74bf074b7cadce06a8633ec33a91a19ff31dcf2e48cad17b71fe44795f355b60

Analysis

max time kernel
64s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VIPAccessSetup.exe
Size

15.2MB
MD5

4c9eefdf645daec351e2dcc24f23ce11
SHA1

5b448eebcabc9208df32ef4ba7794a7c5e3e6b5e
SHA256

74bf074b7cadce06a8633ec33a91a19ff31dcf2e48cad17b71fe44795f355b60
SHA512

08fb706095ef2f29fbd1deff303608194a88c214f9f04b678dd4200c10cfee74f138827fc9f0e14a8208ac955409de80c2e58821d92ab4c57334a5808b4b63b1
SSDEEP

393216:Qk9ENNSNeklpkbUvwhg1y3QSJg+NXcBNaWEaVZu:b9kSNnQbICOy3QSJLtrUO

Score

6^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
8	3116	msiexec.exe
11	3116	msiexec.exe
13	3116	msiexec.exe
18	3116	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	VIPAccessSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	VIPUIManager.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\NoCloseTiled.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\LiveUpdateUIESP.dll	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\help_bubble_tile.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\update_button_onclick_state_left.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_06.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_09.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\InformationLogo.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\minimize.PNG	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_02.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\LiveUpdateUIPTB.dll	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\AboutBkBottom.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\cred_id_copy_icon_onclick.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_11.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_29.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\AboutBkTiled.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\credential_box_copy_icon.bmp	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\menu_separator.PNG	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_13.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\VIPUIManagerELL.dll	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\BorderBottom.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_10.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_23.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_26.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\update_button_hover_state_tile.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\VIPUIManager.rc2	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_08.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\cred_id_copy_icon_up_state_Hide.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\ErrorIcon.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\NoCloseTop.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\sec_code_copy_icon_hover.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\security_code_background.PNG	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\bubble_close_button.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\credential_box_copy_icon.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\VIPLiveUpdate.exe	VIPAppService.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\CLOSE_BUTTON_BLACK_SCREEN.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\update_button_onclick_state_tile.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\yellow_button_up_state.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\About_OK.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\AboutBkTop.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\cred_id_copy_icon_hover_Hide.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\menu_bottom.PNG	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\VIPUIManagerFRA.dll	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\HIDE_CREDENTIAL.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\CLOSE_BUTTON.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\VIPUIManagerJPN.dll	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\BorderTop.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\now_from_Symantec_logo.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\VIP_logo.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_12.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_18.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_27.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_30.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Symantec\VIP Access Client\VIPLiveUpdate.exe	VIPAppService.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\sec_code_copy_icon_up_state.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\security_code_copy_icon.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\yellow_btn_left.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\yellow_button_hover_tile.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\VIPUIManagerITA.dll	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\update_button_up_state.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\yellow_button_hover.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\yellow_button_onclick_right.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_01.png	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\ccLib.dll	msiexec.exe
File created	C:\Program Files (x86)\Symantec\VIP Access Client\res\bk_screen_close_btn_top.png	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{58594A65-ACD7-41A2-B6ED-2597777F2850}\1033.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\{58594A65-ACD7-41A2-B6ED-2597777F2850}\1033.mst	msiexec.exe
File created	C:\Windows\Installer\e5758a0.mst	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5758a2.msi	msiexec.exe
File created	C:\Windows\Installer\{58594A65-ACD7-41A2-B6ED-2597777F2850}\NewShortcut1_C0ADF57F626445648A4051F5964E6823.exe	msiexec.exe
File created	C:\Windows\Installer\{58594A65-ACD7-41A2-B6ED-2597777F2850}\NewShortcut11_68EC464F37144EFB941594C65A7AE1A6.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{58594A65-ACD7-41A2-B6ED-2597777F2850}\NewShortcut11_68EC464F37144EFB941594C65A7AE1A6.exe	msiexec.exe
File created	C:\Windows\Installer\e57589f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e57589f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{58594A65-ACD7-41A2-B6ED-2597777F2850}	msiexec.exe
File created	C:\Windows\Installer\{58594A65-ACD7-41A2-B6ED-2597777F2850}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{58594A65-ACD7-41A2-B6ED-2597777F2850}\NewShortcut1_C0ADF57F626445648A4051F5964E6823.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e5758a0.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI613A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{58594A65-ACD7-41A2-B6ED-2597777F2850}\ARPPRODUCTICON.exe	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
3252	install.exe
2612	VIPAppService.exe
2820	VIPUIManager.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3992	sc.exe
1976	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\VIPAccess_Installer\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\56A495857DCA2A146BDE527977F78205	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FB9BAA6D834E42744B324B603C0D994A\56A495857DCA2A146BDE527977F78205	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\PackageCode = "F4AD58F0F24447A44858A43C3409AD44"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\SourceList\PackageName = "VIPSetup.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\Transforms = "C:\\Windows\\Installer\\{58594A65-ACD7-41A2-B6ED-2597777F2850}\\1033.mst"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\56A495857DCA2A146BDE527977F78205\NewFeature1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\ProductIcon = "C:\\Windows\\Installer\\{58594A65-ACD7-41A2-B6ED-2597777F2850}\\ARPPRODUCTICON.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FB9BAA6D834E42744B324B603C0D994A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\Version = "33685509"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\ProductName = "VIP Access"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A495857DCA2A146BDE527977F78205\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\VIPAccess_Installer\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5096	msiexec.exe
5096	msiexec.exe
4060	msedge.exe
4060	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2820	VIPUIManager.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3116	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3116	msiexec.exe
Token: SeSecurityPrivilege	5096	msiexec.exe
Token: SeCreateTokenPrivilege	3116	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3116	msiexec.exe
Token: SeLockMemoryPrivilege	3116	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3116	msiexec.exe
Token: SeMachineAccountPrivilege	3116	msiexec.exe
Token: SeTcbPrivilege	3116	msiexec.exe
Token: SeSecurityPrivilege	3116	msiexec.exe
Token: SeTakeOwnershipPrivilege	3116	msiexec.exe
Token: SeLoadDriverPrivilege	3116	msiexec.exe
Token: SeSystemProfilePrivilege	3116	msiexec.exe
Token: SeSystemtimePrivilege	3116	msiexec.exe
Token: SeProfSingleProcessPrivilege	3116	msiexec.exe
Token: SeIncBasePriorityPrivilege	3116	msiexec.exe
Token: SeCreatePagefilePrivilege	3116	msiexec.exe
Token: SeCreatePermanentPrivilege	3116	msiexec.exe
Token: SeBackupPrivilege	3116	msiexec.exe
Token: SeRestorePrivilege	3116	msiexec.exe
Token: SeShutdownPrivilege	3116	msiexec.exe
Token: SeDebugPrivilege	3116	msiexec.exe
Token: SeAuditPrivilege	3116	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3116	msiexec.exe
Token: SeChangeNotifyPrivilege	3116	msiexec.exe
Token: SeRemoteShutdownPrivilege	3116	msiexec.exe
Token: SeUndockPrivilege	3116	msiexec.exe
Token: SeSyncAgentPrivilege	3116	msiexec.exe
Token: SeEnableDelegationPrivilege	3116	msiexec.exe
Token: SeManageVolumePrivilege	3116	msiexec.exe
Token: SeImpersonatePrivilege	3116	msiexec.exe
Token: SeCreateGlobalPrivilege	3116	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
3116	msiexec.exe
3116	msiexec.exe
3116	msiexec.exe
3116	msiexec.exe
2820	VIPUIManager.exe
2820	VIPUIManager.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2820	VIPUIManager.exe
2820	VIPUIManager.exe
2820	VIPUIManager.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3252	3472	VIPAccessSetup.exe	84
PID 3472 wrote to memory of 3252	3472	VIPAccessSetup.exe	84
PID 3472 wrote to memory of 3252	3472	VIPAccessSetup.exe	84
PID 3252 wrote to memory of 3116	3252	install.exe	87
PID 3252 wrote to memory of 3116	3252	install.exe	87
PID 3252 wrote to memory of 3116	3252	install.exe	87
PID 5096 wrote to memory of 1516	5096	msiexec.exe	93
PID 5096 wrote to memory of 1516	5096	msiexec.exe	93
PID 5096 wrote to memory of 1516	5096	msiexec.exe	93
PID 1516 wrote to memory of 3392	1516	MsiExec.exe	96
PID 1516 wrote to memory of 3392	1516	MsiExec.exe	96
PID 1516 wrote to memory of 3392	1516	MsiExec.exe	96
PID 3392 wrote to memory of 3992	3392	cmd.exe	98
PID 3392 wrote to memory of 3992	3392	cmd.exe	98
PID 3392 wrote to memory of 3992	3392	cmd.exe	98
PID 1516 wrote to memory of 1744	1516	MsiExec.exe	99
PID 1516 wrote to memory of 1744	1516	MsiExec.exe	99
PID 1516 wrote to memory of 1744	1516	MsiExec.exe	99
PID 1744 wrote to memory of 1976	1744	cmd.exe	101
PID 1744 wrote to memory of 1976	1744	cmd.exe	101
PID 1744 wrote to memory of 1976	1744	cmd.exe	101
PID 5096 wrote to memory of 1836	5096	msiexec.exe	104
PID 5096 wrote to memory of 1836	5096	msiexec.exe	104
PID 5096 wrote to memory of 1836	5096	msiexec.exe	104
PID 2820 wrote to memory of 2948	2820	VIPUIManager.exe	110
PID 2820 wrote to memory of 2948	2820	VIPUIManager.exe	110
PID 2820 wrote to memory of 2948	2820	VIPUIManager.exe	110
PID 2948 wrote to memory of 1284	2948	rundll32.exe	111
PID 2948 wrote to memory of 1284	2948	rundll32.exe	111
PID 1284 wrote to memory of 4580	1284	msedge.exe	112
PID 1284 wrote to memory of 4580	1284	msedge.exe	112
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113
PID 1284 wrote to memory of 4320	1284	msedge.exe	113

C:\Users\Admin\AppData\Local\Temp\VIPAccessSetup.exe
"C:\Users\Admin\AppData\Local\Temp\VIPAccessSetup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VIPAccess_Installer\VIPSetup.msi" TRANSFORMS=1033.mst /lv "C:\Users\Admin\AppData\Local\Temp\VIPSetup.log"
    3⤵
    - Blocklisted process makes network request
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3116

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A8B87DC944AF8054893750073C4781A5
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C sc config VIPAppService start= delayed-auto
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\SysWOW64\sc.exe
      sc config VIPAppService start= delayed-auto
      4⤵
      Launches sc.exe
      PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C sc start VIPAppService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\SysWOW64\sc.exe
      sc start VIPAppService
      4⤵
      Launches sc.exe
      PID:1976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3F13F0CBEA50D11599550A248AB4750E C
  2⤵
  PID:1836

C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe
"C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:2612

C:\Program Files (x86)\Symantec\VIP Access Client\VIPUIManager.exe
"C:\Program Files (x86)\Symantec\VIP Access Client\VIPUIManager.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" url.dll,FileProtocolHandler https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/vip/vip_access/getting-started-with-for-desktop-macos-v119726092-d2353e13.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/vip/vip_access/getting-started-with-for-desktop-macos-v119726092-d2353e13.html
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbf8c646f8,0x7ffbf8c64708,0x7ffbf8c64718
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15129514679907804564,16145641814676112921,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,15129514679907804564,16145641814676112921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,15129514679907804564,16145641814676112921,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15129514679907804564,16145641814676112921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15129514679907804564,16145641814676112921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
      4⤵
      PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5758a1.rbs

Filesize
24KB

MD5
8dbb805719ea489c6eacf38fb2109baf

SHA1
e4099704eab329cf94c945dd6ef996f528338348

SHA256
629f882c675470fccd482c0f28aa36bde5d271b144a4c2c9f1a30b0f3bebe72f

SHA512
10c1319025799ae43ef9bca4866cb7f85062aec2cfa48ebdd031e5b0e2047941c87e15a297a26197eb6f7eaf82262e69b064d4eee401b8ff8570a1cfcfe7f4bc

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\LiveUpdateUI.exe

Filesize
465KB

MD5
d1a41e1853a193bfe33f9c2d0d21cd9f

SHA1
5062e4d8ad5ea5c4dd8e29c2ce93e32dbae350e3

SHA256
23d47a5d6162a4d241b6bea3c22cc194491f5e09c13cb95402d826e294bff275

SHA512
2b04a634f984c31326429bfda725321026a42eeafd7f4c5d204840f7f968c776b797cfb1c613fa43ea72c5ae9fb57f0aa6679564899dc6f07a27c00f3f35da8f

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe

Filesize
73KB

MD5
e82412b9cfc6fd5d5108a6bccf3362f5

SHA1
1bb9f3a233cacf1727b98d17efeee2b2b97eb2d8

SHA256
c436b2380a521b6841716382dfb1bf2bd0fdc413c24ce20511e4bc791514afa1

SHA512
6a185594254d332f2d401357952eb3ab8a4a06b7a10a7d45cbe544786a42da12f31d8b8fb995ca6278774c517939604a29fa5253391c219f9122eb3aec4a73fd

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\VIPUIManager.exe

Filesize
1.5MB

MD5
5d4c06bdc1ec28ef79e7f9bddb8ec0e0

SHA1
a695e12caa3b80bfe3e9788fe0af0dc7c50596b4

SHA256
5e5049341084106e8014e45b7adb0d2e316e44e73a2d2499d21b9c08d495970c

SHA512
8b565391bd47ddd8d2f999060a1f46b87036d3892b2403561633219d2883caf83e360d49edbfe4835ed807f8e60ec59b8a123a6793c496d66d2863daeae4cff0

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\CLOSE_BUTTON_BLACK_SCREEN.png

Filesize
1KB

MD5
52e5047a24bb18fa41f2c2ef4a77d907

SHA1
032f2c2398f2f361b958482d413fcf7604ab1b4b

SHA256
803ec5feb24ee596b1948ef03d36d32b7f406bd304ab768b940f8b5a4713c691

SHA512
f3834bec40222fbfcd656bd059e42e2169855bf5925807126c60341cc1a9dabf7f3af1bafaf429c3cdf0b410cd1e08b429e375abc8273f67d333e6143c5e8943

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_01.png

Filesize
541B

MD5
eeafa933b6b1e314760d79b9544dcdb7

SHA1
55fc3d14769e09d93f190f0ea985582775cbabd1

SHA256
1f1484b86befa6c58b1fe0b1ba3f38e53829dff7b5174d2119ef9929f44fa157

SHA512
aa643da100a79a3f07b0b68ec0cd6e21daaed191ffa2acca1176d572ecf0df2f771629e10c6202315e01a4ba724cfcfe0a7262eb617e17031a5431919071e646

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_02.png

Filesize
583B

MD5
b21cac53c8b331d7070bc7ac283a2f35

SHA1
cd079c8f0a7be9111e801cdbce266c01d576890d

SHA256
86765548738162bddad089abab51e0d984c692ebe9f156c53650cd8a118a83cc

SHA512
7a8e83744dd213d3d502e7d475794ed91ea41b03e12b8d664367ffddaadd7e9461df20bb5ff25c4b5ca399c45b79fb0f374f7395b94727cefcc140e615623fb0

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_03.png

Filesize
568B

MD5
6ed386f1a4b47934690b0e6555e984c9

SHA1
ff42c295d420d46b35dbf9920421fc177f88244d

SHA256
347c2daab3d08055bb1e718e1fd81c08d3e47386a8acde6c91d8970fab64e4b4

SHA512
877e3fc3dffaed084ab119f4ac5320f3a646517ba14c012b5495e072d47cb11f30080745e484b727e4bca92d4cb079faeee0feda7d45e423b047b56752d19281

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_04.png

Filesize
589B

MD5
5c402e6dac30e69a6388bb2b55c8f6f1

SHA1
7df5b41c25ecf136db039b45269858e67be77cae

SHA256
37e96c5042b52c6da71476d6fdbac2cdc3e10e82a2c300a6de04911f3f320d54

SHA512
57fee92dd2d1a6f516d08ed219697e62f2d6d350857788f9fa82f70219586a0afccf7d11b2c3e3374182751b852e6f7d2bfc7ab7246ad3bdbef81bbe674092fa

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_05.png

Filesize
578B

MD5
39a4f334facc95f772cedd8b5dc2a160

SHA1
aca063cce5f6ae8d338d2de7330a7bf3c90020f7

SHA256
5c3ef9d3903e6e84d147509e026e1aa7e8a087c93c1b0d09aa65c5615a922884

SHA512
d96b26761f5625c6ff2001c33a54ab0d28b12029bcfe03e8720fde266df673b6931f905f7c00acae819c3cb3593a393f86e10147384ade596d5dfe6092b7458b

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_06.png

Filesize
585B

MD5
fedd8d98aec1dec791b9238debd1ada2

SHA1
6ae30a4035b395c0a763de608756b873f2821761

SHA256
1e74926719913909b652e311c86cc8e0645c3c43127418cb313a75d7ca45d657

SHA512
d50e7b6bab6e08709803ed089ad00b5566614c9c12f453ef095f1d86c8cdd5bf56be9725e115313149363ef998b316f9e06defac11d6205eede19b0c75450b5e

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_07.png

Filesize
573B

MD5
deb1cc02d37da5a999194c953ad5febe

SHA1
cdae2edbab28c086fce528c8480767738b208792

SHA256
b43c7b37cc352fee6af5f75cc84f043b6b597d64a12009d024b1af13cbfb5ac5

SHA512
af7c8bd115ff288a6135a8734ca6402643e38eb2a8bfa33a690319a8ccb079c677d34dd2e3ec1ec6ca2e0215696d78d9086df349efa78701c42b23c875ef5bce

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_08.png

Filesize
556B

MD5
f406aaa4803702e0d0646b5769c43792

SHA1
6eaeb2c0b09839e58170b9964dc4dfc872509393

SHA256
063ebacd0a89fe394f2eb5216465d1d81c8eb94e78443440e2a1b5e58cef0f61

SHA512
b6830b808aeca1023899f9c154a918eaab1ccb16aa6f86e395bd4cd8060747035a27db14f60b230d522a750739a3c5df542d57b0f337d0a4212c9e3670950a94

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_09.png

Filesize
574B

MD5
05de5ec1b6a9621b896f2048dd8fb9c8

SHA1
d1bdcbaeab44a3ad8a3fa94083f6df09dd54c56c

SHA256
c97bd65c18d5f48daaa2f617de11002e47dfc3942a69e16e3ebf959e775c64ee

SHA512
575277d374148445c5168a025dc465664c26a922136e6aabfcd9f0ea13e21c63bae0aafb81ea21d18b829fce13c1f7ea5f5e6c1727fb93eac21714e3eff29c6a

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_10.png

Filesize
587B

MD5
a125183cedc96071e24b7381d2cf2a98

SHA1
0ce050dc197db9f2956c0c832b23641500b84419

SHA256
12a87b441989577573c3e77a2d8a17e35c082bed408f3c56f6da79488b84167a

SHA512
ca93347db92057c86c09b5a7095fd5b71fe25e6461ee93d973ce78fd141132186f0c6294e4fcd0816d1cf879f132c1c0fd948e8efd6799a84e5a2b9e619c9c03

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_11.png

Filesize
584B

MD5
f2b5737ddf30efdd468397c60605e307

SHA1
ede33fed8ffa0777dbfb546e1512ce34a5090638

SHA256
3916ea6fb29b3a13861aa094730ab0acc17635be8c1f59c70d82a718e33443e6

SHA512
2d5b07c3fa5f3dcef3ec7bbd2c2d3f2fd090c5586c5fe117ba4c00a991ee17c7d384159c27b2260d5402572bb1af042e493ad6eb4d13d9a11865863e06da650f

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_12.png

Filesize
581B

MD5
67c37bf73860078e951f30e0bc85df40

SHA1
8e9d2b1086513e78c838688a2de3f30ec8d3c248

SHA256
dd7ac1666938e65955ed5d867b1c0106c1aaf21bec88f5b613fa44c8b33a0d53

SHA512
f420a2639b0b67ddbb7344eac86c39c23485c98a69b639ee3dc1093484ef99ce12dbb5b512d1a43f842ec96b334cf29c97f1e90008fca557d5fe64d42e48cb53

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_13.png

Filesize
586B

MD5
9f562b2edadbeba9c38a9aa20f70233a

SHA1
0cc1fd2f091cd35346c8bfba28fe590809483983

SHA256
b6d62f9b56214961c23b102be2f21486bac5dca786851cfbe13a2655613aa8d5

SHA512
e2b880f9d4b0dc50ae53ff86a1a501216e692f821fd283d23f37082f888ca3a55e8c608f6b67e15b33d68f739e32e358c70714969ea4eb4e45a7b8fc61ca0001

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_14.png

Filesize
585B

MD5
79ce878d7040aee4fcb46a3c5f7fa382

SHA1
4c12114fea95012cc4fdceeb62ea05134ee901d3

SHA256
bc16509d33181a4cdce7031734092b4b147963f47c7665e81d1b8ae934a27001

SHA512
943249a96f490a32bee9915b00317725ee29c0492a89387a566b1867454b4adb2f2876d6ea524c260b759b63036a5d2051a40e6fac91d3b834550701508d4deb

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_15.png

Filesize
573B

MD5
b5a1f0c4e450ac561464ab1951ed87ff

SHA1
542dd0c562cc94e76e4618db22cfd97edd6472e2

SHA256
9be0678eaba2a8b98b5ad539a05e3dade50d09233c655db85d6ce65a29c33893

SHA512
b9d219608fb4d1c6368658e59abd16a79100ef9d7e4e2e7908b17a0cbd3313bd741edcde2473fb65b5f4066925f7083996a91cbf0b09b967ac804c2ca43a7ab9

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_16.png

Filesize
548B

MD5
f273a55e497d83e40371346d0b7b90f1

SHA1
32ff1b27d853f26fc6893f172e71253cfc3ce93b

SHA256
bc3ac3110d162bd96628cc509f990e7d85fcdf107a76a0173898e820e5f1750d

SHA512
1281230b4d04cf87084cea354cb2041e66bdf24c87fb41dd807e02f7e43c5facd53b07972f5d539f35683db1a19325b20e819e025bd5317ff64c9681304a9e89

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_17.png

Filesize
581B

MD5
6f4c34b8b230e55393fdc1383b6df407

SHA1
4c6038485c4d92c2fa89aaf16c979e9f3305b5cd

SHA256
9cfa8ae94de14d2e2bcbc2b889ba56d2dfbe5b215541d4508c4e36fcc6b04297

SHA512
ea6a5c24ded3600b7ce0d16dda05ed15f3d671c3dda47884743d6200e88a87f2fb0350e3ec4d76278d5d02ad5581d2882d7bec717edd69c896eb7329b818af67

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_18.png

Filesize
589B

MD5
7af17e15a501cd1c71efa9012d4aa548

SHA1
739b17c762909ad31b4f99c895f8af923e20b5c3

SHA256
1c070c02af23d444f0320c21e4e1314b600cb6805ccdd841e0febf7895e58a0d

SHA512
641fbe39fa26de51553f9e8eadff77a2c255bc71677b23d49069580958c42be47d2dcfc41ce681618329c83382b8135df50842aef1cb502088234b32e67fd973

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_19.png

Filesize
590B

MD5
cbf251a7ea4d1df30b80a43dec7bebd6

SHA1
161a45e344f14a7f4842074c27aeaab49dd4daa7

SHA256
7d036760a0d431e2b4b286ee96a623acfb52e130bdad785f314002def7d26a06

SHA512
d5aa48615030787604a434850b31004c09644070e15355e7b170109a02c4a49a8ee4d34bbb5bc375c66704a9138f5e4f1d21198aa5c188b2c767ebcc0f88badc

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_20.png

Filesize
577B

MD5
2d0a7221e3aa046d618f7be4691b9c1c

SHA1
ed58e29ff5815cede4e4b02d5676d2c9a5871438

SHA256
0da2570bbcc3d04845b9c69974d9fad455ff21f4b10ee7673dc8c2266de24d56

SHA512
49afa0dbc74455efa008cec8bf2a5a049ea0047311f1db26b48f8fc1b9ff7fb87e27353212609e2a363633377a9441ff4ba53c6fc7317e23ece5aac4a88e5524

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_21.png

Filesize
608B

MD5
c25d66aeaeb612e0180536dcba2e6425

SHA1
97a99c2502cacf56a38f96511cd5a7aef29a292f

SHA256
e930027f4bdfaf0fd5f02508c7c3d6a6ca04dc2018feaee5583c661896627974

SHA512
ab46146af9d8eeca0a8d4c295e88dbe6dfd8ad946e8a0a6bec0c7b84faad5afc72b784d80cfddb287a375fb31b8212fb1de0fadeb7e58e957a55286cc24e8b1f

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_22.png

Filesize
603B

MD5
067dcc4379613aac42ca9a4e85632320

SHA1
a9d890f0c247db01e1326fd5349a49ebb863803d

SHA256
f8293ab0a5728aad93322a048a217b1f4f44a14c0643f727ff752afcdfaa6f45

SHA512
04eb954273fba482bc1318a45724b2f7ec7272061340ca8f736685af2e6e45659742c8dd4b81ce276db4ffe1f09055239a5d3931321883d3f0f52f5f02ba3026

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_23.png

Filesize
592B

MD5
aa2fa661da516c37973acebb610cabb9

SHA1
e27664a7e65ad4a2e6fc7bfa4d2bbf07037d5946

SHA256
6ce87440a81ed48ec6562815e88afd86fc85a9a4b8799ad17252bc4cd2160273

SHA512
ec837f3e292fee2fe958aa6dff8d5a9996bf97a485a4a9c78f0093d02140ff3f891d5ded9acea11795eaa19bf9c0bef91f57df063a5d71c7ee95b17a67b8dcb2

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_24.png

Filesize
575B

MD5
0d66ef4274f5f5fd1564b3fe600960d9

SHA1
02402cebb261838f9794818ed300f05c0b4af931

SHA256
0571a52ea8bb78bdf53d2b1c35829642bfbb3942c290660f4c8d215f060f53f1

SHA512
95a83259b499d9adfcb15ec4251726b9415a03e63afd0ff79fd6a8c8ffc85ae19a12ad29c9143c79c6b5fda5ad08275499050fe04156fcbc221d20234f749c13

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_25.png

Filesize
583B

MD5
54754d475bbdeecc30a90b75b8083b6a

SHA1
0ea75de9105e1f2d5ff2cfcf63ffc5a02ec4e8ef

SHA256
8bff5ac6ca1c8d755f125fd775c64755ac0285e60ff0e77c74ab22acd11ad495

SHA512
717adc421c83fec44c8a16a049240b4a09e14647fb1ce8caf8938bb9b9790ec328e6b881875cd3b14e32d808b7d2534c39bf7cbaa629a7cda06f19051c327d67

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_26.png

Filesize
582B

MD5
0f9f5581d7ae2c3a2e85f1896431e540

SHA1
2fed6f7bf05041ce17dbea689c95bfca6d8a2022

SHA256
e2acd682e83090879ca5ecb61c5a4661950533f17e6961a02a0b853d6c0e05d8

SHA512
8524120583a3fe39dc4ba40328033a742329c76fca1778d03e2519e61c3d0b4b7f9c1844a54b86496319f9746e889b4f9b3f5a5aa8d0c19b581a63a12c5ba58c

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_27.png

Filesize
578B

MD5
2fc83b24a7d7690eb17e38b76fb6677f

SHA1
b1fb8899d172579f5f518423cf62224e9b7e637f

SHA256
e0d01e047414c471f738ef82032ee908f0515582f72fbd5e8ce7194dd475b68f

SHA512
e94a6b9f4fb2a8add76e2f0ad02cde544ed52018603f37a197e9c91d9e0c4fda9996e7dc1672ee3fd0423f0668c5ff1d86873e1d564e0615e84ba1ab65e4e712

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_28.png

Filesize
580B

MD5
ac85b221c9ae9bbe9a98d410f970aef7

SHA1
9076a88bb00c3d2b949788ed6ffe8cd71fba5d3e

SHA256
dc95828252eb8c2d76ac54819f715380dc61c3ba98ba1904b656ab6fa1f9c9c9

SHA512
2890829065c56377d14e913dd706259679adc2cea9c47b2751ba6c10064840d0f1ab3cb155f2bb3c7ad8b1c673a25019eadf9a33aaf7826e07cb2d73481c326f

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_29.png

Filesize
579B

MD5
dc1e5055adea07e3c693de946fc2da67

SHA1
47cb7b92ac6202d5d443f09fbc085f9ccb63a456

SHA256
09da0012425364ebddcf4216c16646e1e918daefb0ba87ff1a0c67c4fdcffd1a

SHA512
f032003e7a8dc52708f2ac8d8a51b13c43f91099421a57268a8b5dd3b0d5ffdbf54db1a8bb59ba11b46843c6f80012481ce00aa44c40d37d743f87e1040b7d74

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Clock_w_gradientslices\clock_gradient_30.png

Filesize
569B

MD5
731fbe5a628a98e6e51a54a22c190cb7

SHA1
b109812794e2fa245b79d59b08bc0a9759ba7415

SHA256
d3664b11c726f37827cb883c9f7c4992c78b8aedef2f0f1642da3564f0cae0ca

SHA512
6b5240d446ad55b1a1e2a6ab7d0c647629eaaf7b8d85398871e3d115b1c0cb0dca774a372cf0e4832516162c6bbb658f87045544da1c26ca88a97bc0743be63d

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\DisplayBlack.png

Filesize
256B

MD5
3830c2b69e2d7ee8dac21d06c2fc3027

SHA1
cdf003fbad76622b98fd68152659ec518c00a479

SHA256
e3cacacb721688344a7ace5712039649989ee4ced12fb71830b116fb4b0e7687

SHA512
802c2f6870c77d1bacb94683457415b127454979b4998cb49fad76f480c6d8de3ef18eaa7e22f46d613754b2276ccf74154aaea122ddc2a2a294f17927a2414f

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\NoCloseBottom.png

Filesize
3KB

MD5
d33978f971977566531dfab255289336

SHA1
a547c25be0f520d3f82de4bc4888edede67567a7

SHA256
b9672bd2aec18bff7d3021a37abc5ca1df0cbec13181b76337315a915cddba80

SHA512
2dc864a8f8ab097e306f696947e5b7b14882438de7d0a2839d96f7e8e9ccf67b01d6578edd82859bb90db2ec8518e7423c172e6be5a30ec623ded30fd45c9c0d

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\NoCloseTiled.png

Filesize
198B

MD5
18aca6bfbb5ac1ceda3dd8d46d12f402

SHA1
66ac71d31183e48d489d44f5ccb2407aed7b0f46

SHA256
bb38b021c7af375ee26490db8f116182cbee0b70903b76389805f0061c5aca11

SHA512
918368e2fde60423d15290b1b230ce6249b8bc377330aa36f82e38516fda42acfb66591065a646df09b209a464a23b8f6a6df1f36dae99986c26190a1ceced81

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\NoCloseTop.png

Filesize
4KB

MD5
28d50cc9e4cd39977d602b4216644977

SHA1
ae3ece8440eec7c74087fe8049d9a39860cdc7f4

SHA256
96bc5b0f812e9a603896b1131ef34dad9dc25bdd3da7cc4cd18a18aac2f003df

SHA512
4c3d15a5a5aa99885e8df35884319d0aaa3eaf0e105bd60abd2070cbf10dcee2ca50fc800faed798214a441fce70857cfc33ef9876e5bedb28e4f0514063afff

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Rotating.gif

Filesize
3KB

MD5
c8c209e826c4217b2958659cc7287d8a

SHA1
892bab4cb46cbcb02ab480c552d10625b6390cbc

SHA256
6068c5d1c2a370eb054879d2a44a7ecdf04f8e420046af844765e0348d0c6de7

SHA512
2425eaf406d2ff295adbfdb14dfe4db642c9702e20d4e5be00b1de319fc88d5adebc23e9d650f402541f474f56946a8b3eb88855a848f2b634849215c1bf92f1

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\Settings.png

Filesize
464B

MD5
3b6d435e09cf6dfa25b5ac3838d9f661

SHA1
c6ee219bf45d40bea6f05034d811741f88c1af0d

SHA256
0f04191cdb7c6438a949b35ade38f0445bbd0b51328de550232bcdbce4812650

SHA512
853f6716fa8901e877759434cad8f32ed68e94331688c00729f04eaaaeec09f7e8433223cc2dcad6d10b654d58c872daef01fafacea4646c386a40230a13198f

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\TimerBackground.png

Filesize
158B

MD5
6bac2f9f1100062a606da16b297de3ac

SHA1
bd632682dfc28f316aaa48ea876c40f87a4b6d5c

SHA256
119acb58f5c80970cbf4fb8b73e48c2bc25d7b4dc70ffdd9500bc736b3185a56

SHA512
367a663215e699c089fb44ba7d4b6955d8c4e58aef47bc4ff081cb26be0841f37aac83d895ae8eed2820e80f4bdf197db0eeed1179e4a8dc511a7f42fa4bf69b

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\VIP_ACCESS.png

Filesize
4KB

MD5
9facd4dac7b7ca206ba00acdfe49a9b0

SHA1
afac0203c7b2fa06ad75025fb13220bfa6a1e85a

SHA256
046219254b885fb7d1eb0e734865da4c42b1c52a03216145d61d2ef143b2cf26

SHA512
fc3ad728720d38da78ccf9c85586ef04e4d5fbf19663c7b92dc40b0cb538ce2ef01a8ace5800d1fa795307a262ca29305c1b8f26efab21ed70de26a013ce560a

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\VIP_logo.png

Filesize
1KB

MD5
fd2a2bce74ed1b41a1d1b08a56e58d40

SHA1
c9be65be8a1c4275b4fbee13cbee7ff968afd30d

SHA256
aa061ee160b8bf69d48361e65f76791b97c17d17b431ece287549a278553cc88

SHA512
a71b979a284bd111787f5af03886260247cd6630b501724f320081680fdd21104e7ad6bbe0e72b2d1cdbb4407517c2edac5559b46d5bab9e3a7b752cddb48d07

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\background_image.png

Filesize
422B

MD5
26e676ceac36e6a992defb4122af24ab

SHA1
274184f74a183e8c3d415aa2c172ec029f07735e

SHA256
48c99e6c451d6a8b890f202db61cf8c2d7c33e716b0ee0fc38572bd05538093f

SHA512
e931baad3af7cba94a152437f98a46acfad00987d542c7dd7adcf817569d2ce118fe106b42459c01539e9ff293a63884f8b9e337b934b9232715b52abacd44e7

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\cred_id_copy_icon_up_state.png

Filesize
830B

MD5
52c4e599bdc735cd7d57d5d25a53cd18

SHA1
3040f7d83a77595c8441a3ae08045bb5ab43c5d8

SHA256
9857f8133397dfd2040a7d14eb2d634af40565168f226e9d31d2703e45f257db

SHA512
503d68cebe9a59f78c13cf50d4a808023f86116c2446b09732308d3927db8ae4d643762c4d84010d0386dce003f6ff929e9c8efb8f957c015d85ca2ef974ae20

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\credential_box_copy_icon.png

Filesize
2KB

MD5
38e5d6fb750a3c8848661d97ba22e7c6

SHA1
a9a606594dd1ea3029eaec1d6fc4e33a1ec65849

SHA256
85946d934975fd076109f49132846cc98cc8b30ad801482fd547ddae394d66d8

SHA512
eeee4ec44af70718af47d9e0ad48fb88d984bd88278a57dac5bc7330e560ecd4af63df9648be63d7af47cb551570ab8870ea5c2afca1c807ad0319d240a44056

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\minimize.png

Filesize
1KB

MD5
28b3b85ef75f88ab6f95cb9462131f81

SHA1
37dd655fdef7d3569385a405ce2fa10e7d78a143

SHA256
142923e9067bc1bf77d9794248d2d78e3504adefe36ecfd599ce745c97cc6c22

SHA512
705932242de57f367270497c57156a1ab7074580f2421947384b8b567d96b121c83c5811c8d358fccaa105c5d800f9968d627124c7525123936334a80a17b826

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\sec_code_copy_icon_hover.png

Filesize
1KB

MD5
8c38598bd998f1a02f59c19a1cbbb5c9

SHA1
40574754b6dc0e126db556cb36e166b4f4344fce

SHA256
08622b833ec0df6a1a641adc6bf2818ca97fdeb5eb495cee782041d73320ff19

SHA512
9968037dbe94b1b884ee0cba7d80d43f26edb98c433cd3b93aafa1b68cb44b3824352688a87cf0a64f582f5ae9734e6906bab6d01f30484df7f3b224359c5368

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\sec_code_copy_icon_onclick.png

Filesize
1KB

MD5
b6cb0c26c998f6dbcf6e66372868d7a7

SHA1
2987ca930ee0e281b7917e6b2112e25cb4d34518

SHA256
5bd72ade4b052ca3a1fb69cae7785b641eaa7f4f51022a8cf917e8e46fb9c06e

SHA512
3a1f968d7de37919fdb11e21b6c2b2c1a884182f5b5d1cf712f62b82b45d8d55fd587c99ccf975732d79e1d2c19c04e6f370f13da864fe94f1162c9834fe7d99

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\sec_code_copy_icon_up_state.png

Filesize
930B

MD5
1270aff6138b2a9cc2f3e53792790c98

SHA1
263964ffe3f1704d7848e6d92ced3289dd19f57c

SHA256
e04de3f3c75202767721afa573744c8f09b474b2defa2b704e8a4378f75d5fe8

SHA512
6d6e31a9bd4a2241686e70ed24a6e7c07adf5f54ddf9c61d36e706b83929a13208a5767d8175ecffdf07a2c425bafc9a8808500f6cab42a3859e423da3a376f5

Download Submit
C:\Program Files (x86)\Symantec\VIP Access Client\res\security_code_background.PNG

Filesize
3KB

MD5
27dfaf147661106e502362f65ec27c3f

SHA1
7c376e392d368559dbffaf7f7a0451b7bdf61eb7

SHA256
dcfcc747070bb91541f3c286241db4f92ec929c1cdbf6cd35528d360408ddcb7

SHA512
6840a033989345ba26b420459f80a40871d014007fb96444818c91e53ef8418e5cd8b9bc03fdd62daa1abef3d0f6c3c8ca4c3dfe9c8f66ba79b05d89debc0a26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950AB

Filesize
834B

MD5
cbed24fd2b55aea95367efca5ee889de

SHA1
946f48b5c344fd57113845cd483fed5fb9fa3e54

SHA256
1dc8a0fcbe260b77adfe5ad9aaac543239b2a0d9f4e1f3c2657beee4376ffee4

SHA512
c504a11ea576f8ce14de26a0617e22e71e14db0f1dadefc187ce94e4a35a83743c743824e3629899c262aae4772bb86a0ee5bb643db20645483f0c376215ec6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_62F070800935B58FA184DB97FCB304B2

Filesize
1KB

MD5
209c36a3f7040acd1fb21a5e95dd7918

SHA1
44f91710c6c7011977081d0632f3b095a76aa83a

SHA256
b494b6037c019d0124d3af177220f551c941861d5f67779a16f501173b5b6353

SHA512
5ead4ae37de7f102dce4b4604f9ed5bffb91e7c488076424d33e151936129073a1d538507272dac393dca21741a910f99c2607b2ba16dbfbb984f4760ec583df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB

Filesize
180B

MD5
e9c66aa1caae72db7f0c4b1bd2200a4c

SHA1
226f88c5ff57fc6ec20ac8375b11b78135e55228

SHA256
557a9002e35958ad17a00427aa3eae5de636bc5b0a08faf5098aa450cb1010cf

SHA512
0dd72f9848879ed79156fba66a873696e8c6a9ca0538f7b668bec37ec87a7e3377537ae66450c722cb4a1cad42e867d4ef321c67d285d42fc12fc7b21679fd93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

Filesize
398B

MD5
603d8496c87a531140b3f05d9053176a

SHA1
847bcc932708c10a0c07e6d150c2e5fb4363a671

SHA256
c8afa06989517549f2f1912587f3697b2cb0a6250822789bd3a2f3e99ef338ff

SHA512
7993b32ee30d71ad10efa74457d320a23ff1e53b42acbf8f8263a90f51bc98670b0a7963016b180f0933e1de56c11a8bbaa4faaa7de6b2c56e38ebbbe9a775c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_62F070800935B58FA184DB97FCB304B2

Filesize
406B

MD5
f2af8ca7c8ed3f0408a567f4d153c17c

SHA1
4acc24aafa889926a7bea365fc0dbc07f25858c6

SHA256
9d855b00e113076f27bd1fe66b9a39433f875809fa28f51d37ab400d650d6c55

SHA512
a5d13d62f07910aee25bbaa35821f97df9f753c3cd09e0fbb0b9d3f7d0429aefed2cbef8dcf52b3ed45be001313b0e54fc163a34ef3a3f4d12ceb269fb3aeb9f

Download Submit
C:\Users\Admin\AppData\LocalLow\VeriSign\VIPAccessToolbar\CredentialStore

Filesize
2KB

MD5
f41db2309d13333ef8f6e11835482315

SHA1
57be85cd2d62a0cd321ce411d818e945044ede68

SHA256
7700f9c90eeb9a8abb6c2e8fd1b32061df5fd64d7d571de216f579b116aeaa58

SHA512
bde92874c594b92110a77bdf614da3163116e767b90c92eddf3e52269644ec6c1ddb407727516ff62614f771e83f61ac51f0a64194e850dd8ded5ceb1eef609c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
b241aff3cffe374c76c690a8091af0fb

SHA1
0880ec95a381ca7e0c05701a2dfb265804f2d595

SHA256
458d828dfcde6a92d710ca12776a9c1f142970423b9a4f1e74cf9f7f0c32f2c7

SHA512
88c4c33c51b83cc90a6b9c6a8d9f5eba99dec0ee93829b43d7bb43732c978287b82391095b8a086d84b34cbaad3ce934771c50641f933eb872184da3c2dc95dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
748B

MD5
9a00425021a4fa4d485ceac11dfbd28c

SHA1
4efddf1cfd2bc3d15f05e17dd057b7dc5b96d49e

SHA256
0f83e79b4da3efdf4f486a22be629d48b03d89a1c96b38b846101635bbebb6a7

SHA512
d4d08d0bc8a4eca090d8915dd9826a6a52a83abd4fc3e213ca8e3cb0972cc085c8795db7845e9ca21c1bc1eb9c19f8a8ea5c846f07dfe654f9e7ae6b0f6601d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49abf93c7ed0b6d3fd19d86bcdd91c4e

SHA1
be8fca1260aefa0c371add777fa71a45c3fb1c4a

SHA256
a0c1ecb21655bd95b0af9ac1afc5fba705e3027c5db17d42bde87baf2ca80d7a

SHA512
40d7f8db7b3197747c19c642572184d953105c6fa4878f28fd4c00c7c5b23776a07f42656d0d8823b6187a6c10bf36377bf114c05d25a152bc37fa7909d489a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
462dbf3d52630c7c3a343870f3ccb94b

SHA1
d40a6be0ac3e8121929c938142c442c6221b637a

SHA256
c63550a6fc6c71a421657f7ce65849db2e29b951e1c7c0d0320c118153dc819b

SHA512
dbe5efe03d9e1b43a8af2d1acc3c2e318a3f1a23fc1b0ddf0201a07c4100999885341f69cea0c46e99412f945d7501e6cd8444095f367ed14e40c61f97bd940f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
322f2a0f4e1e3d0386ddeae959fbfa4c

SHA1
8d134f678e09f4ee9a090b64245419040c40eceb

SHA256
73ab778f96afdbb68ac4fc5c9624b8a1685d53cbe60ed60bf84c9100a2aa5cd7

SHA512
841c3be524c112be9df2459f494ab71369c22356acefc3a3c4e58ad1e027f635eb2a6a956bf015df54088fc947bb83fc0527e5343bbf8236f620ba2af17aeff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VIPAccess_Installer\1033.mst

Filesize
20KB

MD5
738b1c1da7f4c322c16bf9af507c4261

SHA1
98c2db1fe49b1da583d413fef5046d9b0b2f1cb3

SHA256
6cd35d4186e066775b2b99d9be49d8ac8e1eda66325871a61ecc42c28f62236c

SHA512
6caac39ac635991208f37e577cbdcf4157407f0d3e73ad35a9049498e2ebd6bf980f2e3fa90da41df03b8ccac7ef51b6d6bb1dbc8a8f3f48cbfa5782de7bc147

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VIPAccess_Installer\1040.mst

Filesize
108KB

MD5
8b1f7d2e166df7c5a594889b58405ed4

SHA1
14d32e5c1abce3f56a2183a84c88dc494b3539bd

SHA256
d956cd3de13084fa15c12f477740184ad12360d1f4d45c56540da70c6a90c996

SHA512
13ab59fa0dfe6046ca4accf17dec23b4cdce26cd35c64ee6d1228f5469dfb96a3861ee6e74ec27209dc30abc52e133c76ea117cab75d39f6f499e9cef3b7e1eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VIPAccess_Installer\1041.mst

Filesize
100KB

MD5
705e326105e752f12aa9723f77a608e0

SHA1
a602793dbbf026e2051ddab43de02b47f6489d2c

SHA256
c8566623c4908a2fa166680c86cd6897ab2f713b5a14c91a88880a3bc526fcf6

SHA512
4870b2ad5d78675917b4d7006304424829f58152e968160574427b4cc76f58a24c91f480d6294fb53bf95483654e2dfe90b5197c249875297f3103dbc451c06a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VIPAccess_Installer\VIPSetup.msi

Filesize
3.5MB

MD5
5b3a137a191bd1aa572712b76518f04a

SHA1
d62897038a98d44ca2500b8831404ac1f0ab94c1

SHA256
4d5a93d3180384802e73ec56d693b695dfbdb16e0b764bb380bd33b788bead3f

SHA512
67826df3c57cea677a1911f7c0bc7eb721262142245ee70aa6ca5dcff0be0564799e83e11999c0549d21824dd35f273fc6c526486d4acbd577f3339076266421

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe

Filesize
502KB

MD5
0c1d13aed68a7cccab3fe21c15ba0152

SHA1
33384dac20bf94aff6507b0d32a33c1fd4103e3b

SHA256
8a269d55860f8b71dc0eaa2958b133e9fda9277d73f29e3bbbfc29e4fe8435a5

SHA512
bc10071360320ebb816cd32ac1af811f4c05cdedecad1b4e495c56c23a0b7c93c1e9af8e1127c3e652a0333cc833d23cf6a6e1c146f8a4f2a23007219539ea91

Download Submit
C:\Users\Admin\AppData\Local\Temp\VIPSetup.log

Filesize
77KB

MD5
278c60b01ed434c5382735792e60512d

SHA1
e3e94414d15217fb42dd5b4cbbfbb218103b5bd0

SHA256
f96348666613958f0942cc2bf2d7deba547efb6b266ae9250c4ef8495a531cfa

SHA512
39b9052c258c4195a54c44e631c2061898f8f3e3fd48725f6af746fa785f529651d9731301d0101a2974ee0f9a672ebc05983125fb0a559594b0d7b246352107

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19

Filesize
1KB

MD5
e776021138413b4d0485d3c4cdf60dd2

SHA1
a24c4f1b441e5e5c97c23998fdfea245916e738c

SHA256
b6b1681990775b8817f82fcf94fb1b5d9318dc4cc1a11c7467a0ac371c00907c

SHA512
175739668606dde9b5133f7835deb8f93754ee79cdc441de73d2b1b19250d860b5647b82dc730e90b0ce96570e8d2a585764a18d11f3c6c9c3a4608daa7a9e44

Download Submit
C:\Windows\Installer\{58594A65-ACD7-41A2-B6ED-2597777F2850}\NewShortcut11_68EC464F37144EFB941594C65A7AE1A6.exe

Filesize
404KB

MD5
9d3892ffe6b611481328e144a723c45e

SHA1
823f2a66ef5378072e656b4e81849feccd12f819

SHA256
ce785b40091deb867bc158263bd7add159c6e3f004aa43e462625df0c7aa5503

SHA512
8d647cb1bbd0066992dc562195b90f54d4c2e1bd7875fa7e34e9c44402c063e0f4f299779321995576f5fd00dcf7c205efa723c689a12cfbfc13105f6e75b346

Download Submit