vidar | 312b2ec093ef1f61d8b3db70784aa5a946ac7a772a15d1482f5e32f65e607eaf

Analysis

max time kernel
149s
max time network
133s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
09/12/2025, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 8.1MB
Sample251209-tc2xvsbj5x
SHA256 312b2ec093ef1f61d8b3db70784aa5a946ac7a772a15d1482f5e32f65e607eaf
MD5 0ad01951a8bfebacc62a0e93c7b2265d
SHA1 7b000d471b030f69adec0461f6f11a9dd66d8e64
SHA512 30034d0402b01f0a2b1d0836ed77b5353edfa4676630411b2b1001b6e469c81dd9cc5dc6b5fac68a516e7c947202c99067c880e751a179538c83f7b8cad841c1
SSDEEP 49152:+0aay83sOFL54qGb3z5YtnBuvrslRicSbJCZ5RNAPTboK1ysn:g83TID5YB4sJSNCZnNAb9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dadf4dfb4414faa707e84357dfba40dd discovery vidar spyware stealer

Malware Config

Extracted

Family

vidar

Botnet

dadf4dfb4414faa707e84357dfba40dd

https://steamcommunity.com/profiles/76561198761022496

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0

Signatures

Detects Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/4044-1-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15
behavioral2/memory/4044-30-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15
behavioral2/memory/4044-133-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15
behavioral2/memory/4044-145-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
3388	chrome.exe
3388	chrome.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe
4044	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
904	msedge.exe
904	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3388	chrome.exe
Token: SeCreatePagefilePrivilege	3388	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
904	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3388	4044	file.exe	78
PID 3388 wrote to memory of 3104	3388	chrome.exe	79
PID 4044 wrote to memory of 3388	4044	file.exe	78
PID 3388 wrote to memory of 5008	3388	chrome.exe	81
PID 3388 wrote to memory of 4924	3388	chrome.exe	80
PID 3388 wrote to memory of 4924	3388	chrome.exe	80
PID 3388 wrote to memory of 4952	3388	chrome.exe	82
PID 3388 wrote to memory of 4952	3388	chrome.exe	82
PID 3388 wrote to memory of 5136	3388	chrome.exe	83
PID 3388 wrote to memory of 5136	3388	chrome.exe	83
PID 3388 wrote to memory of 8	3388	chrome.exe	84
PID 3388 wrote to memory of 8	3388	chrome.exe	84
PID 3388 wrote to memory of 2452	3388	chrome.exe	86
PID 3388 wrote to memory of 2452	3388	chrome.exe	86
PID 3388 wrote to memory of 3520	3388	chrome.exe	88
PID 3388 wrote to memory of 3520	3388	chrome.exe	88
PID 3388 wrote to memory of 3288	3388	chrome.exe	90
PID 3388 wrote to memory of 3288	3388	chrome.exe	90
PID 3388 wrote to memory of 5672	3388	chrome.exe	91
PID 3388 wrote to memory of 5672	3388	chrome.exe	91
PID 4044 wrote to memory of 904	4044	file.exe	92
PID 904 wrote to memory of 5092	904	msedge.exe	93
PID 4044 wrote to memory of 904	4044	file.exe	92
PID 904 wrote to memory of 2472	904	msedge.exe	94
PID 904 wrote to memory of 4588	904	msedge.exe	95
PID 904 wrote to memory of 4588	904	msedge.exe	95
PID 904 wrote to memory of 4588	904	msedge.exe	95
PID 904 wrote to memory of 5900	904	msedge.exe	96
PID 904 wrote to memory of 5900	904	msedge.exe	96
PID 904 wrote to memory of 4876	904	msedge.exe	98
PID 904 wrote to memory of 4216	904	msedge.exe	99
PID 904 wrote to memory of 4876	904	msedge.exe	98
PID 904 wrote to memory of 4876	904	msedge.exe	98
PID 904 wrote to memory of 4216	904	msedge.exe	99
PID 904 wrote to memory of 4216	904	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1ac9dcf8,0x7ffe1ac9dd04,0x7ffe1ac9dd10
    3⤵
    PID:3104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1988,i,5227984654646991433,10957290971169941171,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=1980 /prefetch:2
    3⤵
    PID:4924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2140,i,5227984654646991433,10957290971169941171,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2160 /prefetch:11
    3⤵
    PID:5008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2404,i,5227984654646991433,10957290971169941171,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2548 /prefetch:13
    3⤵
    PID:4952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3280,i,5227984654646991433,10957290971169941171,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2932 /prefetch:1
    3⤵
    PID:5136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3276,i,5227984654646991433,10957290971169941171,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:8
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4244,i,5227984654646991433,10957290971169941171,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4200 /prefetch:9
    3⤵
    PID:2452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4620,i,5227984654646991433,10957290971169941171,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4640 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4848,i,5227984654646991433,10957290971169941171,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4248 /prefetch:14
    3⤵
    PID:3288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4844,i,5227984654646991433,10957290971169941171,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4828 /prefetch:14
    3⤵
    PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x30c,0x7ffe09c9f208,0x7ffe09c9f214,0x7ffe09c9f220
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1876,i,12672410050304728210,9102835432719319349,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2072,i,12672410050304728210,9102835432719319349,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2448,i,12672410050304728210,9102835432719319349,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:13
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3312,i,12672410050304728210,9102835432719319349,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3304,i,12672410050304728210,9102835432719319349,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:4216

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4232

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 35d82e84fce9cca79b438f9607097c847d159429051f7ed63a9cf4fffaf6e95b
MD5 956fd0de7f65b126bef2125999689012
SHA1 5ef88a6db81ec7820286f2b6f0090fcbeb4978eb
SHA512 394408d40e235e4da9e8b76ddc5fcf0bcb79d4f7e95445f4e5e8657403c944cc09497d930d9f3cf15050cecf15d97b4d51c00ec8dcbd9c1a763585383b032962
SSDEEP 3072:hXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT0:hWMExki2KL64sbWRtHqldg+G/M0
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 277e71e9ceb89201713d4002f33a073d080eacca63f8c91b3275c33ecf247e93
MD5 f99f26dbfaddbe188d0aa34c55bb0428
SHA1 61b471e4c5b0066224ed9b2ca6e3592aeecce041
SHA512 25b9c4f0bb88dff3c390df044dffd262bb0f499c00ebcd9d0f15d171bf312e2babc94e4172a0df46372107b15552cc8dadc3210866c27ba9a0f06626d4386b8a
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 127d07e6f81904e509b0db8075299473664022591100f1f785e25ff99cac9a73
MD5 74f2ad286284af661856a8cfc4a4f90d
SHA1 b6b1241fbd6e1e2e8027719483086cb1345f8c8e
SHA512 ba000cf6ef09bea6863ec061121fafed83db368de3e554f0ee99e58473be573467d38417342b5a7adef6dba9216e3d546f43ad89ef7cd82d98cbbd560bc43277
SSDEEP 768:wF5BLv7I5wCPFdV6Zi63UCgUUK9R3y5DHnUTvjuRF4ocB1JfXjJ:oJUV6ZL3qXWjqFWlfXjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e63d30029adb96bbefdd22c27e5071eed1016ba9c1a74d220c880c7206994c0f
MD5 34f56f745501006d3a72bad491ee604b
SHA1 d0d8faaef0d3f27206b2864d793550e2c301e54a
SHA512 603315d5c0c41f8e2ecceea5e86adae8b35881227766d196c57c785c6795aa606084fc57f645effd5cd50bd6661c9e48fbe4a1821e49904481b8289f159ef920
SSDEEP 768:cF5BLv7I5wCPFdV6Zi63UCgU3lR3y5DHnNM1iZo3FfocB1JfXjJ:MJUV6ZL3OauwFNlfXjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4044-0-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4044-1-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4044-30-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4044-133-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4044-145-0x0000000140000000-0x0000000140189000-memory.dmp

Download