Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 15:35

General

  • Target

    sgx4824p.exe

  • Size

    1.7MB

  • MD5

    6309329d5a036aacee830839f82c5b2a

  • SHA1

    6862500fdd7e9741ac7b54ee2d7060e5e28d7f52

  • SHA256

    7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0

  • SHA512

    0f0b56e70d88418bba971d28c42b16534dd16d706d0b9bb9b372b80860ff579eed8c0a3984654933ac5b6717aa34a2bcf6c1a78f6ea45e0953b3a9fcd85737f2

  • SSDEEP

    49152:OgPGoI4XaGI4pipxxgBEX+hlqeMUxQ0LV2D5Rw9KxKUuKyL:O34XaNoq0E+ieMuQ4VYw9Kxc

Malware Config

Extracted

Family

vidar

C2

https://t.me/asg7rd

https://steamcommunity.com/profiles/76561199794498376

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Signatures

  • Detect Vidar Stealer 16 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 10 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sgx4824p.exe
    "C:\Users\Admin\AppData\Local\Temp\sgx4824p.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy Za Za.bat & Za.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2248
      • C:\Windows\SysWOW64\findstr.exe
        findstr /I "wrsa opssvc"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1268
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1636
      • C:\Windows\SysWOW64\findstr.exe
        findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2308
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c md 385902
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1836
      • C:\Windows\SysWOW64\findstr.exe
        findstr /V "VECOVERAGEGATESOCCURRING" Scottish
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3896
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c copy /b ..\Dirt + ..\Contacts + ..\Syria + ..\Gross + ..\Ministry + ..\Infected + ..\Trout + ..\Reforms + ..\Highlighted + ..\Mas + ..\Rotary + ..\Preston + ..\Remove + ..\Clock + ..\Liquid + ..\Isa + ..\Cape d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3852
      • C:\Users\Admin\AppData\Local\Temp\385902\But.pif
        But.pif d
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /create /tn "TradeSwan" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TradeOptimize Solutions\TradeSwan.js'" /sc onlogon /F /RL HIGHEST
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1264
        • C:\Users\Admin\AppData\Local\Temp\385902\But.pif
          C:\Users\Admin\AppData\Local\Temp\385902\But.pif
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3716
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
            5⤵
            • Uses browser remote debugging
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4464
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe5768cc40,0x7ffe5768cc4c,0x7ffe5768cc58
              6⤵
                PID:3852
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1928 /prefetch:2
                6⤵
                  PID:2376
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2196 /prefetch:3
                  6⤵
                    PID:3988
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2436 /prefetch:8
                    6⤵
                      PID:2124
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3212,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3232 /prefetch:1
                      6⤵
                      • Uses browser remote debugging
                      PID:3700
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3240,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3284 /prefetch:1
                      6⤵
                      • Uses browser remote debugging
                      PID:1948
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3676,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4560 /prefetch:1
                      6⤵
                      • Uses browser remote debugging
                      PID:1092
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4704,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4592 /prefetch:8
                      6⤵
                        PID:1548
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4788 /prefetch:8
                        6⤵
                          PID:4708
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4796,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4868 /prefetch:8
                          6⤵
                            PID:2248
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5012,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4736 /prefetch:8
                            6⤵
                              PID:4304
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4868,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4720 /prefetch:8
                              6⤵
                                PID:1988
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4920,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5172 /prefetch:8
                                6⤵
                                  PID:5044
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3216,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5052 /prefetch:8
                                  6⤵
                                    PID:3500
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5180,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4956 /prefetch:8
                                    6⤵
                                      PID:224
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5176,i,4051467874397112697,16881596800901920827,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5500 /prefetch:2
                                      6⤵
                                      • Uses browser remote debugging
                                      PID:3952
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                    5⤵
                                    • Uses browser remote debugging
                                    • Enumerates system info in registry
                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                    • Suspicious use of FindShellTrayWindow
                                    PID:1548
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe67da46f8,0x7ffe67da4708,0x7ffe67da4718
                                      6⤵
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      PID:1652
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
                                      6⤵
                                        PID:4564
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
                                        6⤵
                                          PID:3396
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
                                          6⤵
                                            PID:1988
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
                                            6⤵
                                            • Uses browser remote debugging
                                            PID:4940
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
                                            6⤵
                                            • Uses browser remote debugging
                                            PID:1664
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
                                            6⤵
                                            • Uses browser remote debugging
                                            PID:1872
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
                                            6⤵
                                            • Uses browser remote debugging
                                            PID:3048
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
                                            6⤵
                                              PID:2288
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
                                              6⤵
                                                PID:1684
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2728 /prefetch:2
                                                6⤵
                                                  PID:2736
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3632 /prefetch:2
                                                  6⤵
                                                    PID:4476
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2588 /prefetch:2
                                                    6⤵
                                                      PID:4564
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2256305483875013834,8554243976757671713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2496 /prefetch:2
                                                      6⤵
                                                        PID:3352
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JDBGDHIIDAEB" & exit
                                                      5⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3096
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout /t 10
                                                        6⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Delays execution with timeout.exe
                                                        PID:1304
                                                • C:\Windows\SysWOW64\choice.exe
                                                  choice /d y /t 15
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2808
                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                              1⤵
                                                PID:3316
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                1⤵
                                                  PID:4832

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\ProgramData\chrome.dll

                                                  Filesize

                                                  676KB

                                                  MD5

                                                  eda18948a989176f4eebb175ce806255

                                                  SHA1

                                                  ff22a3d5f5fb705137f233c36622c79eab995897

                                                  SHA256

                                                  81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

                                                  SHA512

                                                  160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

                                                • C:\ProgramData\mozglue.dll

                                                  Filesize

                                                  593KB

                                                  MD5

                                                  c8fd9be83bc728cc04beffafc2907fe9

                                                  SHA1

                                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                  SHA256

                                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                  SHA512

                                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                • C:\ProgramData\nss3.dll

                                                  Filesize

                                                  2.0MB

                                                  MD5

                                                  1cc453cdf74f31e4d913ff9c10acdde2

                                                  SHA1

                                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                  SHA256

                                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                  SHA512

                                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                  Filesize

                                                  649B

                                                  MD5

                                                  7eb7230848b75cccfce8c7938a3c4212

                                                  SHA1

                                                  5122543c7ef83ba5706dbdc4a8c9c3e566d0a738

                                                  SHA256

                                                  f709672593d9038ef16ebb06f0f1846f619102fbcc846805db578b8a2d3f24ef

                                                  SHA512

                                                  c675423b2290d9aa0ad5ab1c4ad01843781e1b209da614409a68eb5ea57db2350023070ad29cbc5919b62fb08abc5ebc7a0a915da65189ee7bb937763a42a7e4

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

                                                  Filesize

                                                  851B

                                                  MD5

                                                  07ffbe5f24ca348723ff8c6c488abfb8

                                                  SHA1

                                                  6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                  SHA256

                                                  6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                  SHA512

                                                  7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

                                                  Filesize

                                                  854B

                                                  MD5

                                                  4ec1df2da46182103d2ffc3b92d20ca5

                                                  SHA1

                                                  fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                  SHA256

                                                  6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                  SHA512

                                                  939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                  Filesize

                                                  2B

                                                  MD5

                                                  d751713988987e9331980363e24189ce

                                                  SHA1

                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                  SHA256

                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                  SHA512

                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\83916b2c-806b-42af-b028-d0dc34e518c9.dmp

                                                  Filesize

                                                  826KB

                                                  MD5

                                                  7e327d7ec9110e4f42caf95c56777fcc

                                                  SHA1

                                                  c55f38d1ca237ce7374e7cfc03fbd694a5984de8

                                                  SHA256

                                                  8715e7d291ba34c7303450e8a621dd5963bd43523bb4b3463924de030556e82d

                                                  SHA512

                                                  d112c1a5cce52cb32e885656cef39d7a85fe0ed3cccfcd807ca930cc0d007329bba2aa1a29045d1d0d2606ecc16b637092ce5d21c34a9183feba370b5f2e5b88

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\98c3fd3d-b54c-4660-a42e-6d5f41953632.dmp

                                                  Filesize

                                                  826KB

                                                  MD5

                                                  f755392839534ab4c933a64241aac839

                                                  SHA1

                                                  5183fac22d8bac2950b97d48c0320f3e3440bce6

                                                  SHA256

                                                  5395f6be8af21e43efbc5a069af28c95a5daaf16bd48a6d7765bd6548ce698b9

                                                  SHA512

                                                  3342f3fc685017857b888363bccdc7989da7af5e2caffc0d587c33ce7c0359875a2b8e556931820f559b7fcb857581af153e02e8f8b66ef5d26d807f21e9e496

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\9e031df2-4e00-4d9d-be07-f95e476d9abc.dmp

                                                  Filesize

                                                  842KB

                                                  MD5

                                                  b9821ae31acf97631e0851d2f829c680

                                                  SHA1

                                                  7ada44998645c427e64f85711fa6713a8b8aed31

                                                  SHA256

                                                  6bfc31c1cfa5a097a830558fee327673bee3933e4945728959d71d9f580c5f32

                                                  SHA512

                                                  e0e03007fe3906288ab57edfb36d5e093de47041e3e01baac432857dc30f4e43b31f27960b7f4c5c6f985712b308c8e83668b36b77687cbf74b80a0959f4818f

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\a9dc20d4-d7f3-4064-84fc-1d4d27231f1a.dmp

                                                  Filesize

                                                  838KB

                                                  MD5

                                                  4add8ac1971efa036fd7ea6a865c3988

                                                  SHA1

                                                  cd9f9080a5fa4d20117302b9a8d95bf9c0c06b80

                                                  SHA256

                                                  d69630c9d1808a53b0783c9df1e21e630d5de2d0fb2803c2385c448d61392cbd

                                                  SHA512

                                                  bf253f0007bd4fb973be3f141533ef0d50752e0c65279ae449908d0d1d81c0dea16c60707ec314d132a8130140da3ffdaa303593e9b07547b2afc4778367fd7a

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\e7b45f01-08f3-47d2-916d-c2bb7d60d88e.dmp

                                                  Filesize

                                                  838KB

                                                  MD5

                                                  24948d37fffafac809a6e6494d4039df

                                                  SHA1

                                                  e946b2ac0ad45e9956460effd7f00becd62c3816

                                                  SHA256

                                                  e6ce2547897293bb986a424fc4fb52d80d1174f090fdc4bc7c8cde7807814b95

                                                  SHA512

                                                  47ad95b1fcf95ffc696784c453f1b223f03a762764acaebb55207ef3505a391dfba5d1eb927fe2a7efdf6207e6f519fbb42ff189aa706121f398c515ed734133

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\edc1efe7-8f18-4c64-91ea-de5eab9ea7fd.dmp

                                                  Filesize

                                                  826KB

                                                  MD5

                                                  b04f649adaf73acc7498f3322fc881e2

                                                  SHA1

                                                  d4a4c82c1a1c559cffb8333d3e9a61f5ceea05d3

                                                  SHA256

                                                  eed30bc31deabda736bf5560e3c3959746fd87b903f90dbef1ea8ad573034682

                                                  SHA512

                                                  7151c628761a2d3995c776f65e6ad01ff857627e7f53be3744115dc9ad0c0440d0bb273ae30547d2a66dfd092fa9b2669d76076ba8eda5ab84f63c628144e8cb

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  7de1bbdc1f9cf1a58ae1de4951ce8cb9

                                                  SHA1

                                                  010da169e15457c25bd80ef02d76a940c1210301

                                                  SHA256

                                                  6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

                                                  SHA512

                                                  e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  85ba073d7015b6ce7da19235a275f6da

                                                  SHA1

                                                  a23c8c2125e45a0788bac14423ae1f3eab92cf00

                                                  SHA256

                                                  5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

                                                  SHA512

                                                  eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  d3a47084403bef861bb5d3a422687bd9

                                                  SHA1

                                                  188007ace2674ca3bdc96f420699c5bce13e6fac

                                                  SHA256

                                                  9c746c9f1aa8ed8603c58f59576659b00f12cd5a2e43f2370e75243bb7f2c299

                                                  SHA512

                                                  7866349fc83f6a027c76115312ace96dcc64e95a145f531ab7c3ad6b084586c8a0ffe2332afa8d22f542c5f91a7ec017ebea0d36c73c996aa86b4f6a4d81267a

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  1af320fd99eabecb254e255278f133c5

                                                  SHA1

                                                  8933bf29021a33dd24791ef7a26657a6c42a24ca

                                                  SHA256

                                                  839db0be7dfbcc12b0c69b7be6dae1c08d535b12485aeea5fc145b9367557cec

                                                  SHA512

                                                  7082c9fc8ffa5b4fbfa2284bb84f65fded9f9534724a89b2598324647843134cf0a99ce98628e943063e569f39f61ffc1880d4135369d5fdf4e425d0f42bfe83

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7dc382bc-7c02-4859-8e2f-a9f096926fae.tmp

                                                  Filesize

                                                  1B

                                                  MD5

                                                  5058f1af8388633f609cadb75a75dc9d

                                                  SHA1

                                                  3a52ce780950d4d969792a2559cd519d7ee8c727

                                                  SHA256

                                                  cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                  SHA512

                                                  0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  5KB

                                                  MD5

                                                  b57beb37bcce98eb0a0b53df00c20524

                                                  SHA1

                                                  fb670c65add1b5fab7c845bb0f2ace6d0a900576

                                                  SHA256

                                                  379b4c20e2a02a482ac0f6820bd60044078b7f8d54849d6ee6a018bcf0d8db28

                                                  SHA512

                                                  ae4ca67902a65c5fb44adde8b55d99826f8773111665009e755217832b640b147d76f947239b0ec35330f63eef2728d033616a75b2fef12f27d3b586f23973ba

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

                                                  Filesize

                                                  264KB

                                                  MD5

                                                  f50f89a0a91564d0b8a211f8921aa7de

                                                  SHA1

                                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                  SHA256

                                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                  SHA512

                                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                • C:\Users\Admin\AppData\Local\Temp\385902\But.pif

                                                  Filesize

                                                  872KB

                                                  MD5

                                                  18ce19b57f43ce0a5af149c96aecc685

                                                  SHA1

                                                  1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

                                                  SHA256

                                                  d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

                                                  SHA512

                                                  a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

                                                • C:\Users\Admin\AppData\Local\Temp\385902\d

                                                  Filesize

                                                  1.2MB

                                                  MD5

                                                  6ce26bc637e613fb26e36e3b7b2de741

                                                  SHA1

                                                  fc871ed51cea45e036f2f5da2560028aac6a8d52

                                                  SHA256

                                                  b9f9f94aae237bbc79016a5c6f16699e5bd3e2c4badbdc38e1cfb381c0ee0f19

                                                  SHA512

                                                  07fd8349c544c26033baa348ebd5808bff902c296a2d096af318321bb51e5a85a4cc9c590387a35e8eb5a159dd30c32036d4a9f725b66be53e6d49e28250e31f

                                                • C:\Users\Admin\AppData\Local\Temp\Cape

                                                  Filesize

                                                  13KB

                                                  MD5

                                                  af965d3d1dace1fb30ca33675fff2b9c

                                                  SHA1

                                                  1d64d15e449fd45159c37b44c5066106280e98dc

                                                  SHA256

                                                  3ee9287e6608befe365048f434056557411daf82b5d94124b5ecd2f12893a0dc

                                                  SHA512

                                                  158ff9175f7052062ad53e620e6cdb585d4f6f696c330a50050a4a89c8e74c2bae49abed1a6b49fdb97938062e5554178d90309c621d56ff224d0ca4871086de

                                                • C:\Users\Admin\AppData\Local\Temp\Clock

                                                  Filesize

                                                  79KB

                                                  MD5

                                                  6b8d55cf0157a09b1304a79882cfabf4

                                                  SHA1

                                                  359e84b9a9f23827f2113be4e798a89109a1c4ab

                                                  SHA256

                                                  ccc80113d1d33bd46957e01253217e5e233fa0158107e4a1576d5137c9351450

                                                  SHA512

                                                  8d92bed7361a6cf6986bf505054b818b6f653c6eb493a66bb17e5aef26e5868e31a1948ede87b9f1976360f3bb86767c26ec4333bba41b599c0c1dbc002b68e5

                                                • C:\Users\Admin\AppData\Local\Temp\Contacts

                                                  Filesize

                                                  97KB

                                                  MD5

                                                  06d5ec821bc37509d3888623e943bcbf

                                                  SHA1

                                                  e4ab272ef4feef067be2ab6672cca7b06d97e383

                                                  SHA256

                                                  f85ddce46c17d6da8061f7e84bd681d804c299fcdb51470ee17132b35eadd1a9

                                                  SHA512

                                                  1b250c226e6a54484632cd4894e3ed8deb0873db5f3a5c0ec5d5c006e266c8fb668cb83145df7c9d124b78ed21bea0086a7b7437f83f5ba3e87cfc5fa2c03e4c

                                                • C:\Users\Admin\AppData\Local\Temp\Dirt

                                                  Filesize

                                                  78KB

                                                  MD5

                                                  cde4c46ff3b0d6b46cdac32438fb47de

                                                  SHA1

                                                  170ea674921b4c3b713df5f6a61d86af9332b028

                                                  SHA256

                                                  48e24d58ec13a7c191c32588b7a1d3d36bbe93f009d0508b110071d1b83e20e7

                                                  SHA512

                                                  c1ca7075cdf1c472080d10e40ecb5cc437630b4f88e44a892be6ec6301e68237c4a2a94bf232afbde56b904af212257e45a3231577fea15b9c1d843fb66a57da

                                                • C:\Users\Admin\AppData\Local\Temp\Gross

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  a0703a99dd4463e54652235fa8925efe

                                                  SHA1

                                                  6e4bf1852e8c9c08a33873da1fbcb405e63ea7fa

                                                  SHA256

                                                  edf34aba0958a5139d73f4c96bb45a7eae4e265483118d7e8636677facbd9431

                                                  SHA512

                                                  2015644ba3bdc8a7fa2e19a970bad8778de9a37699327a10807abdb251b8f07e71db8d03a2bf0df6cf641b6ff66df2b9899f725c1e88d688090dbdc23ae96a8b

                                                • C:\Users\Admin\AppData\Local\Temp\Highlighted

                                                  Filesize

                                                  75KB

                                                  MD5

                                                  76877395939bbfdfc0bc89b5cd81dc98

                                                  SHA1

                                                  856453e7c5aa1f00badb3179d4179683d151ac34

                                                  SHA256

                                                  09388133db1b51106b865257278e9ac5aae1a03471655d66dd08d84e4b7bdb34

                                                  SHA512

                                                  01b1c5bc5ce697e9b08e20af194cd3631e80b15467aa699d9afab119dc134cfc35fdb76ddff0d564f7f48c2f0c35820fde7c37bfb51778b614ad49e81eb1a4c0

                                                • C:\Users\Admin\AppData\Local\Temp\Infected

                                                  Filesize

                                                  60KB

                                                  MD5

                                                  62dae5d3236399e12a9b6aa7b6234e17

                                                  SHA1

                                                  bfcff7698ee522692844d1fe8d2eae1956b72177

                                                  SHA256

                                                  7bd5d3c8d61f2ffa76a0b577e26c1ceae0e3b06e862610687306255d415a0cd0

                                                  SHA512

                                                  6dff2292821e0b7326af592c64335c2bd8619339c8ad61a78c9405550adaf63538a835b45f2a8deb9df6c5235a8c8e266df55d8dfc1442a8f2282ab6973166e3

                                                • C:\Users\Admin\AppData\Local\Temp\Isa

                                                  Filesize

                                                  89KB

                                                  MD5

                                                  b40befe54498a6d595b364b7b525f30f

                                                  SHA1

                                                  f8881f753450e7265fcde49d405c07198c94beba

                                                  SHA256

                                                  f25f42d199259454fad606804668bdd177a5bc0d03cf56d3c2cb68e393a439d5

                                                  SHA512

                                                  716cb614a1cc28de222917d1cbcb4f73def6b523f2b9c871c7c09fd6bfbe511390a11c568133633739fea4f1795bc6b83a1baa51186d6a9654b6fb70ddf2dcbb

                                                • C:\Users\Admin\AppData\Local\Temp\Liquid

                                                  Filesize

                                                  70KB

                                                  MD5

                                                  bbf271eaa9d8aeaefa40cac9e19a7838

                                                  SHA1

                                                  49cbfe8c945a849c39779a60c7866b0dea329bae

                                                  SHA256

                                                  4d43fbfee58142287d8e3c0ec3005b50dd110248a7e0ec1b891dce2501b8ca5c

                                                  SHA512

                                                  e6a3c6d1facd1b90669ba52f90ed46ddd921ef0b1dd99948220eeeed5d60a84e7a126e9a01144fb95e18dc6fbe4abcade35a58fb7dca3c52e83010a1e6208a44

                                                • C:\Users\Admin\AppData\Local\Temp\Mas

                                                  Filesize

                                                  92KB

                                                  MD5

                                                  fa0509a52879aa4a62f19d057a88bac3

                                                  SHA1

                                                  109c5e34cdca7a5664f433ff8f1c44bda24a164b

                                                  SHA256

                                                  a0dd14e2a3b74fd5ca903446dd99bac3d7918748eeff693658d4790f00097532

                                                  SHA512

                                                  321a2b7380544ef5faf1912b4eede29f76cfa6ccd2be7aa7c6ae5efbf0a5a3503ec7da541de3e83e6db0c70a5ca38f8cd97735a1faf475917a598fc5eac36254

                                                • C:\Users\Admin\AppData\Local\Temp\Ministry

                                                  Filesize

                                                  84KB

                                                  MD5

                                                  7be94726608f8c106665afa8cfdc89bb

                                                  SHA1

                                                  59e8662e8d5f0c6880a8935ae0cb81a089980eb0

                                                  SHA256

                                                  803b70d8ab4f2e9c764b9e43c26039da2b0f985f6728971fcc623289f02187aa

                                                  SHA512

                                                  21babae17d2db7aebca44d11876d53efac58652ff6b73076eef6f4b9ff9b685bc0a8541155132b399fd166a376ac4b56eed72b7a4a2f61ff6e1a808e2939feb1

                                                • C:\Users\Admin\AppData\Local\Temp\Preston

                                                  Filesize

                                                  59KB

                                                  MD5

                                                  3f86bb99af0bb655504dce21757c744b

                                                  SHA1

                                                  7a6279dbc69d3cb87717fbc34900cad4acdb27f3

                                                  SHA256

                                                  d97cdda1db2bbd8ffcd46144b245aa410232e7d1d075b2c576eb49206c0e18fd

                                                  SHA512

                                                  e46d4c23061f0bffacf30dffce5a7d5e893e79e699dd6de40a5493c2744ea2efda586900587fc955d699db16e96009c4f30c46f23130c92eeb04274ade71672a

                                                • C:\Users\Admin\AppData\Local\Temp\Reforms

                                                  Filesize

                                                  70KB

                                                  MD5

                                                  b8d9068ad91d42e750a76d26003f9fa4

                                                  SHA1

                                                  c75eb994cf1c607de148db30cab2bae30e00898a

                                                  SHA256

                                                  d3cb08d75bcadec46233d8097f1580ac1ff763ecefbcd74172801c574ff4a93f

                                                  SHA512

                                                  ce911583ad373a45d5dae61b95a9a3742a831d245c9f8b005cc86aea92445b63b72643e1384424277f5961e0c49bc9be0171a0ef998b518a65f2cba984ebecaf

                                                • C:\Users\Admin\AppData\Local\Temp\Remove

                                                  Filesize

                                                  66KB

                                                  MD5

                                                  a529d544a10836bedf47c06c4d52b25b

                                                  SHA1

                                                  dd03707284f9fc7d8980d65a8ba19318df9544ee

                                                  SHA256

                                                  a3974c65e3dfea5864655fb0ed24bccfaec7539a20d7ffac41c1201a351223cf

                                                  SHA512

                                                  1fd747ff5096bc26f8e740e2f730059fc11aa1d2e7db2654fe19115e5457cf7b8da1ac0233461a4fac1d0aaad6f2c81c10160dda39fece6b09a8c241e4152dbb

                                                • C:\Users\Admin\AppData\Local\Temp\Rotary

                                                  Filesize

                                                  95KB

                                                  MD5

                                                  6051b9eecd39a03bb32bc2bba5082095

                                                  SHA1

                                                  b2a63fd5e96493699fe067cbfa099622d8acea32

                                                  SHA256

                                                  4f12f27328c4c0a600c6850d17aa237e75f23b66a74cd1ec7e5f9cfdc299ca30

                                                  SHA512

                                                  6223aa52de9df2f999eee13dc61be08954cbacbd5ffa83831d4a11a0ed35bf36dce05c0f5b3eeb5a7a0759cebe313be9c3d8486d22e3d063eaec9a76adead8b3

                                                • C:\Users\Admin\AppData\Local\Temp\Scottish

                                                  Filesize

                                                  11KB

                                                  MD5

                                                  91f6672574a6fd8cbbad8d6cd414d156

                                                  SHA1

                                                  643c062c6b131258149503ed4219de12d92e3a68

                                                  SHA256

                                                  044aea42dbeeba30d10e5cf9bb40ea12840de423a13d162bdd366cd12c9c2213

                                                  SHA512

                                                  f62112c697dd33eaa3c5590f728900303eaf7c34c29e36be6a56b82161bb2fb059f37539ce3fd2b1e93c326db003d51396aadc69b8870a02e286c6912cf8fee6

                                                • C:\Users\Admin\AppData\Local\Temp\Sequences

                                                  Filesize

                                                  861KB

                                                  MD5

                                                  2dd483c6fde0586ffa94acc2376dd7d9

                                                  SHA1

                                                  c9ef9e4d9a0185ebed8ff26a1dfbf83c954ec09b

                                                  SHA256

                                                  40c07fbaec3090d544f2d764897ae01cd7e8e8e97ac95f769c9d09bc3c660195

                                                  SHA512

                                                  314d03f8c2e3b9b67349d82362620fe72e6c9356393ff5b72d343c781a14b4b1e5ff4a9f78782753d04028b208be5f8812e60dd830f323435b013f50b30aa33d

                                                • C:\Users\Admin\AppData\Local\Temp\Syria

                                                  Filesize

                                                  58KB

                                                  MD5

                                                  a0e351dd432603992449c20dc0c6ea0b

                                                  SHA1

                                                  dd6a250e1400f0ed460f5989968b38fdfad642bc

                                                  SHA256

                                                  ac7ae2f73b1035ea98f04caadafc74e8919f124e417a14966af4a41fbef0229d

                                                  SHA512

                                                  d07c1e176b23fcf307df0181d1b24ea0e202206d59d87cfe0d30214de4571d88bf6edee33fab8540a12afb0527098c25ecf5a0a224d4a71d487737a48318f86f

                                                • C:\Users\Admin\AppData\Local\Temp\Trout

                                                  Filesize

                                                  88KB

                                                  MD5

                                                  1a6f03d3e9d3165a38d8b59cf0b2d4bc

                                                  SHA1

                                                  bab5dc699a736cbba1c64f2ecfc84f3a194ff51c

                                                  SHA256

                                                  755ffe7b3854437f7d1a85aa929a353bd0cb8f84d9e2899cd9ad29d7733e6496

                                                  SHA512

                                                  dd98537e73522e9d55112368de9b363622a0804d5159deeb1760b2803221f5cca9957a734db315afa0c3b907887765c3cc4c98991b65be5253c5e2bdd6081cab

                                                • C:\Users\Admin\AppData\Local\Temp\Za

                                                  Filesize

                                                  16KB

                                                  MD5

                                                  29a0ea7fbce305cb957d7f88a2eb1d6b

                                                  SHA1

                                                  eed117e955aad6ac880bab3c530634da6bb6315f

                                                  SHA256

                                                  229d200f4b5bf50af37b19d601448152886be2e6110a7f7de7d5b91e4ed54d26

                                                  SHA512

                                                  4a63a11cc013295a5c8677c66e6386412ff58ce53a77a92f7ba7d1004960d5b1c27922fa006c3e48d06ebb76bc491753dbe7ca23ce88c0f424110655977b0d44

                                                • C:\Users\Admin\AppData\Local\Temp\scoped_dir4464_2056655564\CRX_INSTALL\_locales\en_CA\messages.json

                                                  Filesize

                                                  711B

                                                  MD5

                                                  558659936250e03cc14b60ebf648aa09

                                                  SHA1

                                                  32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                  SHA256

                                                  2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                  SHA512

                                                  1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                • C:\Users\Admin\AppData\Local\Temp\scoped_dir4464_2056655564\cdd61443-ad03-46e9-b337-d18bab6198ce.tmp

                                                  Filesize

                                                  132KB

                                                  MD5

                                                  da75bb05d10acc967eecaac040d3d733

                                                  SHA1

                                                  95c08e067df713af8992db113f7e9aec84f17181

                                                  SHA256

                                                  33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

                                                  SHA512

                                                  56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

                                                • memory/3716-451-0x000000001A760000-0x000000001A9BF000-memory.dmp

                                                  Filesize

                                                  2.4MB

                                                • memory/3716-1190-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-429-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-431-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-449-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-1039-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-450-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-894-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-893-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-428-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-1196-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-1197-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-887-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-886-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-1219-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-1220-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-1227-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/3716-1228-0x0000000000A00000-0x0000000000D00000-memory.dmp

                                                  Filesize

                                                  3.0MB