Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
130s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/10/2024, 20:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://coincapy.com/tradingview_premium/TradingView_Premium_Desktop.zip
Resource
win11-20240802-en
General
-
Target
https://coincapy.com/tradingview_premium/TradingView_Premium_Desktop.zip
Malware Config
Extracted
vidar
11
dd3c663b33910bd77937a09a739dc3d6
https://steamcommunity.com/profiles/76561199780418869
https://t.me/ae5ed
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
Signatures
-
Detect Vidar Stealer 1 IoCs
resource yara_rule behavioral1/memory/4752-131-0x0000000000330000-0x0000000000E3F000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
pid Process 4752 TradingView Premium Desktop.exe 4752 TradingView Premium Desktop.exe -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TradingView Premium Desktop.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TradingView Premium Desktop.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString TradingView Premium Desktop.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\TradingView_Premium_Desktop.zip:Zone.Identifier msedge.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2336 msedge.exe 2336 msedge.exe 3572 msedge.exe 3572 msedge.exe 2628 identity_helper.exe 2628 identity_helper.exe 3472 msedge.exe 3472 msedge.exe 236 msedge.exe 236 msedge.exe 4752 TradingView Premium Desktop.exe 4752 TradingView Premium Desktop.exe 4752 TradingView Premium Desktop.exe 4752 TradingView Premium Desktop.exe 4752 TradingView Premium Desktop.exe 4752 TradingView Premium Desktop.exe 4752 TradingView Premium Desktop.exe 4752 TradingView Premium Desktop.exe 1616 msedge.exe 1616 msedge.exe 1616 msedge.exe 1616 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe -
Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1996 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3572 wrote to memory of 1972 3572 msedge.exe 79 PID 3572 wrote to memory of 1972 3572 msedge.exe 79 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2088 3572 msedge.exe 80 PID 3572 wrote to memory of 2336 3572 msedge.exe 81 PID 3572 wrote to memory of 2336 3572 msedge.exe 81 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82 PID 3572 wrote to memory of 2992 3572 msedge.exe 82
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://coincapy.com/tradingview_premium/TradingView_Premium_Desktop.zip1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4d1b3cb8,0x7ffb4d1b3cc8,0x7ffb4d1b3cd82⤵PID:1972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:2088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:82⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:12⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:12⤵PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:12⤵PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:12⤵PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7532758134717941276,7411627493371146499,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2580 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4624
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2720
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:480
-
C:\Users\Admin\Downloads\TradingView_Premium_Desktop\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe"C:\Users\Admin\Downloads\TradingView_Premium_Desktop\TradingView_Premium_Desktop_(password_github)\TradingView Premium Desktop.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4752
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
152B
MD5026e0c65239e15ba609a874aeac2dc33
SHA1a75e1622bc647ab73ab3bb2809872c2730dcf2df
SHA256593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292
SHA5129fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569
-
Filesize
152B
MD5228fefc98d7fb5b4e27c6abab1de7207
SHA1ada493791316e154a906ec2c83c412adf3a7061a
SHA256448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2
SHA512fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56
-
Filesize
116KB
MD5a6969175c2869e307762d694c5193d43
SHA12827dce7d8582db5c7abcff31a72bb7d724514f4
SHA256469589e2b6276f19329ddb22db9a2e13af65d9ea94435e1ced0cbc1622e028a5
SHA512d583a3eae71f962f2c4257acca27805d4c05953b6d36c4c1929be0b790a078b36f33e13dc865a0b5836087d59b8c49c2da47396cca133f18241a3aba4c5900a1
-
Filesize
180B
MD5e7ae15a9137b7cb2f873ad36c866adde
SHA1b5abcae4572db89294bc882e055e396d43e324ae
SHA256a10c65289bc1ccfe68ee245c5f84c223adb53d8eee7696ca4f2ade4b53989108
SHA512f1fa8f75f4c75f43f8477e92320b941f67b4e64d75947ddb20a2f0597314012046108d74e3799014134960f537888a87bc7bac95f5cbafd63702ea8299047718
-
Filesize
5KB
MD5de3b965365147061e5e0fdf03c7a76d0
SHA16b8460c12d10748b60487ee47a1f1d6ce1a98a79
SHA256a9d5434d726beaed2b18bcda82f950cf31ecf3043b5daf96d64f9195d6098e87
SHA51237dc197514d25ad02a5541a9b4df470491ef1c5e4ce5ad8131ba8012fef86d0c1fb3560d9eeffb832dfbb3d91ac0b9543018adcf78f34f6320dd96f7969d0873
-
Filesize
5KB
MD5e91cbeafaceb2346ecb250ef9b8241fa
SHA18789fd5f11e266f466c31cc3e42f7f8af1d64372
SHA25688300c9e102bc609e774538f28f0df0a8f54e4be27ee829768e966e6d878c45e
SHA5126fb85f0862d9efa7dc2be2e44166afe914554985156407604d4306dde1b0f32c0d57bc4941393c92d9ff0b77e15932ead9c83d766078c63669f5342891747bb2
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5658d40d7c708401b2f1a4f68d0b2726c
SHA188ef32fbb6522dfc3e251b24d020b405eaf031b3
SHA256239b8ec56e4e2ed528ea9be1362fc57731c3c9ac56bf0518acba741822550b56
SHA512a2a94e2250c30412820131c5575044e9129c0564ff11e6f624556d7ac403b7999af332814bd6485c089db973574cfccd0ca17f94ac3231cbd4ab81c542ffb74a
-
Filesize
10KB
MD55217b892e5c9d50a9f8893c324851f57
SHA1451455c6079fbd1e0c82365f69927e6e31c0da89
SHA256ed6f82bbc25bab3895ef13a1efb5e9974610e2933fe13f848eb3340b31d274c7
SHA512714f976bc7a0e0ce80121c07b0a806e44d7e65724fbddb80a78216bd962549baa9f5191882e85de1e536d28ced389f8d5d453e5b6d1c1b2565a519e904bbb826
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD541ce6cd728e8893a0387cd1d5aaf201d
SHA1c6c5257c73d52968b03fa7a332f61f050229999c
SHA256c6ff6212cd4c01ff44605a8339568c3ed2b9dd85c7956873ee9db592e24b654d
SHA51273c40effe3fa0c521cdd5347e85ac142666a5a7b982d96c80f4c08c079d2f5a8d58c12644af20f27b8480040eb74b28d0696be16fc9566c02bf2d60d08839c27
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98