vidar | e7461fb1155e2b7efccc34694313d50cdee5529c0aea229e0c15d32582096e68

Analysis

max time kernel
101s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
16/04/2025, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

En-Setup.v.exe
Size

5.8MB
MD5

8055f571dd14b65d688fe63b533e8a4f
SHA1

05b24092a0f11a38b2ea9da83975e4860cb8405f
SHA256

e7461fb1155e2b7efccc34694313d50cdee5529c0aea229e0c15d32582096e68
SHA512

884f2faedf80bd567a233c27cf87aaf68b5760783a33ca2173646437ff3068175ead1a614eab2724bc7c77b77273a1bfb0bdfed11a23f6a2d28b5fdbf6c13bb8
SSDEEP

98304:uriWMsk3Q82ZJ6bQRjliR1xi/5hW/7wSt8TijYFHYIXpRoYKCPISxkZksn:urFMnQJZJ6MoRa5hW/ESgijY6IZiiraT

Score

10^/10

vidar 0d80c60d314e504eeb06c12f83f4aeb6 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

https://t.me/v00rd

https://steamcommunity.com/profiles/76561199846773220

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

vidar

Version

13.5

Botnet

0d80c60d314e504eeb06c12f83f4aeb6

https://t.me/v00rd

https://steamcommunity.com/profiles/76561199846773220

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Signatures

Detect Vidar Stealer 40 IoCs

stealer

resource	yara_rule
behavioral2/memory/4088-438-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-440-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-439-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-437-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-449-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-450-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-455-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-456-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-459-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-463-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-464-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-465-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-469-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-470-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-515-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-516-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-517-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-518-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-521-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-525-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-526-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-527-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-531-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-534-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-892-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-934-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-939-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-941-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-942-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-946-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-947-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-951-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-952-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-968-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-969-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-973-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-974-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-987-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-988-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7
behavioral2/memory/4088-989-0x0000000003D60000-0x0000000003D89000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4108	chrome.exe
5932	chrome.exe
4652	msedge.exe
6068	msedge.exe
3304	msedge.exe
5596	chrome.exe
5212	chrome.exe
5500	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
4088	Sigma.com

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2768	tasklist.exe
5856	tasklist.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PhotographersGourmet	En-Setup.v.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\ChessToner	En-Setup.v.exe
File opened for modification	C:\Windows\ToldScuba	En-Setup.v.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\EmailSix	En-Setup.v.exe
File opened for modification	C:\Windows\WeekendColony	En-Setup.v.exe
File opened for modification	C:\Windows\MexicoSussex	En-Setup.v.exe
File opened for modification	C:\Windows\HhPhysiology	En-Setup.v.exe
File opened for modification	C:\Windows\TechnologicalResponse	En-Setup.v.exe
File opened for modification	C:\Windows\HazardFranklin	En-Setup.v.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sigma.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	En-Setup.v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Sigma.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Sigma.com

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5776	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133893162249198280"	chrome.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
5596	chrome.exe
5596	chrome.exe
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2768	tasklist.exe
Token: SeDebugPrivilege	5856	tasklist.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
4652	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4088	Sigma.com
4088	Sigma.com
4088	Sigma.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 5608	484	En-Setup.v.exe	78
PID 484 wrote to memory of 5608	484	En-Setup.v.exe	78
PID 484 wrote to memory of 5608	484	En-Setup.v.exe	78
PID 5608 wrote to memory of 2768	5608	cmd.exe	80
PID 5608 wrote to memory of 2768	5608	cmd.exe	80
PID 5608 wrote to memory of 2768	5608	cmd.exe	80
PID 5608 wrote to memory of 3368	5608	cmd.exe	81
PID 5608 wrote to memory of 3368	5608	cmd.exe	81
PID 5608 wrote to memory of 3368	5608	cmd.exe	81
PID 5608 wrote to memory of 5856	5608	cmd.exe	83
PID 5608 wrote to memory of 5856	5608	cmd.exe	83
PID 5608 wrote to memory of 5856	5608	cmd.exe	83
PID 5608 wrote to memory of 1916	5608	cmd.exe	84
PID 5608 wrote to memory of 1916	5608	cmd.exe	84
PID 5608 wrote to memory of 1916	5608	cmd.exe	84
PID 5608 wrote to memory of 4772	5608	cmd.exe	85
PID 5608 wrote to memory of 4772	5608	cmd.exe	85
PID 5608 wrote to memory of 4772	5608	cmd.exe	85
PID 5608 wrote to memory of 1084	5608	cmd.exe	86
PID 5608 wrote to memory of 1084	5608	cmd.exe	86
PID 5608 wrote to memory of 1084	5608	cmd.exe	86
PID 5608 wrote to memory of 1504	5608	cmd.exe	87
PID 5608 wrote to memory of 1504	5608	cmd.exe	87
PID 5608 wrote to memory of 1504	5608	cmd.exe	87
PID 5608 wrote to memory of 2244	5608	cmd.exe	88
PID 5608 wrote to memory of 2244	5608	cmd.exe	88
PID 5608 wrote to memory of 2244	5608	cmd.exe	88
PID 5608 wrote to memory of 2284	5608	cmd.exe	89
PID 5608 wrote to memory of 2284	5608	cmd.exe	89
PID 5608 wrote to memory of 2284	5608	cmd.exe	89
PID 5608 wrote to memory of 4088	5608	cmd.exe	90
PID 5608 wrote to memory of 4088	5608	cmd.exe	90
PID 5608 wrote to memory of 4088	5608	cmd.exe	90
PID 5608 wrote to memory of 5656	5608	cmd.exe	91
PID 5608 wrote to memory of 5656	5608	cmd.exe	91
PID 5608 wrote to memory of 5656	5608	cmd.exe	91
PID 4088 wrote to memory of 5596	4088	Sigma.com	92
PID 4088 wrote to memory of 5596	4088	Sigma.com	92
PID 5596 wrote to memory of 4880	5596	chrome.exe	93
PID 5596 wrote to memory of 4880	5596	chrome.exe	93
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94
PID 5596 wrote to memory of 5772	5596	chrome.exe	94

C:\Users\Admin\AppData\Local\Temp\En-Setup.v.exe
"C:\Users\Admin\AppData\Local\Temp\En-Setup.v.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Arrangement.psd Arrangement.psd.bat & Arrangement.psd.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3368
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
- - C:\Windows\SysWOW64\findstr.exe
    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1916
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 154723
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4772
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Staying.psd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1084
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Margin" Implementing
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 154723\Sigma.com + Jennifer + Evaluating + Player + Resorts + Graduated + Dem + Paypal + Interracial + Intranet 154723\Sigma.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Vp.psd + ..\Stripes.psd + ..\Pillow.psd + ..\Clients.psd s
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\154723\Sigma.com
    Sigma.com s
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d80adcf8,0x7ff9d80add04,0x7ff9d80add10
        5⤵
        
        PID:4880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1880,i,10306041058929639117,1118370292427633527,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=1876 /prefetch:2
        5⤵
        
        PID:5772
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1444,i,10306041058929639117,1118370292427633527,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2228 /prefetch:11
        5⤵
        
        PID:5252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2356,i,10306041058929639117,1118370292427633527,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2720 /prefetch:13
        5⤵
        
        PID:5080
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3212,i,10306041058929639117,1118370292427633527,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3284 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5500
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3220,i,10306041058929639117,1118370292427633527,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3304 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4236,i,10306041058929639117,1118370292427633527,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4276 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:4108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4620,i,10306041058929639117,1118370292427633527,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4676 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5932
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5304,i,10306041058929639117,1118370292427633527,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4628 /prefetch:14
        5⤵
        
        PID:5048
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5476,i,10306041058929639117,1118370292427633527,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5488 /prefetch:14
        5⤵
        
        PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:4652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ff9d808f208,0x7ff9d808f214,0x7ff9d808f220
        5⤵
        
        PID:3428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1812,i,17561119787706214913,17155129137144357011,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
        5⤵
        
        PID:1196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2204,i,17561119787706214913,17155129137144357011,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
        5⤵
        
        PID:2556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2528,i,17561119787706214913,17155129137144357011,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
        5⤵
        
        PID:1268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3424,i,17561119787706214913,17155129137144357011,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3428,i,17561119787706214913,17155129137144357011,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6068
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 11 & del /f /q "C:\Users\Admin\AppData\Local\Temp\154723\Sigma.com" & rd /s /q "C:\ProgramData\4790z" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:2848
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5776
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5656

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\4790z\db1dba

Filesize
512KB

MD5
59071590099d21dd439896592338bf95

SHA1
6a521e1d2a632c26e53b83d2cc4b0edecfc1e68c

SHA256
07854d2fef297a06ba81685e660c332de36d5d18d546927d30daad6d7fda1541

SHA512
eedb6cadbceb2c991fc6f68dccb80463b3f660c5358acd7d705398ae2e3df2b4327f0f6c6746486848bd2992b379776483a98063ae96edb45877bb0314874668

Download Submit
C:\ProgramData\4790z\eknyus

Filesize
64KB

MD5
ced0915fbb97949f886f1972e3ea1cbc

SHA1
1016c5aac09a93d8a7eaca420925aa30fbe50cf6

SHA256
6e30129b0718bf85befde3df672e5b22af1a6aa2cf82d0ab8939958352a05d7b

SHA512
ff26085e4a69446045269fff4595dcfbdd962b119dd25846036a23a83950c95c11aa24414881207f5a9da2d0123365acd2a17d55f4ba51703e0235299257e9e4

Download Submit
C:\ProgramData\4790z\wbaa16

Filesize
288KB

MD5
23ae7b89bfdc1198e09a953e9b49dbce

SHA1
3f6d5b7cf402471ed7a540ddb4db281924447c04

SHA256
6c5340a69a891b6fa83a8becc4883bdb9591dc451e7b6ffeb7adf80d6d1acc0d

SHA512
9b36375ed3862513b9ec4ee748f90bf507e6c3ba9dac691003b3e66d70ce665bc4997c84afc755d3e3791551f0d5907f43a92fcb930e77a67da6bedf6d5e505a

Download Submit
C:\ProgramData\4790z\yuaiwt

Filesize
64KB

MD5
281d11c4aa88120381727a94bc60ecb6

SHA1
7192b1a0bc3a385f67e83cc56a2c2fa94dfe72ba

SHA256
e48a289de01bddca9d3acffa5a55863e7f7ef313faf427a9e3b1d71fbff07698

SHA512
a8cba994765cfd042217687f4b717130951326d71761dbf8b9a263648a1807c9d0eb7dc93c554bd7e65f11944b323b9060b5b996b1999e4303f163ed94fc642c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
414B

MD5
5e508d066b5584b7420b477feec92734

SHA1
b3b241d1a74eab0078155a138d10968985e1c177

SHA256
be92feec2cceb89b41adc6c43c4019662719ebb26b74c00d24ea35c7a2e65d74

SHA512
f4a9da39478fac75af7b300cba54cebe28d521bca3fa68a879517e8ba9f576a5fd244feb4a0476cd9a05af2c7dee57b7951477d6e9c7ea9c1b5d0faefe3f2cbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
78KB

MD5
9a50971e97aca8c5e953c60c8cf6c73e

SHA1
83c3f790c74dbf28731c8a2e9233589f44d93103

SHA256
a4796693e2def951ce28b949e2bebb75da3a0f99e7579fee4c26215376e9e467

SHA512
78ed601bf066180921005c4a25eed6603b0a3830c95bb0e06cea913fcafbeb9c3d3c6d4389fa3a89c8d5b73c7b569e1913c4a7b59f41627eb26d4a246b47e7aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
1781354d27507643c155a786707c38a7

SHA1
2640329f5fa81556f623a621d593cf34ac7c4aec

SHA256
53facdb807aa83e6148a7c9aa06da7783307ee5012b638eb05210554f85cde80

SHA512
abfe8088d4714d74d0011578f8964a74c7d79362cb5b54e1742ac5b0b5cfae4d108d8a11843121bcb4d96f3c693c02a7c02164edf5157f21e51355e23721c37c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aa76037d-2c25-4bd5-9f81-89e3f85aefc7\index-dir\the-real-index

Filesize
1008B

MD5
654579cfa8e9072debada54a9c7b9939

SHA1
6af9b6dd9ad6b8eb337906c9487b0b3e50cc10fd

SHA256
d1e1e4a7e92a0f6a511c32efbcdf7828e90739b8a91fb1eac4d69d5a0430392a

SHA512
769090731b4588dcb3e2e569ac841856b1f1a61c3311ff5b00060c76f594b4ac06082a2b000fe2091ad46a7fbc2fdfff24ba2d563d86f0918ad3412b430b135e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aa76037d-2c25-4bd5-9f81-89e3f85aefc7\index-dir\the-real-index~RFe5818f2.TMP

Filesize
1008B

MD5
2b61df10cca9394f391d2689d0fcce06

SHA1
3bf318ec5a459f3a62b984850d095b73c40a5085

SHA256
52cddc51941fc3b19cfb8fde5c4378f42f3c69caa64521e7b6190dca8ff21f33

SHA512
0475bc5e219b7649ab170c7699b249717a7b4ea02fc910af83ec1d8b52b79930a9cf4e355c95ba14e9578d63f2d2d1b5f63d35e0c48b36b7ff90009ed65b18a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
adb707dfaf7098677dfafcdc1cb2e2f1

SHA1
983ab1576c13ae39666790c2d43aa4ffa37ee29a

SHA256
987f18c8fb7e010fbee70fb7f08d6f640bf50bf3553819c5a2a72375d9fc6e2b

SHA512
167383530651eebdad9947ad53c8c23f2b74669ea346ada637551f12df0dd022024420ba9936ce2124fb5fa942bebb2d5fe9173613674109f4372e803409bb78

Download Submit
C:\Users\Admin\AppData\Local\Temp\154723\Sigma.com

Filesize
1KB

MD5
12ee3f9eab7d6b8ece7394b30bd36a7e

SHA1
ef233279961f470984c86916caf1adf23f383f7e

SHA256
db42cc5d4344acf50cb308a1d1eb90a4efccfc3c0ee9f18b62a93caf6232b1dd

SHA512
c5f0db04be864dea9fe98c9ed47f526fbdd5a18c52751cd9d5277539311f6422d83e58bfd07d8a60f79670ab32db64a5af862107fbea186885a9e1c8baa7f9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\154723\Sigma.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\154723\s

Filesize
264KB

MD5
a2d8c1190659760ca229784325e5d4e8

SHA1
60982e848b3b8809772970b38f2ccec0e9707d07

SHA256
85177eaf073e8c7216ce06a8be39b6951864a9b6d8c226fc1493a795a24c7951

SHA512
c358720963d1ae3771cc2fbcd08e03191ccebf53fb185524cdd9e8abceb3cea20b4394e2927864a8859c1bc5d24471dcb355ffd7c9071f97d4c277aafdd5659b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Arrangement.psd

Filesize
17KB

MD5
59f22b8777394031b7922f06b731354e

SHA1
2df54e2ccfdcba08967155381578f19c4ce2cde3

SHA256
2d15a810bd0ae9fb2e96e8eaba68ec46d74d47937cf1fa83c9768297296c14b4

SHA512
0d6b911cf75118567e66f83c8eda462378115a4978b5b2683069c0c4b166623cee9ef17c7779afd3545703350d8a9b4bba462dd9998b8fc4a9c569232b24ed66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Clients.psd

Filesize
39KB

MD5
be18d9adeb2b11ac850cda3935599a1d

SHA1
29d4d198480431e0f9afec9b4642b80aa35d00f2

SHA256
c0cc9737fff5fda8438b9e068707066f29f46e716c6368df9c629855f108373b

SHA512
7b4fd5ab5f55b7ec1900ad6d9a0918c1d3314711256453708a404f98be9a3d554914e851eed99fadabb18dfdb96a747b4854e9508bd1bbac5f0dcd4c5e85904a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dem

Filesize
149KB

MD5
711f46a515ccdbc546b1c2b38e7e56c2

SHA1
464df67250c5faee6c4b18874c620b16eb911667

SHA256
eed9dccbfd4e0e1342bc33e369b386a2ae8c786c603209c73343a478ce7142d5

SHA512
fef57b76db57817e5449e7000726b07c7700d8c099f901170356268be16ea27132278cfd0b54df49da1ceeedc07d138468e048ebe4049e293a3095fbf6b10f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Evaluating

Filesize
52KB

MD5
11d1084471a398c1fc16ba16c3d97c8f

SHA1
21e29e6db32494c7104e92bd804864ee4e8f01ac

SHA256
4c2201c19aad032761603d98a9efa126435ab2b8c11738acaa050898ebfd674b

SHA512
15e29c9bd71ac1b24b61956697858ef9c6bc257cb748be1a10fe6bf9489fdc49ac460b663a4351ab1ad8223beff2c9e6391d14855dabe3aa6605b2dea7d94176

Download Submit
C:\Users\Admin\AppData\Local\Temp\Graduated

Filesize
100KB

MD5
fc03a6660588f9b3385e848f6cd0056c

SHA1
8cd3f9df8e86c06a8b48fae8e808094b22b36765

SHA256
c6d3d80a211ce89ff2619ac65cd3cd70518d3b2db501a7204df9f75b6a1e1849

SHA512
2519bd54e1f9d7a428267bc878f31c4502f358f5f1fef3e0e09e7ab17d1d5dd134647f9679ecb8d6117708fba8390ecd59a25aac6f2d31c6598896fbe47ce266

Download Submit
C:\Users\Admin\AppData\Local\Temp\Implementing

Filesize
1KB

MD5
0764bdc31e68d68b104cbf15607fbf6e

SHA1
42d38abcf810cdf6fa5606006c03f2704c817cad

SHA256
140d6a94377b499d462d222cf83853de19336c7de1880347cf2bc9d505836b3a

SHA512
e3bb25ae503368172c7b542b1ff420c53c3196a167fe4660b347740e9131ae41ac02b2a39176e4b8f1e15aaf4ccfb3c120ad5f01f7cd23a4f07d7b670073339f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Interracial

Filesize
74KB

MD5
f9f5cac82344a2a8e0161c3db016d1ab

SHA1
cece8585b8735f65a86c74a0b285a18b7cc3bb18

SHA256
5fceac0e7920e1416fdef7ee05156dcf9069a9851eb4aa33e7288b8c916a8806

SHA512
1db7e46fc1c9531759ace97ffa72273c1edabf2a7b7a2b35a59d73443c77ae9d433cf7d84440b8a8c8bdfc319e08de769472cc1b438712e51f97f6e8fb9d7c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Intranet

Filesize
133KB

MD5
959fde9361d0a1dd0de9609049c109a9

SHA1
0c1a4a58f79e03dc21866daacf61086e3a706a50

SHA256
5d72ed02bb21accb5c9448d9ba7b83e67bb904dcd2c97a2316cd9137f466bd6c

SHA512
13fecea4532e7d3e575fd3d82e2fb17827faa05c552858dff4523c18a91b80d07203c78589fb14c3dc84530b2c8720305048ca05feea89500543a74ac5e984ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jennifer

Filesize
88KB

MD5
59d440c3e91766f5fd8dae8c1db494ba

SHA1
9f728dc537f62ebb9dd3de27cd9337c4022f073b

SHA256
e6baa5c72a90d8647b538f71df2820258bf94d1f08c1d763249fece1318c3735

SHA512
579cf1eca92a0851fea64f39de36ebd9f7dc1dd667a3da36d474e7c0de011f728f426b2c015c70ee443465bc5e4c683f87c0066f6b94cb681dbcc2a1b963b648

Download Submit
C:\Users\Admin\AppData\Local\Temp\Paypal

Filesize
53KB

MD5
53429cceb778c71f22314d295682d45c

SHA1
1c180b4fd39f469b318ed032a800fc12566d6bb1

SHA256
068bb1461aafc63e6089231fe86fd428faacd53a841b1fac849f0e1b85032f67

SHA512
a1299e5699fdab4044a7eff988ee348f12d65d259edcc2320dbe80e8e7a77914286f5a4526a3b11e4165ad7c5506fe8f51b7027c2cd78dc9c47107b414d05d43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pillow.psd

Filesize
73KB

MD5
5af7681994d86ffda109f1a92ced0ee0

SHA1
859913d36e8d3637dbc108dab41037370797b8e5

SHA256
5f80e592e77d2ac1ab3576893d6b110380f53ab75a221f29bc448561e9e0838d

SHA512
40907b9a066d0fea4206e083d8a75bae8b16dce5d869f38df5f07775167274f25992e39b399a1b3a4ea2557b60f1b481a8f142a481a9c7cd6916735ebdd43573

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player

Filesize
128KB

MD5
52bc12227550c0e894113e2552dff82a

SHA1
2305155178f20a2505fbf29c7e6f6d8785310185

SHA256
931597efcad5fe656f28967697590ae684dbdecbda0421f36bc3fb72bd43e2c1

SHA512
9aef39cfb614a61cf5ea6cc24aa1d5fe8c0690a16b4efa8ef049b4441d3a2d44364fc42d4faaef2d059603d7c5badbc95634d3401f5ac886c0c9ab1fb4f8cb1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resorts

Filesize
146KB

MD5
63723d5cd52217259c3a2083621b1e76

SHA1
621da11b656224f879644152842135e871d58f99

SHA256
35704e8585755ac25d6e0a01077820ecb58e5b7ff2ee04a3a344dca15615f61c

SHA512
70ab6167fa38a3022f45ccd5a5253db0e25245987c13f0f375b1d31a31a6324bfa88fba6d34e32502e403a370833713923313b97f5fe2bd760936a6cc03f91ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Staying.psd

Filesize
476KB

MD5
84e94fcf7db165dc08891a0eab8a9e7f

SHA1
dac7bb482c67dfb94f3101cf6bac4f644833c9cd

SHA256
7c10a7ac70e8ff1213312cd9bb45afa35b030ff78ea4781fe900c6d6a496b574

SHA512
c4e24d802be8992366a74890954a312cab32cfad7fb5454b2fdc12d9439787e648208ce9fe9f084f81ca0d8434f17b568cf859417bb1201f6d16cea11e2e1d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Stripes.psd

Filesize
87KB

MD5
f6874fe0b63fd0774feaa8bcd3466ca2

SHA1
123343f5dafb972796ef832e6c20b592aa4dc422

SHA256
0368930e0ee37d40fe154ba522dfceaa12da03493c7f32ee20f7d016cf51f871

SHA512
8839f935a3d1c3517792e1080bd6c4de02c754d30971fe14ce6305d16a0e494d4464f8a8b4bb1a04c67fb15586f65561978b5c8c87b82a5c07d41edae260c39b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vp.psd

Filesize
65KB

MD5
bc636b825e5b5c6ca5c316de61183ef8

SHA1
0fdd3bdd860bb478524946c0251ec76b34f33ba0

SHA256
e6237034f8287b0a860a8b670ba45311e22d3e618313f14dcdc97f95bb4fe0fa

SHA512
44245ea8d738f4fea15dd452ebe6aaf9537c758318daf185f3f1f7da930d006f61aa22c4c9062521aaf9fa1a32077ee625f0449a73040f8c7b6aa0fb3fe66eea

Download Submit
memory/4088-518-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-439-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-464-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-465-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-469-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-470-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-459-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-456-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-455-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-450-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-515-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-516-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-517-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-449-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-521-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-525-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-526-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-527-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-531-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-534-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-437-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-463-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-440-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-438-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-892-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-934-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-939-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-941-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-942-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-946-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-947-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-951-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-952-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-968-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-969-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-973-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-974-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-436-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-987-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-988-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-989-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-434-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-435-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download
memory/4088-433-0x0000000003D60000-0x0000000003D89000-memory.dmp

Filesize
164KB

Download