Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 07:22
Static task
static1
Behavioral task
behavioral1
Sample
498a7a01bf758c22edce4242d2a44960.exe
Resource
win7-20240508-en
General
-
Target
498a7a01bf758c22edce4242d2a44960.exe
-
Size
854KB
-
MD5
498a7a01bf758c22edce4242d2a44960
-
SHA1
020d69ceb746b1fb62c65f651ee1b37769654607
-
SHA256
b2506074e22cbbd6c7a54b64c258ca48dd5a06bebf0830cc63596f1034045bfa
-
SHA512
5318ab904d014a1657e8df6cfbd5b822c70d934b31c2efef51f8317eeb5aa60e9b38925590bd7f201393c437fb13758ffd30759aab17f0f1189016429ed286e2
-
SSDEEP
24576:wQDRq87lrAOfpjo1K7l604k1QmPtAKAe4INR:wN8JMIpjo1K7wAQG/R
Malware Config
Extracted
stealc
Extracted
vidar
https://88.198.124.82
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1
Signatures
-
Detect Vidar Stealer 10 IoCs
Processes:
resource yara_rule behavioral2/memory/2128-575-0x0000000000A00000-0x0000000000C46000-memory.dmp family_vidar_v7 behavioral2/memory/2128-577-0x0000000000A00000-0x0000000000C46000-memory.dmp family_vidar_v7 behavioral2/memory/2128-579-0x0000000000A00000-0x0000000000C46000-memory.dmp family_vidar_v7 behavioral2/memory/2128-580-0x0000000000A00000-0x0000000000C46000-memory.dmp family_vidar_v7 behavioral2/memory/2128-596-0x0000000000A00000-0x0000000000C46000-memory.dmp family_vidar_v7 behavioral2/memory/2128-597-0x0000000000A00000-0x0000000000C46000-memory.dmp family_vidar_v7 behavioral2/memory/2128-613-0x0000000000A00000-0x0000000000C46000-memory.dmp family_vidar_v7 behavioral2/memory/2128-620-0x0000000000A00000-0x0000000000C46000-memory.dmp family_vidar_v7 behavioral2/memory/2128-639-0x0000000000A00000-0x0000000000C46000-memory.dmp family_vidar_v7 behavioral2/memory/2128-640-0x0000000000A00000-0x0000000000C46000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
498a7a01bf758c22edce4242d2a44960.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 498a7a01bf758c22edce4242d2a44960.exe -
Executes dropped EXE 2 IoCs
Processes:
Buy.pifBuy.pifpid process 1520 Buy.pif 2128 Buy.pif -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Buy.pifdescription pid process target process PID 1520 set thread context of 2128 1520 Buy.pif Buy.pif -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Buy.pifdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Buy.pif -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 2104 tasklist.exe 2668 tasklist.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Buy.pifBuy.pifpid process 1520 Buy.pif 1520 Buy.pif 1520 Buy.pif 1520 Buy.pif 1520 Buy.pif 1520 Buy.pif 1520 Buy.pif 1520 Buy.pif 1520 Buy.pif 1520 Buy.pif 2128 Buy.pif 2128 Buy.pif 2128 Buy.pif 2128 Buy.pif 2128 Buy.pif 2128 Buy.pif 2128 Buy.pif 2128 Buy.pif 2128 Buy.pif 2128 Buy.pif -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tasklist.exetasklist.exedescription pid process Token: SeDebugPrivilege 2104 tasklist.exe Token: SeDebugPrivilege 2668 tasklist.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Buy.pifpid process 1520 Buy.pif 1520 Buy.pif 1520 Buy.pif -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Buy.pifpid process 1520 Buy.pif 1520 Buy.pif 1520 Buy.pif -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
498a7a01bf758c22edce4242d2a44960.execmd.exeBuy.pifdescription pid process target process PID 3176 wrote to memory of 3340 3176 498a7a01bf758c22edce4242d2a44960.exe cmd.exe PID 3176 wrote to memory of 3340 3176 498a7a01bf758c22edce4242d2a44960.exe cmd.exe PID 3176 wrote to memory of 3340 3176 498a7a01bf758c22edce4242d2a44960.exe cmd.exe PID 3340 wrote to memory of 2104 3340 cmd.exe tasklist.exe PID 3340 wrote to memory of 2104 3340 cmd.exe tasklist.exe PID 3340 wrote to memory of 2104 3340 cmd.exe tasklist.exe PID 3340 wrote to memory of 4536 3340 cmd.exe findstr.exe PID 3340 wrote to memory of 4536 3340 cmd.exe findstr.exe PID 3340 wrote to memory of 4536 3340 cmd.exe findstr.exe PID 3340 wrote to memory of 2668 3340 cmd.exe tasklist.exe PID 3340 wrote to memory of 2668 3340 cmd.exe tasklist.exe PID 3340 wrote to memory of 2668 3340 cmd.exe tasklist.exe PID 3340 wrote to memory of 1092 3340 cmd.exe findstr.exe PID 3340 wrote to memory of 1092 3340 cmd.exe findstr.exe PID 3340 wrote to memory of 1092 3340 cmd.exe findstr.exe PID 3340 wrote to memory of 4016 3340 cmd.exe cmd.exe PID 3340 wrote to memory of 4016 3340 cmd.exe cmd.exe PID 3340 wrote to memory of 4016 3340 cmd.exe cmd.exe PID 3340 wrote to memory of 404 3340 cmd.exe findstr.exe PID 3340 wrote to memory of 404 3340 cmd.exe findstr.exe PID 3340 wrote to memory of 404 3340 cmd.exe findstr.exe PID 3340 wrote to memory of 2680 3340 cmd.exe cmd.exe PID 3340 wrote to memory of 2680 3340 cmd.exe cmd.exe PID 3340 wrote to memory of 2680 3340 cmd.exe cmd.exe PID 3340 wrote to memory of 1520 3340 cmd.exe Buy.pif PID 3340 wrote to memory of 1520 3340 cmd.exe Buy.pif PID 3340 wrote to memory of 1520 3340 cmd.exe Buy.pif PID 3340 wrote to memory of 2044 3340 cmd.exe PING.EXE PID 3340 wrote to memory of 2044 3340 cmd.exe PING.EXE PID 3340 wrote to memory of 2044 3340 cmd.exe PING.EXE PID 1520 wrote to memory of 2128 1520 Buy.pif Buy.pif PID 1520 wrote to memory of 2128 1520 Buy.pif Buy.pif PID 1520 wrote to memory of 2128 1520 Buy.pif Buy.pif PID 1520 wrote to memory of 2128 1520 Buy.pif Buy.pif PID 1520 wrote to memory of 2128 1520 Buy.pif Buy.pif
Processes
-
C:\Users\Admin\AppData\Local\Temp\498a7a01bf758c22edce4242d2a44960.exe"C:\Users\Admin\AppData\Local\Temp\498a7a01bf758c22edce4242d2a44960.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k copy Apparent Apparent.cmd & Apparent.cmd & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c md 2098353⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V "BARNLUGGAGEANYTIM" Transcripts3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Mel + Avoid + Online + Prove 209835\q3⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\209835\Buy.pif209835\Buy.pif 209835\q3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\209835\Buy.pifC:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\209835\Buy.pif4⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\PING.EXEping -n 5 127.0.0.13⤵
- Runs ping.exe
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:31⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch DictionariesFilesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\209835\Buy.pifFilesize
915KB
MD5b06e67f9767e5023892d9698703ad098
SHA1acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA2568498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA5127972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\209835\qFilesize
347KB
MD531ed0f956703a726c62248a411d22cce
SHA1bd4a0d351c5ee8d7fca36e3cf4e462462301eafe
SHA2565ceb6a47114ad7027f40b0d33ecc4a3c101cd843e825c06b15e7bd73455d2b26
SHA5125f59dd79af888211625bba773b80a6df7d645260e602cfe074aa19f16c12fc384e56caae2b633a6e437cb0b007983772c05b02a7279d9984c444a08adbcd0dd7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\AnchorFilesize
19KB
MD57400c856071a39c301413acf230411d6
SHA1e448951a0387274dc276996045183740ba5e681b
SHA25615e238f0cc601e974c899a9f1709ad0583d856c0e09fb1ae9491f250cd864c16
SHA5122df7ed26a6d95f459cae4fcf5b8db0eb2ed51ff9678fdb5f67b0f07c18c29b64af97857f8a13f0a7e157fb79d3448b7ab42c72cb87ddef6780cd67bb36123ad0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ApparentFilesize
24KB
MD5ceada9d3039535bc0cb87c3ff57628ff
SHA1babd1a60b008d59ad862c7732b23a249f4059890
SHA2569f904098b3b965b0f383f097102982637107bc04f5588bb2d6ecd33551aa249d
SHA5123aad377df0f258dbfddad21530b4dca267ff1ab9ee168274f880ef32cd07a63555d996281bc20f9f17209536f7cdcfcac30527c1a2c1f126c3c2610b358ed292
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\AvoidFilesize
67KB
MD5bc31a12aefbdd22638a6c51c40ac0cbe
SHA101bd5d83b79fdafcd441dd25538b6f1789842e36
SHA256e41445bcb2b87065aaf10471ba1d94ba25c34d0bfb94a034b006d0762b809a62
SHA512828283ccaee57aa8fc97476f9cb9c7c8aacaf90efe3d7c69f4e54289b2ece18ecc75c2a3c42b95bba43b6989061e00a7c3ef77e5bc7a2efe672cf180b0e94ef3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\BurdenFilesize
66KB
MD50b53aa66b605e881670b79a59573d0eb
SHA15f747decd8764b7f7a01a20f049db3f7f2d51822
SHA256707ebfe234767c1c62fd5c17d58e10f7e0bc233aa9c9406eeb6eba68cc0e22c4
SHA512239bfb4d4389e544cae776baf2063f3f959cd7ddd00bdaed5ce1e73a003645d7873443a3ec993e96a458245e7c149d9459476f0009983f30a5c599dea0024a63
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\CommentFilesize
53KB
MD5ae59a671263ed7577ee67882a91e6e24
SHA114e61438cd996ba5a6e0358364c49c4c82a170d1
SHA2566a9d9ad65c58d9a359d84c73c7a60e3cca3326a7ee14f0d6a84b1ff9c152082e
SHA512098764cbd227a116a0f11274dfc5ee1855f82ac48e97a90f316f4e8eb8aa0a19f71dfacb0c21d60f63f7036a0c2509f41ad8dbbfb4e3bd37dbb021b283cfd742
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\CooperationFilesize
64KB
MD5153bc866a91a3ea8090ebb07addcf721
SHA175c4f3675e9966cd6e57ee4b8d9dfb85866532f2
SHA256f9b5fe82e99db096ad9b233a25b7bc70b3cd613bc5c2ac8ee65de037c7c65aab
SHA512b65be678b7311fe3e7c0e649af4f8f2499b0cc178a71d6a620ba9495495876728c3d71796e75c7499df739da6f7dca34a045569a56d573a13e75e5fa39b804b9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\DefeatFilesize
51KB
MD5ffce7513b0b9425c6c2d98f3f7ba9dba
SHA1b02e72f5a3d806a02a0a95fc9945da98e213543e
SHA256611f7148a76fae9bcc5d2075dd614da0450202edf561bab91565ab123570671c
SHA512139a97f27360d14f0eb70b49fd85b5a1740254dbdb8c2d266a05ed3bffc0d8d0b4c7695c8cfc1a181ada0b43faf50da0d62fb13549acff8818a552b1eb1d24a8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\DefiningFilesize
12KB
MD53f67ae4354226998d838891675309cfe
SHA1aff63b9af03f953f180c7c3b0bbb4fab55eeed86
SHA256c2b6356e08c317b39beae721dd860f1db3999dd2ede310b2c239c3b968cce912
SHA5120193f294dbf9f4dc0fb3d839b132825afd18ea0832ad1bde53b77e9bff7043a15034b41256afcce9334da4600223763776219cc8d90d342551cb75cb52514b4e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\DonationFilesize
49KB
MD57ca4621d1c35fc9ffd158ea8d4fffddd
SHA16deb7fc23d51fdaf914607e4f5d1aa6f9041d740
SHA2563d713587907eeb8bf06c0283dc234fb9dd9451ab9b597a75ae5ef960fdf38a1e
SHA512fb069357e5d34d6ea22c95b7e89961636c9b073b320ecf3ed7290766fabc6c6277808528a50b8dcc37c68235cd9c3c0b5effa7321609b3b042e92483e2c3a220
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\FameFilesize
36KB
MD57eae9d7be47dcb5828c15147aba3d9e4
SHA1f1f7c713cc4df7655aa70f8e9c035fe7a3e29ddd
SHA25650719294e27ee75b1a4adec7414bb70fec7a8752d53e208f60a585ef88c06b0d
SHA512a2b8b712989715f56cb82cdfd1c44b5772d874bff8f44e3d81d0cdb77efdae422b17225c222e6aca9c566876df8a883ec3ac7a07c7db1b774492957db1bc0047
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\GoreFilesize
63KB
MD540214213b456ce9ae37e7135bc938fcd
SHA14c3805226bee6a0314c5e4c7aed6beaeca070688
SHA25679cee99cc90423f33223e679cb999dc1e9da0d46817764bad47a551557f07a1e
SHA5122375f3b2aa224a2a0672092def6520f93b58e570ad17b4b24406b7eb3f8ad95d690da8484547dd5fd809b39c164210ba785459749842222e66ccfb6b48018cfb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\HamptonFilesize
41KB
MD5f083727754cf8a400295c00b2b2d10e1
SHA13a1d2f1e541d36ec109b77ad32911cea1678e40b
SHA2562611e74b00969844d134d89835110f42450bdb1038ad9212a043dc03a4a16f4f
SHA5123d99dd6686c0aecf3c3b54fd7d68555740d8c69ba6a398b874d9208f8cfde994d9abb6a606ff5a9716858f17cd633ac48cc0976401877bd2fe660c58eba0cff3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\HandleFilesize
29KB
MD5f92123f4085f2e2d633b61e255056a81
SHA1efbfc3873208e0ca18fa64feb22f53903ee45bc1
SHA2565dbf8f90f3a0f57161250f4474507d9c763c918c1cae328e8f46eea026fd248c
SHA512dcf0fab394f03e32102b25bdfdd361b4cb27b45d2de9ba99c71b6ad651dca98802f88303cab459aa39cdff4f282594e9cf413a707101c6338569efe0121584ff
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\KeenFilesize
62KB
MD5932c22652e4dc04172bd3c9e8231c090
SHA19e29c64008e554f34b1217381e874a0935e5d909
SHA256f6dacd2fb67de305665f84a25fd2f0c85c9abef75334498735924e1eb8c40a96
SHA512f4c6b0282d89bdf0687424d8d691ddb41dafcfebec87d6bd99c591c2682faa006170e2b7b7d8da630b1b4e6712f51ca487d63f89d22d47037472f2a1834a872d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\MeetingFilesize
35KB
MD5f4d1e58fe6ea4e6db131e2fbb1877fb9
SHA12f757a077929e38873022d033e6835fa6d908584
SHA256d49e2fafdc343c80a370e407aef49f092d98a1cde4313990b555b3ff602d14b4
SHA512ab2ad408b66c35d8af39de3aa248f84a9da3f22d0b8ba74f7c38d6e56e0843c95f84698d63bc00278d190c987020ab2d90ab0db38dfb83cf5ea25e60e13578d4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\MelFilesize
25KB
MD54266c93fc57f777f5bb5c5167c6c358b
SHA1eb387be4f7bf71d91bfd1a0ab4fc3e9d66de5c46
SHA2566ab509c23bf8ad2f0cbbafe0f521809aea700fac53976854ab9db3306facf04a
SHA512c9c16310adecd657a39c2c4aa31bac6f0b33a82b1764c1c821bddb552ee6d930bbe34a1ad18cc46e6c11880e7590865abf0a52890b9e0acaf1de4b10fd456754
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\OnlineFilesize
138KB
MD59fbaf981a4fb785664fa165e0ce463d0
SHA162476abe076dbd35cd3dc906f3c8d7e8399cc5d2
SHA256271c4cff3e2eb78badfb87005aba3876d182c18ae98993e4309908041fa3a6eb
SHA5128b5295b77537b5681b7248ebcebc5633e8e6d69c145391f0c78cccf4d91568af054c9c43daea0bb023f17eaeaeeb67cda6e1cc02ccaa56b5852681c7305d1074
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\PrincipalFilesize
20KB
MD5a3326a8340a9b6c4c6cc4736c9d68833
SHA19840d262918441d11d228f1325ed6e885dbd760c
SHA256c8592bf3b25774e06014b03e180c978b62abb0449842c5965b1b93b006dc3d69
SHA512d9b562000f376e2084a6cce7a894d2e0b1ad326a404d84527a80065b171233ec6dfb5abdfc896e3d09a2d7ac0a90131b67231fccf3cdfc243bd6ea1d307d79ca
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ProveFilesize
117KB
MD50d82d568de81a5416b65d46275c57afe
SHA1f1496bf5d56e2ca48a20738203238b47345f49ef
SHA25648fd8dfc163008e4968654073afa8c186de9d95460bbc2b60d3aa5529947e162
SHA51245b895e71db3703398ec1c1647de5890f54c1f2e525fbe0f5986fe3d3c43925a2d13683a691d2603a71d6f995cac54e119d218b95b81bdddd31ae03cb3e18135
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\PussyFilesize
42KB
MD54ca7db16fbca0bb3ff1b58b7dc68ed33
SHA13ef55f25643b885e99ba30569e382d14887f9df8
SHA256d62002a7c054dcf9daf35c311c72f2494786cceb3c968f52210e5f3a0acbea97
SHA512de67b3230ff51260d383518a376c7b67807809acd69b672b9ce7fff80271c266a518ef665b736d4f61b57c39989376cfe45c2990586bb5351630d7c39be0e40a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ShiftFilesize
44KB
MD568fc2213914195ca32a487be4960b246
SHA165bd64a6b135cd2c6bff7e8226df6197272c790c
SHA25618e4cc79ad57a1b0ce2e946ef97f19780d26aca2e944accefa7c99bd40a13c69
SHA51247aadaa6e47a38a5074ef3d76677533fb00fffdb0b4928e8b5d343404b5ff0f17f21bbb84b372b2d42fea695a65e8aa6c4f1e7d6615b49ffaa2200c3fda08d4b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\SpecsFilesize
26KB
MD51bcb4b7705fdef179cc72980fea7ce26
SHA182dd3552e15f57bca8742d8258767f492e5ec46e
SHA2563bba68698818d8f273c1440c12d3e281a697ad7fade35fb859467480b56e3ad8
SHA512554e6ff5705d4e71f25ad99879d38c061e7c66c12531c7828308a8fee1bfda4366c2e2d4846aa71a0968426132e908124707a2b341083463463d85bb92f4c0e7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\TranscriptsFilesize
158B
MD52818b8f68bd095c62f48222c252262ec
SHA1e90bc017ce4a45ba8352585c78d8158b4c4e139b
SHA256c0e947ef64b02398cbbc8d1080de78e7a884500e06e3fba36c1b13f39b49e28f
SHA512398fc4bbc8e498c0beddc14a5181973a9caf5607e48f4c421ee624d788e2830177af813e4a957af99691c48d0ef0b93002219422ff1b787d53e1f0872a8aabaf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UkraineFilesize
59KB
MD51615dd90a44f0748e0bcb5c620e08aea
SHA12002a43a8ccafd28926417428d9fc45a945228b5
SHA2567060bbb1549dd936219fcfdbe47dc6089202e4b69368db82521c862b05b7f6c7
SHA5121e981a8a038fab2692276e1979ac848e7af28cb682477b12cfad7a64ca94c3852127d0c6e6720fc57aec0880579bf9ff6c1489729bf6918daaac071d378e7094
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UruguayFilesize
64KB
MD5dd85bf970e4e6cfcf951f8cc7715a8c6
SHA11743f1439889e4a5aa1c9bb5df870025ae07d904
SHA25655e80cbc262a725e7f7ef2d7bbf2ce4a9c5d2e1e429e9930d1baae1df24b97ca
SHA51299905866f4408ce419792a6a94891dcbef3d3d773f6a4c5d53511184b9e95524a15ed3f7c66e953a90541543810e1cb7e9543eac4741a30197cdeec889f1f209
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\VarFilesize
8KB
MD50829f71740aab1ab98b33eae21dee122
SHA10631457264ff7f8d5fb1edc2c0211992a67c73e6
SHA2569f1dcbc35c350d6027f98be0f5c8b43b42ca52b7604459c0c42be3aa88913d47
SHA51218790c279e0ca614c2b57a215fecc23a6c3d2d308ce77f314378cb2d1b0f413acd3a9cd353aa6da86ec9f51916925c7210f7dfabc0ef726779f8d44f227f03b1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\WearingFilesize
12KB
MD564cc92e2de1c2f706b4078d99daf0fbe
SHA10cae2206ec04a05234112e5df725fa8338085346
SHA2564e09ea0f8526cdaea7ca21c5f5abe5023a2447e3c9e28ce99fb6119c66de6b42
SHA512f625a257d5c47f19fc9ba797443247ee6e368e6f05121342e0156ee701c15ab3e5a146d40aafe81d72c8703274bdece83da67624c502e2c025d2220f79ba4b7c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\WebcamFilesize
60KB
MD5fbe1a1a4ea1a979ec69ab7e29cf30f48
SHA1b85fad489c682ad454df9ddbd34cc694980c50ab
SHA2567dc3f42e99fdeb3c242cebb74e554f9d8b0496902e4cc0c6e21ca95c6eb7e74b
SHA512eacfbb6fda9f361c51f1771cd32e3f4e30ee33d6e0a0cc261568a8b43432dfc35fb568da8ca9b9d5c8139070612f175d97211360ce9626de72418c1f0ab75119
-
memory/2128-577-0x0000000000A00000-0x0000000000C46000-memory.dmpFilesize
2.3MB
-
memory/2128-579-0x0000000000A00000-0x0000000000C46000-memory.dmpFilesize
2.3MB
-
memory/2128-580-0x0000000000A00000-0x0000000000C46000-memory.dmpFilesize
2.3MB
-
memory/2128-582-0x0000000019820000-0x0000000019A7F000-memory.dmpFilesize
2.4MB
-
memory/2128-596-0x0000000000A00000-0x0000000000C46000-memory.dmpFilesize
2.3MB
-
memory/2128-597-0x0000000000A00000-0x0000000000C46000-memory.dmpFilesize
2.3MB
-
memory/2128-613-0x0000000000A00000-0x0000000000C46000-memory.dmpFilesize
2.3MB
-
memory/2128-575-0x0000000000A00000-0x0000000000C46000-memory.dmpFilesize
2.3MB
-
memory/2128-620-0x0000000000A00000-0x0000000000C46000-memory.dmpFilesize
2.3MB
-
memory/2128-574-0x0000000000A00000-0x0000000000C46000-memory.dmpFilesize
2.3MB
-
memory/2128-639-0x0000000000A00000-0x0000000000C46000-memory.dmpFilesize
2.3MB
-
memory/2128-640-0x0000000000A00000-0x0000000000C46000-memory.dmpFilesize
2.3MB