecd90b3201773415eab64cc69ac

                                SHA512

                                8f2772be5a6e375f06439f58c4b26277f93b8b777c950640c4699de6e0b0a99f7f33ebc6eac4b3a87a1e1b644c573b7ae5de9289d399fa41d732867c1bf95508

                              • C:\Program Files (x86)\ClipGrab\Qt5WebChannel.dll

                                Filesize

                                96KB

                                MD5

                                2a65f4f49a88417222bcf109b59247ef

                                SHA1

                                a165ff1b21ff45c11783b63f2f4e9f270f84f05e

                                SHA256

                                632a5d720f3f6371721f94e4665ac13988afde722d155aaa5364a27cbd46d3ac

                                SHA512

                                c260fdb3454994e15582feec31b63e8418c9b1d705ee06ac09aa4ac77782ac79f722c9c883714e462ef919834ddd569ea7fff2b7d616a2b210966013c8ad9add

                              • C:\Program Files (x86)\ClipGrab\Qt5WebChannel.dll

                                Filesize

                                96KB

                                MD5

                                2a65f4f49a88417222bcf109b59247ef

                                SHA1

                                a165ff1b21ff45c11783b63f2f4e9f270f84f05e

                                SHA256

                                632a5d720f3f6371721f94e4665ac13988afde722d155aaa5364a27cbd46d3ac

                                SHA512

                                c260fdb3454994e15582feec31b63e8418c9b1d705ee06ac09aa4ac77782ac79f722c9c883714e462ef919834ddd569ea7fff2b7d616a2b210966013c8ad9add

                              • C:\Program Files (x86)\ClipGrab\Qt5WebEngineCore.dll

                                Filesize

                                8.7MB

                                MD5

                                3005fce50302bf7db1d47f1680868542

                                SHA1

                                81af69dee6f1f3b62faad8acd453ec3e4068f9b5

                                SHA256

                                992dffca98e53017b459dd3848f0f54a0b27d5ac42a96e3a5f2400d3f9697301

                                SHA512

                                b6983373362a4125e6291b57e51bea1fef5ee580686d5c01b41689a5b68906e53369705bc3d650f296cc884fea89b65f2452152d7a0c2bf30eca32ba2d9cfa8e

                              • C:\Program Files (x86)\ClipGrab\Qt5WebEngineCore.dll

                                Filesize

                                8.8MB

                                MD5

                                6daf705899d7dc1835a3ca617eb980de

                                SHA1

                                131788ce591d53a538294f7c2056ca85e5fec0fc

                                SHA256

                                9959e437c02b125b3747a39bc69804d093214db5b7429c5cb45c30eec3cd538a

                                SHA512

                                affc8bc8401573f23071c6d0fd32e6ab236d5340b3a1f766f7a572b7fe3fdacf2f64461ac9b7798f83ee67a32312e1800bc432c298afe223a1fe1424c0ecbe1c

                              • C:\Program Files (x86)\ClipGrab\Qt5WebEngineWidgets.dll

                                Filesize

                                187KB

                                MD5

                                9c30ad3a2ba28362ac506f50221e881d

                                SHA1

                                02497e8d0544d91318a2b6619b7c154cebee1073

                                SHA256

                                ce773742d6d80df75e9e462bd38bf237508541b3243dad57c48b4eb24f4ff3f1

                                SHA512

                                50bb8ac0f02bebe6aaa09554bfe8dd575681810239edeeb696b8170a8f4c3457a4ff3bf2e7ad9ed1b6a6c54f81201988c8e347f1fbff4e2ea2d348a72ca9aa70

                              • C:\Program Files (x86)\ClipGrab\Qt5WebEngineWidgets.dll

                                Filesize

                                187KB

                                MD5

                                9c30ad3a2ba28362ac506f50221e881d

                                SHA1

                                02497e8d0544d91318a2b6619b7c154cebee1073

                                SHA256

                                ce773742d6d80df75e9e462bd38bf237508541b3243dad57c48b4eb24f4ff3f1

                                SHA512

                                50bb8ac0f02bebe6aaa09554bfe8dd575681810239edeeb696b8170a8f4c3457a4ff3bf2e7ad9ed1b6a6c54f81201988c8e347f1fbff4e2ea2d348a72ca9aa70

                              • C:\Program Files (x86)\ClipGrab\Qt5Widgets.dll

                                Filesize

                                4.3MB

                                MD5

                                db7034b133d238447a6f3704b65bbceb

                                SHA1

                                c834d45162f38f461a8eafe737301eb22056e913

                                SHA256

                                53d9f928141382a5ef60039562b200e03d18e8720f16fb0ee8072b45e94202a7

                                SHA512

                                837b7e675b752c372973ecb4a53de568fc087e5f3896916614d504405a0a1ae78d1be59f173c2a0b28b4b139924736208de2eb6ee767c78894b7834fae9bf9f1

                              • C:\Program Files (x86)\ClipGrab\Qt5Widgets.dll

                                Filesize

                                4.3MB

                                MD5

                                db7034b133d238447a6f3704b65bbceb

                                SHA1

                                c834d45162f38f461a8eafe737301eb22056e913

                                SHA256

                                53d9f928141382a5ef60039562b200e03d18e8720f16fb0ee8072b45e94202a7

                                SHA512

                                837b7e675b752c372973ecb4a53de568fc087e5f3896916614d504405a0a1ae78d1be59f173c2a0b28b4b139924736208de2eb6ee767c78894b7834fae9bf9f1

                              • C:\Program Files (x86)\ClipGrab\Qt5Xml.dll

                                Filesize

                                149KB

                                MD5

                                fd0f95e872b99b61f0b7276e0ff76c28

                                SHA1

                                a90b20be2f436362782ac18182637f8dca1e9719

                                SHA256

                                9150d32aa158f9c555cc3b845fc8f776684f11ec014b47a96d498faad67e7a31

                                SHA512

                                25a4e5d74315f64171c16929da0fa049db9dd835cb912e2909bf442fc6383a424cdd52aec58c6eb6d335697651deff16f688ecac8c11310a1fe7383996bdcd94

                              • C:\Program Files (x86)\ClipGrab\Qt5Xml.dll

                                Filesize

                                149KB

                                MD5

                                fd0f95e872b99b61f0b7276e0ff76c28

                                SHA1

                                a90b20be2f436362782ac18182637f8dca1e9719

                                SHA256

                                9150d32aa158f9c555cc3b845fc8f776684f11ec014b47a96d498faad67e7a31

                                SHA512

                                25a4e5d74315f64171c16929da0fa049db9dd835cb912e2909bf442fc6383a424cdd52aec58c6eb6d335697651deff16f688ecac8c11310a1fe7383996bdcd94

                              • C:\Program Files (x86)\ClipGrab\clipgrab.exe

                                Filesize

                                1.1MB

                                MD5

                                57cdd2bc92aee7d3d213561188e565d4

                                SHA1

                                fb34ba0178b5764b6ccc9d228796196ee172980e

                                SHA256

                                10770da581cc85d55a286d42a0428accafe6c7910bc640cc4264da7fb26dafa4

                                SHA512

                                ac00f5021cbc34b7ca160364cdde0a404353d8fc9e6a46866884268880c7b753e91741c48b413d6f7a5ff28a4e3d98bd7485550b46009a7c5b42dd0a877f3856

                              • C:\Program Files (x86)\ClipGrab\clipgrab.exe

                                Filesize

                                1.1MB

                                MD5

                                57cdd2bc92aee7d3d213561188e565d4

                                SHA1

                                fb34ba0178b5764b6ccc9d228796196ee172980e

                                SHA256

                                10770da581cc85d55a286d42a0428accafe6c7910bc640cc4264da7fb26dafa4

                                SHA512

                                ac00f5021cbc34b7ca160364cdde0a404353d8fc9e6a46866884268880c7b753e91741c48b413d6f7a5ff28a4e3d98bd7485550b46009a7c5b42dd0a877f3856

                              • C:\Program Files (x86)\ClipGrab\clipgrab.exe

                                Filesize

                                1.1MB

                                MD5

                                57cdd2bc92aee7d3d213561188e565d4

                                SHA1

                                fb34ba0178b5764b6ccc9d228796196ee172980e

                                SHA256

                                10770da581cc85d55a286d42a0428accafe6c7910bc640cc4264da7fb26dafa4

                                SHA512

                                ac00f5021cbc34b7ca160364cdde0a404353d8fc9e6a46866884268880c7b753e91741c48b413d6f7a5ff28a4e3d98bd7485550b46009a7c5b42dd0a877f3856

                              • C:\Program Files (x86)\ClipGrab\libEGL.DLL

                                Filesize

                                21KB

                                MD5

                                55813372944c5acaca0e38c22902a6e6

                                SHA1

                                8c3fbdcacecc971aac8823a52eb83082669220a3

                                SHA256

                                fc219ad27720cfb1b223d748c1b5bdd78886235f4254bfe8e0adaf168c7e9849

                                SHA512

                                73f504a1f7cda4082f370387304db701672d95409886362dd70f8599fc17a5b577d2b37dd8f012cecb6d6dffe4321906c2a07cdd7e12e2d31bb9df0fb2e97a7f

                              • C:\Program Files (x86)\ClipGrab\libEGL.dll

                                Filesize

                                21KB

                                MD5

                                55813372944c5acaca0e38c22902a6e6

                                SHA1

                                8c3fbdcacecc971aac8823a52eb83082669220a3

                                SHA256

                                fc219ad27720cfb1b223d748c1b5bdd78886235f4254bfe8e0adaf168c7e9849

                                SHA512

                                73f504a1f7cda4082f370387304db701672d95409886362dd70f8599fc17a5b577d2b37dd8f012cecb6d6dffe4321906c2a07cdd7e12e2d31bb9df0fb2e97a7f

                              • C:\Program Files (x86)\ClipGrab\libGLESv2.dll

                                Filesize

                                2.7MB

                                MD5

                                02c59344a65e9893d7d2d0d79b570429

                                SHA1

                                d07d73aab1beaeeef57c03330add64afa5f20160

                                SHA256

                                adba2649650fa580fb301b69a74aa4ad0b8796a6b35179ff0a938be510db1b7d

                                SHA512

                                222ffdb94f4df18d25e5d77cb76ff95c0704dbd696796880bdc7c23c930546435ac5060233f3be9a5b2c058a721c15ffc542b9ba84aafe28dfc77498037f21df

                              • C:\Program Files (x86)\ClipGrab\platforms\qwindows.dll

                                Filesize

                                1.2MB

                                MD5

                                b190c721612ac9d169f8b3a8f8b48a29

                                SHA1

                                206442dd161e878f1a6f83f3ebdb9208b56abfff

                                SHA256

                                ccb562f817d7015c78da4098bc576e7eaf3df1ebd55afb58d75f12dace9c761f

                                SHA512

                                951bc91302fcb1a28b7093f6867b379a90188733cec329efedb465ae27ae1a526a2d5f997816b26ed123d2401a9aa2854d26a003a65318f50e3a695d7948f6b7

                              • C:\Program Files (x86)\ClipGrab\platforms\qwindows.dll

                                Filesize

                                1.2MB

                                MD5

                                b190c721612ac9d169f8b3a8f8b48a29

                                SHA1

                                206442dd161e878f1a6f83f3ebdb9208b56abfff

                                SHA256

                                ccb562f817d7015c78da4098bc576e7eaf3df1ebd55afb58d75f12dace9c761f

                                SHA512

                                951bc91302fcb1a28b7093f6867b379a90188733cec329efedb465ae27ae1a526a2d5f997816b26ed123d2401a9aa2854d26a003a65318f50e3a695d7948f6b7

                              • C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

                                Filesize

                                797KB

                                MD5

                                ded746a9d2d7b7afcb3abe1a24dd3163

                                SHA1

                                a074c9e981491ff566cd45b912e743bd1266c4ae

                                SHA256

                                c113072678d5fa03b02d750a5911848ab0e247c4b28cf7b152a858c4b24901b3

                                SHA512

                                2c273bf79988df13f9da4019f8071cf3b4480ecd814d3df44b83958f52f49bb668dd2f568293c29ef3545018fea15c9d5902ef88e0ecfebaf60458333fcaa91b

                              • C:\Users\Admin\AppData\Local\Temp\is-5GMLO.tmp\clipgrab-3.9.7-dotinstaller.tmp

                                Filesize

                                3.2MB

                                MD5

                                aadc16c8ad4312196df3aa1d9f6386d3

                                SHA1

                                ff4d78923e0d957e6a66b3c06efecc435c396c7a

                                SHA256

                                04fade43204ecbbb378114a023b3db4a3aebe8258ff3b3846156e80a9c5cf4a3

                                SHA512

                                51621ec71d530d75e4a537381edf03bc48b234dd861547c950573febf5709a1716ee797368854512edf1950a4e1f4f8bbe292417a0dd238600338a39e2454e04

                              • C:\Users\Admin\AppData\Local\Temp\is-779B7.tmp\vc_redist.x86.exe

                                Filesize

                                14.0MB

                                MD5

                                310f8aadd8055f8b8eba1a6528be7d10

                                SHA1

                                3ee9622151e4b50837fcdfac1b085430f0181f4e

                                SHA256

                                54ad46ae80984aa48cae6361213692c96b3639e322730d28c7fb93b183c761da

                                SHA512

                                2872a30939f7ee20b494806574cf5b8b5a0976f8fe69bdbd77dde2483ce2a9e5458ff3636147e49a449e941a44ca2d79239e3da62fddb69fc5bced8ee1004ee5

                              • C:\Users\Admin\AppData\Local\Temp\is-779B7.tmp\vc_redist.x86.exe

                                Filesize

                                14.0MB

                                MD5

                                310f8aadd8055f8b8eba1a6528be7d10

                                SHA1

                                3ee9622151e4b50837fcdfac1b085430f0181f4e

                                SHA256

                                54ad46ae80984aa48cae6361213692c96b3639e322730d28c7fb93b183c761da

                                SHA512

                                2872a30939f7ee20b494806574cf5b8b5a0976f8fe69bdbd77dde2483ce2a9e5458ff3636147e49a449e941a44ca2d79239e3da62fddb69fc5bced8ee1004ee5

                              • C:\Users\Admin\AppData\Local\Temp\is-EJSVD.tmp\clipgrab-3.9.7-portable.tmp

                                Filesize

                                2.5MB

                                MD5

                                ae7b203e80eaa5afb50768049bb3de50

                                SHA1

                                cc0b5d64c2af21a3b24e167352df8ae93acd30d3

                                SHA256

                                ffe5d85efc5b75b4c99b07f5819d1fb3b9b1b42e67c903ef86f013bdedad7112

                                SHA512

                                a94cc199a4fa8a67496169de972bef84dd0e411502c5f74438ec0e7d18626ef3278d9c3aae1b0d025776849dbed5ec8e06d714b4bd48a43e48e2a167f7d52748

                              • C:\Users\Admin\AppData\Local\Temp\is-EJSVD.tmp\clipgrab-3.9.7-portable.tmp

                                Filesize

                                2.5MB

                                MD5

                                ae7b203e80eaa5afb50768049bb3de50

                                SHA1

                                cc0b5d64c2af21a3b24e167352df8ae93acd30d3

                                SHA256

                                ffe5d85efc5b75b4c99b07f5819d1fb3b9b1b42e67c903ef86f013bdedad7112

                                SHA512

                                a94cc199a4fa8a67496169de972bef84dd0e411502c5f74438ec0e7d18626ef3278d9c3aae1b0d025776849dbed5ec8e06d714b4bd48a43e48e2a167f7d52748

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\RAV_Cross.png

                                Filesize

                                74KB

                                MD5

                                cd09f361286d1ad2622ba8a57b7613bd

                                SHA1

                                4cd3e5d4063b3517a950b9d030841f51f3c5f1b1

                                SHA256

                                b92a31d4853d1b2c4e5b9d9624f40b439856d0c6a517e100978cbde8d3c47dc8

                                SHA512

                                f73d60c92644e0478107e0402d1c7b4dfa1674f69b41856f74f937a7b57ceaa2b3be9242f2b59f1fcf71063aac6cbe16c594618d1a8cdd181510de3240f31dff

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\WebAdvisor.png

                                Filesize

                                33KB

                                MD5

                                db6c259cd7b58f2f7a3cca0c38834d0e

                                SHA1

                                046fd119fe163298324ddcd47df62fa8abcae169

                                SHA256

                                494169cdd9c79eb4668378f770bfa55d4b140f23a682ff424441427dfab0ced2

                                SHA512

                                a5e8bb6dc4cae51d4ebbe5454d1b11bc511c69031db64eff089fb2f8f68665f4004f0f215b503f7630a56c995bbe9cf72e8744177e92447901773cc7e2d9fdbb

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\botva2.dll

                                Filesize

                                37KB

                                MD5

                                67965a5957a61867d661f05ae1f4773e

                                SHA1

                                f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

                                SHA256

                                450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

                                SHA512

                                c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\botva2.dll

                                Filesize

                                37KB

                                MD5

                                67965a5957a61867d661f05ae1f4773e

                                SHA1

                                f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

                                SHA256

                                450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

                                SHA512

                                c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\clipgrab-3.9.7-portable.exe

                                Filesize

                                70.3MB

                                MD5

                                962d6f9e7331b8f3eb2fa4acb15f5f61

                                SHA1

                                2e1a7e9ec7159e564814a599657d42dc01ef9858

                                SHA256

                                0ae8656f4c65673d75544cff54721cbfc586edd6e8b4b2a2070930684920411e

                                SHA512

                                f8721fc68703d6a6ab9188bce1d64774447f02f378dd4b4d267f7fb4b01d42c4520feede2855ab426d92dfc538a1d272d7a88e65871015a95654c3d8f321d3be

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\clipgrab-3.9.7-portable.exe

                                Filesize

                                70.3MB

                                MD5

                                962d6f9e7331b8f3eb2fa4acb15f5f61

                                SHA1

                                2e1a7e9ec7159e564814a599657d42dc01ef9858

                                SHA256

                                0ae8656f4c65673d75544cff54721cbfc586edd6e8b4b2a2070930684920411e

                                SHA512

                                f8721fc68703d6a6ab9188bce1d64774447f02f378dd4b4d267f7fb4b01d42c4520feede2855ab426d92dfc538a1d272d7a88e65871015a95654c3d8f321d3be

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\finish.png

                                Filesize

                                2KB

                                MD5

                                7afaf9e0e99fd80fa1023a77524f5587

                                SHA1

                                e20c9c27691810b388c73d2ca3e67e109c2b69b6

                                SHA256

                                760b70612bb9bd967c2d15a5133a50ccce8c0bd46a6464d76875298dcc45dea0

                                SHA512

                                a090626e7b7f67fb5aa207aae0cf65c3a27e1b85e22c9728eee7475bd9bb7375ca93baaecc662473f9a427b4f505d55f2c61ba36bda460e4e6947fe22eedb044

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\loader.gif

                                Filesize

                                10KB

                                MD5

                                f23a523b82ad9103a9ac1dcc33eca72f

                                SHA1

                                5363bb6b51923441ef56638576307cc252f05a71

                                SHA256

                                59853c413b0813ded6f1e557959768d6662f010f49884d36b62c13038fac739c

                                SHA512

                                514ec63f7ed80d0708f7e2355fad8a558b4dcf2d0122ff98fe7c3ca1f40e7cd04e8869ca7a3b95622c0848c0d99306d7e791b86ca69b9e240beae959ca6285be

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\logo.png

                                Filesize

                                9KB

                                MD5

                                2c050a55ade91ca10c94c41fdceaa8cb

                                SHA1

                                178fd0ee1c184fe681d89bff0ff8b89392723a67

                                SHA256

                                43262c9cc6328d67007b97a8eb36c924d05d45a383349e61b067f35677e1ad6e

                                SHA512

                                425825cbe2a417f10832c37fc0e571ca3e3f9b940f93f9f8ec8fcff2df896a52ff753386c30e03836d588b6bf355323dbea2e3a0cbf756f8f3c7065335cbfeac

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod0.zip

                                Filesize

                                499KB

                                MD5

                                cd9c77bc5840af008799985f397fe1c3

                                SHA1

                                9b526687a23b737cc9468570fa17378109e94071

                                SHA256

                                26d7704b540df18e2bccd224df677061ffb9f03cab5b3c191055a84bf43a9085

                                SHA512

                                de82bd3cbfb66a2ea0cc79e19407b569355ac43bf37eecf15c9ec0693df31ee480ee0be8e7e11cc3136c2df9e7ef775bf9918fe478967eee14304343042a7872

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod0_extract\installer.exe

                                Filesize

                                13.2MB

                                MD5

                                becd3dd0019c2636189818d8c64344b9

                                SHA1

                                895ed4d50699f815b54889de381ad84e5c0c77be

                                SHA256

                                cb194241cae0e174b46058df1232ee577a17568e4dad4330f923920b578154ff

                                SHA512

                                ca3ea26206e85ac100fb590bd827c5f374b4e9c7cf35326d86819a666b7b6706e3db0475149ca5dd09109744c3bb0b1588d19acb950d165cbe440a833f4508d1

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod0_extract\installer.exe

                                Filesize

                                8.9MB

                                MD5

                                47a46343b20484d0b338ad8340c7b311

                                SHA1

                                911decf4ec2a06bcf40b30c6310c12dfa3539d77

                                SHA256

                                0d6b74d280638dab3f55aa1d5c0ac9761d1aed975104aec950b8e59574cf2e3d

                                SHA512

                                db25bfbd2c186c657453cada7a21fbe8b7ad1539b073b86eb120efbc9b5905cf25a8ed70d52dd12f54116b5b273ba336e75c6ab89de54e3db564d8f88cd90b54

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod0_extract\installer.exe

                                Filesize

                                8.6MB

                                MD5

                                f3c40a10a54a609c4a2f1762ca6052af

                                SHA1

                                66dc5cd15ab7961d6474f162f94a87172f40494a

                                SHA256

                                a60de35de5de67fa7b59775d0cf4ca454a205ab0b782149375b520cdda491bde

                                SHA512

                                b67ee9637a6f2e592aef7bd82a3b0fe0043e8e9399322c9070423473e449e7adb67cd75f5888513960f434b829a3c8d688740c785a2a1cecb48e53c8e91af91c

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod0_extract\saBSI.exe

                                Filesize

                                1.1MB

                                MD5

                                bb7cf61c4e671ff05649bda83b85fa3d

                                SHA1

                                db3fdeaf7132448d2a31a5899832a20973677f19

                                SHA256

                                9d04462e854ef49bcd6059767248a635912ce0f593521a7cc8af938e6a027534

                                SHA512

                                63798024e1e22975d1be1e8bff828040d046d63df29f07d6161c868526d5f08451e44b5fa60bfb0c22cf7880abc03aaedafa2c5c844c3aeff640e6fac9586aab

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod0_extract\saBSI.exe

                                Filesize

                                1.1MB

                                MD5

                                bb7cf61c4e671ff05649bda83b85fa3d

                                SHA1

                                db3fdeaf7132448d2a31a5899832a20973677f19

                                SHA256

                                9d04462e854ef49bcd6059767248a635912ce0f593521a7cc8af938e6a027534

                                SHA512

                                63798024e1e22975d1be1e8bff828040d046d63df29f07d6161c868526d5f08451e44b5fa60bfb0c22cf7880abc03aaedafa2c5c844c3aeff640e6fac9586aab

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod0_extract\saBSI.exe

                                Filesize

                                1.1MB

                                MD5

                                bb7cf61c4e671ff05649bda83b85fa3d

                                SHA1

                                db3fdeaf7132448d2a31a5899832a20973677f19

                                SHA256

                                9d04462e854ef49bcd6059767248a635912ce0f593521a7cc8af938e6a027534

                                SHA512

                                63798024e1e22975d1be1e8bff828040d046d63df29f07d6161c868526d5f08451e44b5fa60bfb0c22cf7880abc03aaedafa2c5c844c3aeff640e6fac9586aab

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod1.exe

                                Filesize

                                44KB

                                MD5

                                82f761d3b0eeb84b2980e02c3ad08d76

                                SHA1

                                926d2f695bc3a496c703ed466cd09fb080043608

                                SHA256

                                32732da934d94750b97fea75dba70e76db24c56b5decbac1ed090ec666aa0172

                                SHA512

                                3706a97842452445bc7541f285c9310ed9d17c7b86bb5a64461f18be2d0b17b65e59027f43d27c4d83085277b6c6af331033b42b7adc15026cb655dba2e2d2a2

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod1.exe

                                Filesize

                                44KB

                                MD5

                                82f761d3b0eeb84b2980e02c3ad08d76

                                SHA1

                                926d2f695bc3a496c703ed466cd09fb080043608

                                SHA256

                                32732da934d94750b97fea75dba70e76db24c56b5decbac1ed090ec666aa0172

                                SHA512

                                3706a97842452445bc7541f285c9310ed9d17c7b86bb5a64461f18be2d0b17b65e59027f43d27c4d83085277b6c6af331033b42b7adc15026cb655dba2e2d2a2

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\prod1.exe

                                Filesize

                                44KB

                                MD5

                                82f761d3b0eeb84b2980e02c3ad08d76

                                SHA1

                                926d2f695bc3a496c703ed466cd09fb080043608

                                SHA256

                                32732da934d94750b97fea75dba70e76db24c56b5decbac1ed090ec666aa0172

                                SHA512

                                3706a97842452445bc7541f285c9310ed9d17c7b86bb5a64461f18be2d0b17b65e59027f43d27c4d83085277b6c6af331033b42b7adc15026cb655dba2e2d2a2

                              • C:\Users\Admin\AppData\Local\Temp\is-HCQQ1.tmp\zbShieldUtils.dll

                                Filesize

                                2.0MB

                                MD5

                                e1f18a22199c6f6aa5d87b24e5b39ef1

                                SHA1

                                0dcd8f90b575f6f1d10d6789fe769fa26daafd0e

                                SHA256

                                62c56c8cf2ac6521ce047b73aa99b6d3952ca53f11d34b00e98d17674a2fc10d

                                SHA512

                                5a10a2f096adce6e7db3a40bc3ea3fd44d602966e606706ee5a780703f211de7f77656c79c296390baee1e008dc3ce327eaaf5d78bbae20108670c5bc809a190

                              • C:\Users\Admin\AppData\Local\Temp\ja2pe144.exe

                                Filesize

                                1.9MB

                                MD5

                                4b72d82b560777b5824f6ab1cc4da4ec

                                SHA1

                                9937a2e5a505c1a9a3f5005993dfe839f1f73918

                                SHA256

                                812ce93a92ff7bf896ec0c39b4f4a121cc90ebddb1a8c35bb0c3e484a4a3f255

                                SHA512

                                d8ff3c40bbc22bed49af7e1138689e4762eea9a10bed2bde07491279480e9e18bba68bd44bec764c07ea81fc6be6db2f4377321d1049966cbd36f3f14f096261

                              • C:\Users\Admin\AppData\Local\Temp\ja2pe144.exe

                                Filesize

                                1.9MB

                                MD5

                                4b72d82b560777b5824f6ab1cc4da4ec

                                SHA1

                                9937a2e5a505c1a9a3f5005993dfe839f1f73918

                                SHA256

                                812ce93a92ff7bf896ec0c39b4f4a121cc90ebddb1a8c35bb0c3e484a4a3f255

                                SHA512

                                d8ff3c40bbc22bed49af7e1138689e4762eea9a10bed2bde07491279480e9e18bba68bd44bec764c07ea81fc6be6db2f4377321d1049966cbd36f3f14f096261

                              • C:\Users\Admin\AppData\Local\Temp\ja2pe144.exe

                                Filesize

                                1.9MB

                                MD5

                                4b72d82b560777b5824f6ab1cc4da4ec

                                SHA1

                                9937a2e5a505c1a9a3f5005993dfe839f1f73918

                                SHA256

                                812ce93a92ff7bf896ec0c39b4f4a121cc90ebddb1a8c35bb0c3e484a4a3f255

                                SHA512

                                d8ff3c40bbc22bed49af7e1138689e4762eea9a10bed2bde07491279480e9e18bba68bd44bec764c07ea81fc6be6db2f4377321d1049966cbd36f3f14f096261

                              • C:\Users\Admin\AppData\Local\Temp\nsd62A4.tmp\System.dll

                                Filesize

                                12KB

                                MD5

                                cff85c549d536f651d4fb8387f1976f2

                                SHA1

                                d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

                                SHA256

                                8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

                                SHA512

                                531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

                              • C:\Users\Admin\AppData\Local\Temp\nsy62D4.tmp\Microsoft.Win32.TaskScheduler.dll

                                Filesize

                                341KB

                                MD5

                                a09decc59b2c2f715563bb035ee4241e

                                SHA1

                                c84f5e2e0f71feef437cf173afeb13fe525a0fea

                                SHA256

                                6b8f51508240af3b07a8d0b2dc873cedc3d5d9cb25e57ea1d55626742d1f9149

                                SHA512

                                1992c8e1f7e37a58bbf486f76d1320da8e1757d6296c8a7631f35ba2e376de215c65000612364c91508aa3ddf72841f6b823fa60a2b29415a07c74c2e830212b

                              • C:\Users\Admin\AppData\Local\Temp\nsy62D4.tmp\RAVEndPointProtection-installer.exe

                                Filesize

                                539KB

                                MD5

                                41a3c2a1777527a41ddd747072ee3efd

                                SHA1

                                44b70207d0883ec1848c3c65c57d8c14fd70e2c3

                                SHA256

                                8592bae7b6806e5b30a80892004a7b79f645a16c0f1b85b4b8df809bdb6cf365

                                SHA512

                                14df28cc7769cf78b24ab331bd63da896131a2f0fbb29b10199016aef935d376493e937874eb94faf52b06a98e1678a5cf2c2d0d442c31297a9c0996205ed869

                              • C:\Users\Admin\AppData\Local\Temp\nsy62D4.tmp\RAVEndPointProtection-installer.exe

                                Filesize

                                539KB

                                MD5

                                41a3c2a1777527a41ddd747072ee3efd

                                SHA1

                                44b70207d0883ec1848c3c65c57d8c14fd70e2c3

                                SHA256

                                8592bae7b6806e5b30a80892004a7b79f645a16c0f1b85b4b8df809bdb6cf365

                                SHA512

                                14df28cc7769cf78b24ab331bd63da896131a2f0fbb29b10199016aef935d376493e937874eb94faf52b06a98e1678a5cf2c2d0d442c31297a9c0996205ed869

                              • C:\Users\Admin\AppData\Local\Temp\nsy62D4.tmp\rsAtom.dll

                                Filesize

                                156KB

                                MD5

                                9deba7281d8eceefd760874434bd4e91

                                SHA1

                                553e6c86efdda04beacee98bcee48a0b0dba6e75

                                SHA256

                                02a42d2403f0a61c3a52138c407b41883fa27d9128ecc885cf1d35e4edd6d6b9

                                SHA512

                                7a82fbac4ade3a9a29cb877cc716bc8f51b821b533f31f5e0979f0e9aca365b0353e93cc5352a21fbd29df8fc0f9a2025351453032942d580b532ab16acaa306

                              • C:\Users\Admin\AppData\Local\Temp\nsy62D4.tmp\rsJSON.dll

                                Filesize

                                218KB

                                MD5

                                f8978087767d0006680c2ec43bda6f34

                                SHA1

                                755f1357795cb833f0f271c7c87109e719aa4f32

                                SHA256

                                221bb12d3f9b2aa40ee21d2d141a8d12e893a8eabc97a04d159aa46aecfa5d3e

                                SHA512

                                54f48c6f94659c88d947a366691fbaef3258ed9d63858e64ae007c6f8782f90ede5c9ab423328062c746bc4ba1e8d30887c97015a5e3e52a432a9caa02bb6955

                              • C:\Users\Admin\AppData\Local\Temp\nsy62D4.tmp\rsLogger.dll

                                Filesize

                                177KB

                                MD5

                                83ad54079827e94479963ba4465a85d7

                                SHA1

                                d33efd0f5e59d1ef30c59d74772b4c43162dc6b7

                                SHA256

                                ec0a8c14a12fdf8d637408f55e6346da1c64efdd00cc8921f423b1a2c63d3312

                                SHA512

                                c294fb8ac2a90c6125f8674ca06593b73b884523737692af3ccaa920851fc283a43c9e2dc928884f97b08fc8974919ec603d1afb5c178acd0c2ebd6746a737e1

                              • C:\Users\Admin\AppData\Local\Temp\nsy62D4.tmp\rsStubLib.dll

                                Filesize

                                248KB

                                MD5

                                a16602aad0a611d228af718448ed7cbd

                                SHA1

                                ddd9b80306860ae0b126d3e834828091c3720ac5

                                SHA256

                                a1f4ba5bb347045d36dcaac3a917236b924c0341c7278f261109bf137dcef95a

                                SHA512

                                305a3790a231b4c93b8b4e189e18cb6a06d20b424fd6237d32183c91e2a5c1e863096f4d1b30b73ff15c4c60af269c4faaadaf42687101b1b219795abc70f511

                              • C:\Users\Admin\AppData\Local\Temp\nsy62D4.tmp\uninstall.ico

                                Filesize

                                170KB

                                MD5

                                af1c23b1e641e56b3de26f5f643eb7d9

                                SHA1

                                6c23deb9b7b0c930533fdbeea0863173d99cf323

                                SHA256

                                0d3a05e1b06403f2130a6e827b1982d2af0495cdd42deb180ca0ce4f20db5058

                                SHA512

                                0c503ec7e83a5bfd59ec8ccc80f6c54412263afd24835b8b4272a79c440a0c106875b5c3b9a521a937f0615eb4f112d1d6826948ad5fb6fd173c5c51cb7168f4

                              • C:\Windows\Temp\{28A4C4DB-7A1E-4C0A-BD0E-8F10C11AC370}\.ba\1055\license.rtf

                                Filesize

                                177KB

                                MD5

                                f1a281f74d3e91d16dd26d1f313cd8a9

                                SHA1

                                ddb2ca9032c5a9c091eac53b679f6ba428077b00

                                SHA256

                                f79108a254f876e0f6bbcb05a9effbe25dc252e7ea256bfe3fd28ceb79737f25

                                SHA512

                                484c5ca26275427e1fb74d3217a22a0e4aac409aba973e78d7ad68834e7ad1d86c7855d34b227925200f941d288dfc09477b2d7dfe0856810c6c847297b8d625

                              • C:\Windows\Temp\{28A4C4DB-7A1E-4C0A-BD0E-8F10C11AC370}\.ba\logo.png

                                Filesize

                                1KB

                                MD5

                                d6bd210f227442b3362493d046cea233

                                SHA1

                                ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

                                SHA256

                                335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

                                SHA512

                                464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

                              • C:\Windows\Temp\{28A4C4DB-7A1E-4C0A-BD0E-8F10C11AC370}\.ba\wixstdba.dll

                                Filesize

                                191KB

                                MD5

                                eab9caf4277829abdf6223ec1efa0edd

                                SHA1

                                74862ecf349a9bedd32699f2a7a4e00b4727543d

                                SHA256

                                a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

                                SHA512

                                45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

                              • C:\Windows\Temp\{E5683510-DDC0-4A5B-8926-72614363830F}\.cr\vc_redist.x86.exe

                                Filesize

                                881KB

                                MD5

                                9df0848b2753e9255f1a6b4cdc9a5a3e

                                SHA1

                                051469cd9e786b720ef6b70c35a1e184a643f520

                                SHA256

                                59089badd61acb47a07748c9018d3a959cf58f07de9902b0c45dffae3e566090

                                SHA512

                                518a78e77515b2fb21c5f66a760473a1f8ab5050e9bc65a4715ab178e568079f11f65fc173db59dd021b69fe0b606c42e50bf5f09a34ba2009a7b71e88033452

                              • C:\Windows\Temp\{E5683510-DDC0-4A5B-8926-72614363830F}\.cr\vc_redist.x86.exe

                                Filesize

                                881KB

                                MD5

                                9df0848b2753e9255f1a6b4cdc9a5a3e

                                SHA1

                                051469cd9e786b720ef6b70c35a1e184a643f520

                                SHA256

                                59089badd61acb47a07748c9018d3a959cf58f07de9902b0c45dffae3e566090

                                SHA512

                                518a78e77515b2fb21c5f66a760473a1f8ab5050e9bc65a4715ab178e568079f11f65fc173db59dd021b69fe0b606c42e50bf5f09a34ba2009a7b71e88033452

                              • memory/400-698-0x00007FFBBF1D0000-0x00007FFBBFC91000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/400-407-0x00007FFBBF1D0000-0x00007FFBBFC91000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/400-409-0x0000029D84A60000-0x0000029D84A70000-memory.dmp

                                Filesize

                                64KB

                              • memory/400-711-0x0000029D84A60000-0x0000029D84A70000-memory.dmp

                                Filesize

                                64KB

                              • memory/400-401-0x0000029D84620000-0x0000029D84628000-memory.dmp

                                Filesize

                                32KB

                              • memory/400-402-0x0000029D9F000000-0x0000029D9F528000-memory.dmp

                                Filesize

                                5.2MB

                              • memory/1292-36-0x0000000000400000-0x000000000051D000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/1292-1-0x0000000000400000-0x000000000051D000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/1292-714-0x0000000000400000-0x000000000051D000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/2268-720-0x00007FF6BD010000-0x00007FF6BD020000-memory.dmp

                                Filesize

                                64KB

                              • memory/2268-721-0x00007FF6BD010000-0x00007FF6BD020000-memory.dmp

                                Filesize

                                64KB

                              • memory/2268-709-0x00007FF6BD010000-0x00007FF6BD020000-memory.dmp

                                Filesize

                                64KB

                              • memory/2268-722-0x00007FF6BD010000-0x00007FF6BD020000-memory.dmp

                                Filesize

                                64KB

                              • memory/2452-153-0x0000000000960000-0x0000000000961000-memory.dmp

                                Filesize

                                4KB

                              • memory/2452-151-0x0000000000400000-0x0000000000685000-memory.dmp

                                Filesize

                                2.5MB

                              • memory/2452-356-0x0000000000400000-0x0000000000685000-memory.dmp

                                Filesize

                                2.5MB

                              • memory/2452-102-0x0000000000960000-0x0000000000961000-memory.dmp

                                Filesize

                                4KB

                              • memory/2524-82-0x00000000063A0000-0x00000000063AF000-memory.dmp

                                Filesize

                                60KB

                              • memory/2524-37-0x0000000000400000-0x000000000073F000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/2524-710-0x0000000000400000-0x000000000073F000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/2524-410-0x0000000000400000-0x000000000073F000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/2524-93-0x0000000000400000-0x000000000073F000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/2524-411-0x00000000063A0000-0x00000000063AF000-memory.dmp

                                Filesize

                                60KB

                              • memory/2524-6-0x0000000000950000-0x0000000000951000-memory.dmp

                                Filesize

                                4KB

                              • memory/2524-81-0x0000000000400000-0x000000000073F000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/2524-29-0x00000000063A0000-0x00000000063AF000-memory.dmp

                                Filesize

                                60KB

                              • memory/2524-38-0x00000000063A0000-0x00000000063AF000-memory.dmp

                                Filesize

                                60KB

                              • memory/2524-39-0x0000000000950000-0x0000000000951000-memory.dmp

                                Filesize

                                4KB

                              • memory/3392-556-0x00000209EA300000-0x00000209EA301000-memory.dmp

                                Filesize

                                4KB

                              • memory/3392-504-0x00000209ED3B0000-0x00000209ED3EA000-memory.dmp

                                Filesize

                                232KB

                              • memory/3392-508-0x00000209ED360000-0x00000209ED38A000-memory.dmp

                                Filesize

                                168KB

                              • memory/3392-506-0x00000209EA2D0000-0x00000209EA2D1000-memory.dmp

                                Filesize

                                4KB

                              • memory/3392-494-0x00000209EA370000-0x00000209EA3B0000-memory.dmp

                                Filesize

                                256KB

                              • memory/3392-502-0x00000209EA320000-0x00000209EA321000-memory.dmp

                                Filesize

                                4KB

                              • memory/3392-501-0x00000209ED3A0000-0x00000209ED3B0000-memory.dmp

                                Filesize

                                64KB

                              • memory/3392-489-0x00000209E9EA0000-0x00000209E9F28000-memory.dmp

                                Filesize

                                544KB

                              • memory/3392-1087-0x00000209ED3A0000-0x00000209ED3B0000-memory.dmp

                                Filesize

                                64KB

                              • memory/3392-1075-0x00007FFBBF1D0000-0x00007FFBBFC91000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/3392-496-0x00000209EA330000-0x00000209EA360000-memory.dmp

                                Filesize

                                192KB

                              • memory/3392-645-0x00000209ED450000-0x00000209ED4A8000-memory.dmp

                                Filesize

                                352KB

                              • memory/3392-490-0x00007FFBBF1D0000-0x00007FFBBFC91000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/4316-108-0x0000000000400000-0x00000000004CE000-memory.dmp

                                Filesize

                                824KB

                              • memory/4316-98-0x0000000000400000-0x00000000004CE000-memory.dmp

                                Filesize

                                824KB

                              • memory/4316-357-0x0000000000400000-0x00000000004CE000-memory.dmp

                                Filesize

                                824KB

                              • memory/4316-94-0x0000000000400000-0x00000000004CE000-memory.dmp

                                Filesize

                                824KB