vidar | hxxps://polovoiinspektor[.]shop/rules/bash[.]txt

Resubmissions

20-12-2024 16:52

241220-vdt43s1jcm 10

20-12-2024 16:50

241220-vcmnls1jbm 10

20-12-2024 16:45

241220-t9wr4szlb1 10

Analysis

max time kernel
86s
max time network
88s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-12-2024 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://polovoiinspektor.shop/rules/bash.txt

Score

10^/10

vidar google defense_evasion discovery phishing stealer

Malware Config

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/4048-585-0x0000000000730000-0x0000000000969000-memory.dmp	family_vidar_v7
behavioral1/memory/4048-586-0x0000000000730000-0x0000000000969000-memory.dmp	family_vidar_v7

Detected google phishing page
phishing google
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Executes dropped EXE 2 IoCs

pid	Process
3396	PpmSubscriptions.exe
4048	Screenshot.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2792	tasklist.exe
984	tasklist.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LinkHarper	PpmSubscriptions.exe
File opened for modification	C:\Windows\WomanDirectly	PpmSubscriptions.exe
File opened for modification	C:\Windows\DescribeIntegrity	PpmSubscriptions.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\PpmSubscriptions.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Screenshot.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PpmSubscriptions.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 19515.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\PpmSubscriptions.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
1932	msedge.exe
1932	msedge.exe
4896	identity_helper.exe
4896	identity_helper.exe
4324	msedge.exe
4324	msedge.exe
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	tasklist.exe
Token: SeDebugPrivilege	984	tasklist.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4048	Screenshot.com
4048	Screenshot.com
4048	Screenshot.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4284	4884	msedge.exe	77
PID 4884 wrote to memory of 4284	4884	msedge.exe	77
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 3320	4884	msedge.exe	78
PID 4884 wrote to memory of 2368	4884	msedge.exe	79
PID 4884 wrote to memory of 2368	4884	msedge.exe	79
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80
PID 4884 wrote to memory of 2920	4884	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://polovoiinspektor.shop/rules/bash.txt
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffc89243cb8,0x7ffc89243cc8,0x7ffc89243cd8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1872,6380146139133730421,11560708698092399339,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2404

C:\Users\Admin\Downloads\PpmSubscriptions.exe
"C:\Users\Admin\Downloads\PpmSubscriptions.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Calcium Calcium.cmd & Calcium.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3952
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4848
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:984
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 815951
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1596
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "artwork" Passed
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4252
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Reporting + ..\One + ..\Liable + ..\Code + ..\Cashiers + ..\Est W
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\815951\Screenshot.com
    Screenshot.com W
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4048
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4460

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
7f51e7eebea2144f5b16a38f10e54fd1

SHA1
8526f174ca747356fcb7af596c011c05ed482c3d

SHA256
f491fcdcfa8e4f424375eae6038fbb2bd96f1ccd1c783edd5b052d8fcddd7f8c

SHA512
e46a74bdf97df75ff506f3afc2e9ec09079db98e23bf9ae2dbda74163e5952a6ed6ced5abb3756aafe36434470931449cb310b8e211d12bdcd843c1d5085f992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
57040b3d3d174ffeaf69e2a3341a11c5

SHA1
86735aad15e81ac9c330c34d7563652f0bbf1752

SHA256
8b09415c57d127e2bca45494bbbce3cbe484779e33cb66fdbd66b40ee8bd2496

SHA512
1a85638878c600cbcffcee6dbafc9c18a250849e2f65ed4e0ff12c22cfddd2cbc0612869ea66f4b03a6450ef4f1c99bfe176b50192908b92330acbda99407151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b71d95e2d04b0239f0b4d18cba9ca1ff

SHA1
dac920c300f986f502345923b0a389f0688ab325

SHA256
9b9a06d2f4886b17fb3ba73aba3d59ee8cde6fd69b26df1bd363ebff692576d1

SHA512
2f6fca7e7822468b6289220c6cb41b30bf6a8e0f48c61a071512474f8451252c56aec3c47a52c699068da5e8889ead7481168e2625ce5ba593081eb45fc32b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97f0a3275550d8455915c0d4c3344d52

SHA1
f283f491fc20c39bc1b0534613b8f8d06cdb2a0e

SHA256
8ce558398c97f6923b5fe1c4fb855c2b1056731d7e19f992c574fcac5cf0d630

SHA512
1583ccda178af47f79f56ce820c8b7cc07d1e149e9b6aad76c09e2c7ee35585719b740dbc68e2ee8005b5d8408c980df31bec4a5bab1490117fa7dee5abc26cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
231967fd66bc7fa0fb8916b6cf5a7675

SHA1
7fb323c6d8bff0ef7cbb09041ad1924efd3a03c5

SHA256
536b7cbe61f14fa3b9e3e81f8ccb1b7a9ae5ee74ad8700ce7bfee401833b9c2f

SHA512
73169cf99adb58ca52f4d4d136eaad1942d118a7960c9190433a2ff582ee21b485fb932fef8a10b5d241e46eca763d729ccbb35ec0a1e4d7ed69b3428c6306d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8915dcbf497d88fb62bf15080f822fb9

SHA1
d16da581963ce5ad893cbcb63d279c3247dee74d

SHA256
fd863700e4ca199beb4030b67fa201cfc9b5a6afa015438eeb17544e6c7481b7

SHA512
e08ef7d403e6a57fba15c72c0f08515f4a1869235b2282d5f1352af94cf311fd2a737c63c6bba47257ef57e2b4a57a1a7c46e8d9eb418a17e315935953bc7dd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26448d6b8c6811d3a170e69658324a2f

SHA1
1f74b8ec24b993c8b5c886e69dfb51f552c97362

SHA256
fbb8bcf33ae37ccdbdf81ffa61e1c3864d63e2dcfa863416768ba4e1a65e495f

SHA512
79937da73880c5860ae40dcf2074e2ec98cbd9b579619d9c0ec823612fe1a839e9ffb195148f53599f7d5116b1f8dd6571002f0e9c1f29445d2805bea325becc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ab21d7bda7eb33fa23d50f782001c47f

SHA1
e49f96ea9c1b97b01834754c309db241130b5c88

SHA256
976f9128a4ed613a206d4628b96396ac0a3d90e83fb816187940aa5005165afa

SHA512
5a4cf0903ecc4a871f1b558335b9b2b6b25d324b6151723a001fdf0cedfa2e85049b9416d3924cff467c154b2fff09269aba4932bf8ffb8ca0a73ca4289fee71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
26ebcb90b8e8c8235ed9c784fe348b68

SHA1
8d84ec29d2d01de9a96a11e9acabef535ff9a62f

SHA256
88d63258716951f75c47fd6d71b63637665ffd628b9348cba913f65bfc2bba1d

SHA512
83ee80c25547abb67812eeffa80e244dc189db30cdb660bb6fb7596058583a080ef94f559e75635898389f0eac1a301296ccc1118546383303a70560c425a479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587829.TMP

Filesize
48B

MD5
13df0b70574f3f728bbe98dda393878d

SHA1
0b8a3dbb45738d9784c53c14ff9be93c51b2fe43

SHA256
68ef6ab36c36a8bdea2bff417410e2cabbc46b725342b052b915060a768cf699

SHA512
72b419d7709f3cad374fb80a73c2347d097f41946470dcef28ffdd9ee6da4ba168dbe9dabf9c69cf768adf7c342a4f7e2a175c6b6ec2821117f59cfb001aa477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
f7d9b9d85741b111e0642f0129ac1c77

SHA1
0a3d23c6f2d6d2610808d0a0be8654181cf09131

SHA256
2952cb08d8b4f503ef6e1ab026c1eb87f4a35b696d5981a7e64961f38f1e4d8b

SHA512
4c3bb5115191fa199ca694711ddcaf3d2d56d830cfa4f7f002094853be57f7b5cbe3644709b88059cfb08cce31d18cfbfb8928a19a5b7aba4cf06be838c7639b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5845ce.TMP

Filesize
370B

MD5
0ca35404c5e4b3b7013dffe378ab6d4e

SHA1
d69e573f678f6288b2cfb10d96ed200e51ed8cc3

SHA256
025f7d40b307d54294a5d90fac2870c830bfc412a200b998378360151ebe4b70

SHA512
1b02a26ec1e6ea37dd7f5d19bcb13539d08e4fcd3e2fb3dcd744ee220b86482331a91b934441f78547ca26a395cc7adc7fa7293246d740d006124e4a23c6c6a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aa9438ff07a54201a92e4bf24137e37e

SHA1
f64b285f22bfb63b63652931e42f63c4bdc44b0e

SHA256
ffda3c908ce421a9fece0ec14b38563f448be060eeaa04036d4af18734d2ea43

SHA512
5eb32d29e1fdaa3b1c5629d3f9c4bf4046341c95a28d1328a366be9164182be872a9ac06c42cab151e137274edb31ce9f606aa4ec62f970ba6edd5d0d48f9ba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
72d20c328e3b8badb6d9e6368f86025e

SHA1
f66eaa8e2069ef686ed825cd9835ecb8e4257960

SHA256
70d89e74c6b300fbbcee50033c795df976df619a65ebf4d0b1af07b0e10af045

SHA512
ec9902c55546fe0fd0052d3a31ffecbec0ea199971a20d5cc0332756086f7cbda466e0d59a0965d6b278c475878f9e2147ba8d4f7eba2532174839354ded3129

Download Submit
C:\Users\Admin\AppData\Local\Temp\815951\Screenshot.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\815951\W

Filesize
396KB

MD5
6a7db8d85a7ed147975c0a76bc63a6b7

SHA1
34657091af5f691cf027c19aac172675776e7d03

SHA256
82ddacae764a16ff866e7da0bd3d7b432c1fd0eae0094e371526e95da8e1d7a3

SHA512
d5965c824779960d50b8a460dba6b4046472c98ea83774fa8a2b282ae3fdcfe2a19c84637897af5aebfb139a3d93c1f4713c0a994cbe37b0b8491f4367157e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Brighton

Filesize
69KB

MD5
800140c62a1caf6d4a5b5be20d691a4f

SHA1
29f90b42aa74869c7bd49080113b130607afdeac

SHA256
f62c6cc265289d67940bf1161e9995914f86a8ee946c58002950c14b93f601a8

SHA512
c4387cef40f37235d0b2838b54d699bd7d3af2695bfb762d060cb4798de74beb3ba947bf45e54b150b0a37f82bc73fd735a2c19ea83a2789505adc8831c8a975

Download Submit
C:\Users\Admin\AppData\Local\Temp\Calcium

Filesize
27KB

MD5
8587422c8aa5c693ab7cbe6aa164b417

SHA1
3bc48c54608184c6b339d1dfba60466bfa975c73

SHA256
fe0ee756f14547fbadef9670e7fd02e4c220be42747387cfea5a17775e83b592

SHA512
9c646fee69377c60fec82898fc1895709859a60002b942da2ec630b682fbbe884620c91e12a7e41816c2cb334ef76ce4288510a9ebf66cf252db205bf6c85fa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cashiers

Filesize
83KB

MD5
5f44eb5c967657c9e86a134105238d6f

SHA1
2efbfb0a6b70319fe7269c336386f7f8f5060090

SHA256
1388116ae9de3e7a702d7651c741cc250c0d8bc513186f0238f901f5de0afa32

SHA512
55b5f4d6f36be14cb85008ac9ebd2d9ee43c7ca489b1424f9f6ec9c8984ac36681dc7926a80b0e284790f0bc6ac40f865bad577f52780d0fda9954348b224e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Code

Filesize
77KB

MD5
f50faed04bb66633f487ecbbf9882f1a

SHA1
33b5c854be7b257fe4778529af8252a36eae0783

SHA256
3c73c485a78f02f83ab20c574f9b7324403e2f73baf7196e620d80f833a09935

SHA512
a80ecf948acbb3cfb955b2867fd64b48753ef6f2d2cda1bbcc44f623386335d53a2e5e1139ca8862d8d622e8baed9edf765943f39885ba1e3f4679d7f753fe9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Creativity

Filesize
69KB

MD5
cf613611fa89066fd411ca0c4e1361d5

SHA1
0a5b25b7c43f642c40564151592899e3f177200f

SHA256
2c8683467184336a78826746c6bc94bbaf341e6f88333585f437814d341267ef

SHA512
62911f5985412766e7434f43e69e56d7a4001dbf38189632aef2b2fa241f5d86c6a58af7516c723bcd45ae55264898956f701aa5374665c85278fbbc380c489a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deserve

Filesize
95KB

MD5
c11fd721f9baeb3c3a65d1cdc06602a2

SHA1
d46fad5366ffb57f76813d66e29b69485b63cf99

SHA256
8b89ba3dba13b04cef436f293b6faad38f587df53d397da5819f1513c9eacf5c

SHA512
732ed874c7fd749e9a7dbfa3c09df7cac2b2ae1dd0479247e64c23286f04fba6af34ba571f17fe9b6d39385464c40353af06bd1bdf5205f294a75802d3954fab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Discussions

Filesize
135KB

MD5
6d6e95f0dbbb9f66abddb10382efd635

SHA1
a587b9814f60f9ad623524611ba0440626f34b23

SHA256
10d1a00fe863cab334823510e60fa05effecdec9d86488b0bd2d35d0567f35cb

SHA512
0afedbbc9759738c43320b602a3ec279c75a160f108461449b91ecff1e07a9ef0d25da26d30656da8ccaad3270ef56bd86cd21f09db78698951e607d960fb62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Est

Filesize
191B

MD5
c6f5a3e8d97de9a6c09b3d12ff05e873

SHA1
587b7fc38e4757fc26c680809dd52a7faea7ef34

SHA256
b5419ec8ebc587f6a3f85bbfcf7ae6173f537d1dfb36bf13e27d75e9aec82ef8

SHA512
a936a2dd04bc4fab1943155fe14d948cac1189392ae58eda14b59f3f3751230a21f469e62dc43bb346a8eb12377539f6a342e6743e64a9469a21f9480d9a73de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Home

Filesize
31KB

MD5
14c374994e755a90441f2acba7dad3ee

SHA1
947dc6e8ef6d2d4c6b9b465ae3b0767da6c744cc

SHA256
e8abbfefafc93f3ea0be9b89d7e5a3d51d4cb2c9b42141f57a195c71abdf1504

SHA512
63e2ec5caef1e188fba196e1cc6c3767e5f0dce2e3e9cea3e57917eee0407cf912f9514758949c97e7039979bae84d9b71c2782a6dec4a4929ac007cc86002a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Installing

Filesize
72KB

MD5
b82d000da85f5b875ec154d9f9359df6

SHA1
9da4547abd37417ba3b00d4374144f24e75d3c1e

SHA256
5137712b0bdaa8857b9d5862ef8f8d3375518600a1caedb5ddcb4565404f8150

SHA512
6f7f980ee8d74cef2dac9b742dc3607ff740a113252e8a423b6cced99f279d0ed382e3ce5d5fc01dc45f70ebe00704554f134bcab57700b83c6aab65e38f7197

Download Submit
C:\Users\Admin\AppData\Local\Temp\Liable

Filesize
63KB

MD5
3963c82707e90126e454a170693a7239

SHA1
edca4c7db2ecaea5e458b58f9ddbfd4d9340a442

SHA256
245ab548d12bac2b67a5925202bc690d5752ac65fb9b54f8d74cd8dc619babee

SHA512
6d1a2c31927f6741a0f04304e3d4cd20747e0b42c54818d7b7b77ae5749b439ec79e7266124e364ec7a835b6246214297325d6fea0bb565b9936cbb58cd554d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\One

Filesize
99KB

MD5
178873173ce0a535a170b60e2739886e

SHA1
b3213cca7bee1d8a50b34664f56ac19c182884c6

SHA256
01e1c1069ef37e08995b4ed04ba634b1d110f8dc3cf51cb7c17dce10ec492f06

SHA512
bd424a53c440e090aedd536f82c9eb478ff04756a5cc2da6fc7c15aa981e413b8254d5a2e1d9b9969852aa35d214c18ec60a3d820f52d8c30e84dbd77f8173ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pas

Filesize
87KB

MD5
f5cafb3ca1193320e8867439b6e80908

SHA1
41593b9ca73ff489415e2fa00cef36a8a2d63f58

SHA256
b800fabb812ea2dcaecaf176f80e94bcaf328eb42921616813a6e20fbca4173b

SHA512
c0183cf3f6b0f3f74382304507b66ef8c6539d2622d7c50d598ca51f7e580788c03385de764e60728c095d84c07cf5ca32f96215fdcbc1d23fb49c5536114587

Download Submit
C:\Users\Admin\AppData\Local\Temp\Passed

Filesize
109B

MD5
f63b2f6807453b1e0ad2a4ea71f1a3db

SHA1
af4b2dc8dafa90ce3ced9db36abf15fc7d0e028f

SHA256
88a19af86dd136e5b7af3f7e54089493d7b1d28c795cf87592ca81f7073ef0b3

SHA512
b8aa7550285d1141d8a13708d0130e5f26b257b03944e316a641f498c69dea7f1bc1e2164709d7e9ff7096663a36342cc74c9081ebdec3617575128233209036

Download Submit
C:\Users\Admin\AppData\Local\Temp\Reporting

Filesize
74KB

MD5
43437fcfcc247a530b3182d3569af041

SHA1
4fe39e9165b5f4cabee2c59fa77c445486945ff6

SHA256
131ea271c41ce04edcdcb1f43d3cc4ab73f89285666faf2ced1b55a196b95093

SHA512
df8cfe98f88df119e36e369c9ca2f2a77978d45ca5d4f723d28ab47126e8cd5545c09716a4f68dfff9830ec509f536836c41281fb0a30ec6ae2e43557ef782ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Shareholders

Filesize
141KB

MD5
65b2254d334faef1e0099c76f0834b9d

SHA1
fcf1a5a421461ef60d0d016d0142944b8fde3f6a

SHA256
1e4319ba9a0b61b658d704269d5d16549c4e539a7d3ed411dc7a11d90e2974c7

SHA512
33c4e33b61d3de75d0620171f9ab4d67776dea0118414c814b63484f3750564b73d55a9fe9e53c6035dd575b56d96285767c7846414c9cea4fd99ceec3b39428

Download Submit
C:\Users\Admin\AppData\Local\Temp\Some

Filesize
129KB

MD5
62065881c20070b99f076d38b592488f

SHA1
8f601093f9e0f6e8e4d109cecbeb0d8f01bea125

SHA256
7b896bd69d6476634adae5ce23383a7eaadb7722ea1f286e61b31c0ad0343a98

SHA512
6441c7bc74e6a6d4c901a8c510313753fccab57753334a37072789e5327ea00994a58913be9d816d418143e70b7c163d82a77816fbcbc3c38bcaeefad02d9ca0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Terrorist

Filesize
96KB

MD5
463ac359dd04e261dbd8ac4c3158184a

SHA1
ebc1ba3bf2380173ff1c86a91f16449efdecceb9

SHA256
3f625e3de2e2a09729cfd8b98d27278d8dbb74ef4dd5337e912ac13ee324fb36

SHA512
b23abc19245477b7171f1b295caf8947aa3029e0aa2dce6d46e0301897e64413ebc5b1eb4da1e7f8082db85d0a3315dd389e33e640d9dc7b5a33ced6b8553202

Download Submit
C:\Users\Admin\Downloads\PpmSubscriptions.exe:Zone.Identifier

Filesize
94B

MD5
abfb5f7e18dde67fff607ec5ffa21429

SHA1
98aca7acca7e90cb017a84998707721e285888fb

SHA256
9bf65dd02f93061d38e393bb36f0dbbc5d9fc5e87ec4b53b728cede7069f4658

SHA512
609e346c639bb192a0f7fc444f3f8be2755d3c580b35a51357cd6e2eac4717724e7a4d1f87c4f823146ff005ff0f7cdf4c9f2703859d4b01a04b6f0794c325ae

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 19515.crdownload

Filesize
1.5MB

MD5
65d22eed9430388f478d259c13b91151

SHA1
3fd6c1b050b7fda4c00b60960aafcaa1f2ac8199

SHA256
a3a7d2d924f021a1c29dda0fbdf843d52ca294a0c0bf136e151002d34df92a18

SHA512
0eeffbaf2ade4a66e9cd1a50eb954003693715bbeff76a2012d15930a164cc3f8176ba29163c13a95e52e4fbad0e9848e3bbd933e5519f803ce5277d7eee9d37

Download Submit
memory/4048-581-0x0000000000730000-0x0000000000969000-memory.dmp

Filesize
2.2MB

Download
memory/4048-582-0x0000000000730000-0x0000000000969000-memory.dmp

Filesize
2.2MB

Download
memory/4048-585-0x0000000000730000-0x0000000000969000-memory.dmp

Filesize
2.2MB

Download
memory/4048-586-0x0000000000730000-0x0000000000969000-memory.dmp

Filesize
2.2MB

Download
memory/4048-584-0x0000000000730000-0x0000000000969000-memory.dmp

Filesize
2.2MB

Download
memory/4048-583-0x0000000000730000-0x0000000000969000-memory.dmp

Filesize
2.2MB

Download