This is the Lazarus component delivered via the VeraPort hijack described earlier. The signed initial downloaders are Themidaprotected binaries, which download, decrypt and execute other payloads in memory, without dropping them to the disk. This