vidar | hxxps://coincapy[.]com/tradingview_premium/TradingView_Premium_Desktop[.]zip

Resubmissions

05/10/2024, 20:28

241005-y9al4awgnc 10

05/10/2024, 20:22

241005-y5s8ms1gkm 10

Analysis

max time kernel
129s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/10/2024, 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://coincapy.com/tradingview_premium/TradingView_Premium_Desktop.zip

Score

10^/10

vidar dd3c663b33910bd77937a09a739dc3d6 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

dd3c663b33910bd77937a09a739dc3d6

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/4752-131-0x0000000000330000-0x0000000000E3F000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
4752	TradingView Premium Desktop.exe
4752	TradingView Premium Desktop.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TradingView Premium Desktop.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TradingView Premium Desktop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TradingView Premium Desktop.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TradingView_Premium_Desktop.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
3572	msedge.exe
3572	msedge.exe
2628	identity_helper.exe
2628	identity_helper.exe
3472	msedge.exe
3472	msedge.exe
236	msedge.exe
236	msedge.exe
4752	TradingView Premium Desktop.exe
4752	TradingView Premium Desktop.exe
4752	TradingView Premium Desktop.exe
4752	TradingView Premium Desktop.exe
4752	TradingView Premium Desktop.exe
4752	TradingView Premium Desktop.exe
4752	TradingView Premium Desktop.exe
4752	TradingView Premium Desktop.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 1972	3572	msedge.exe	79
PID 3572 wrote to memory of 1972	3572	msedge.exe	79
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2088	3572	msedge.exe	80
PID 3572 wrote to memory of 2336	3572	msedge.exe	81
PID 3572 wrote to memory of 2336	3572	msedge.exe	81
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://coincapy.com/tradingview_premium/TradingView_Premium_Desktop.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4d1b3cb8,0x7ffb4d1b3cc8,0x7ffb4d1b3cd8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2580 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:480

C:\Users\Admin\Downloads\TradingView_Premium_Desktop\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe
"C:\Users\Admin\Downloads\TradingView_Premium_Desktop\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4752

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
026e0c65239e15ba609a874aeac2dc33

SHA1
a75e1622bc647ab73ab3bb2809872c2730dcf2df

SHA256
593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292

SHA512
9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
228fefc98d7fb5b4e27c6abab1de7207

SHA1
ada493791316e154a906ec2c83c412adf3a7061a

SHA256
448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2

SHA512
fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
a6969175c2869e307762d694c5193d43

SHA1
2827dce7d8582db5c7abcff31a72bb7d724514f4

SHA256
469589e2b6276f19329ddb22db9a2e13af65d9ea94435e1ced0cbc1622e028a5

SHA512
d583a3eae71f962f2c4257acca27805d4c05953b6d36c4c1929be0b790a078b36f33e13dc865a0b5836087d59b8c49c2da47396cca133f18241a3aba4c5900a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
e7ae15a9137b7cb2f873ad36c866adde

SHA1
b5abcae4572db89294bc882e055e396d43e324ae

SHA256
a10c65289bc1ccfe68ee245c5f84c223adb53d8eee7696ca4f2ade4b53989108

SHA512
f1fa8f75f4c75f43f8477e92320b941f67b4e64d75947ddb20a2f0597314012046108d74e3799014134960f537888a87bc7bac95f5cbafd63702ea8299047718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de3b965365147061e5e0fdf03c7a76d0

SHA1
6b8460c12d10748b60487ee47a1f1d6ce1a98a79

SHA256
a9d5434d726beaed2b18bcda82f950cf31ecf3043b5daf96d64f9195d6098e87

SHA512
37dc197514d25ad02a5541a9b4df470491ef1c5e4ce5ad8131ba8012fef86d0c1fb3560d9eeffb832dfbb3d91ac0b9543018adcf78f34f6320dd96f7969d0873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e91cbeafaceb2346ecb250ef9b8241fa

SHA1
8789fd5f11e266f466c31cc3e42f7f8af1d64372

SHA256
88300c9e102bc609e774538f28f0df0a8f54e4be27ee829768e966e6d878c45e

SHA512
6fb85f0862d9efa7dc2be2e44166afe914554985156407604d4306dde1b0f32c0d57bc4941393c92d9ff0b77e15932ead9c83d766078c63669f5342891747bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
658d40d7c708401b2f1a4f68d0b2726c

SHA1
88ef32fbb6522dfc3e251b24d020b405eaf031b3

SHA256
239b8ec56e4e2ed528ea9be1362fc57731c3c9ac56bf0518acba741822550b56

SHA512
a2a94e2250c30412820131c5575044e9129c0564ff11e6f624556d7ac403b7999af332814bd6485c089db973574cfccd0ca17f94ac3231cbd4ab81c542ffb74a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bf6e104f-9371-4e7e-a1dd-3b8fc1ae4100.tmp

Filesize
10KB

MD5
5217b892e5c9d50a9f8893c324851f57

SHA1
451455c6079fbd1e0c82365f69927e6e31c0da89

SHA256
ed6f82bbc25bab3895ef13a1efb5e9974610e2933fe13f848eb3340b31d274c7

SHA512
714f976bc7a0e0ce80121c07b0a806e44d7e65724fbddb80a78216bd962549baa9f5191882e85de1e536d28ced389f8d5d453e5b6d1c1b2565a519e904bbb826

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
41ce6cd728e8893a0387cd1d5aaf201d

SHA1
c6c5257c73d52968b03fa7a332f61f050229999c

SHA256
c6ff6212cd4c01ff44605a8339568c3ed2b9dd85c7956873ee9db592e24b654d

SHA512
73c40effe3fa0c521cdd5347e85ac142666a5a7b982d96c80f4c08c079d2f5a8d58c12644af20f27b8480040eb74b28d0696be16fc9566c02bf2d60d08839c27

Download Submit
C:\Users\Admin\Downloads\TradingView_Premium_Desktop.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/4752-139-0x0000000027F50000-0x00000000281AF000-memory.dmp

Filesize
2.4MB

Download
memory/4752-130-0x0000000003910000-0x0000000003911000-memory.dmp

Filesize
4KB

Download
memory/4752-131-0x0000000000330000-0x0000000000E3F000-memory.dmp

Filesize
11.1MB

Download
memory/4752-129-0x0000000000330000-0x0000000000E3F000-memory.dmp

Filesize
11.1MB

Download