vidar | a84c53037ecf5ba9db3d05ed58d835a960973dfba8946c94e9bfa6838ee12a4b

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2025, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 8.5MB
Sample251211-ab462stlem
SHA256 a84c53037ecf5ba9db3d05ed58d835a960973dfba8946c94e9bfa6838ee12a4b
MD5 d994ab0bb21c653f2e22e94e8f457835
SHA1 dc2014ab3653e07344d20dde248ffe45bb86939e
SHA512 391ff51b81f3e02308017072e960f8b4c5a575e34e19f536b0ce6f86918557a92f68f9253adeaaf33a9f5f8990062fb8100f10ff92c067966e4155a5802908df
SSDEEP 49152:BWxAK3xWyq9jEIzWzdzMrq1KcUR6ykdU6xK1X:lK3x5q2I+dgr0KcYJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dadf4dfb4414faa707e84357dfba40dd discovery vidar spyware stealer

Malware Config

Extracted

Family

vidar

Botnet

dadf4dfb4414faa707e84357dfba40dd

https://steamcommunity.com/profiles/76561198761022496

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0

Signatures

Detects Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral1/memory/5536-1-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15
behavioral1/memory/5536-25-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15
behavioral1/memory/5536-146-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15
behavioral1/memory/5536-158-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
2244	chrome.exe
2244	chrome.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe
5536	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2244	chrome.exe
Token: SeCreatePagefilePrivilege	2244	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2244	chrome.exe
2252	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5536 wrote to memory of 2244	5536	file.exe	89
PID 2244 wrote to memory of 5144	2244	chrome.exe	90
PID 5536 wrote to memory of 2244	5536	file.exe	89
PID 2244 wrote to memory of 436	2244	chrome.exe	91
PID 2244 wrote to memory of 436	2244	chrome.exe	91
PID 2244 wrote to memory of 2480	2244	chrome.exe	92
PID 2244 wrote to memory of 1336	2244	chrome.exe	93
PID 2244 wrote to memory of 1336	2244	chrome.exe	93
PID 2244 wrote to memory of 3204	2244	chrome.exe	95
PID 2244 wrote to memory of 5624	2244	chrome.exe	96
PID 2244 wrote to memory of 3204	2244	chrome.exe	95
PID 2244 wrote to memory of 5624	2244	chrome.exe	96
PID 2244 wrote to memory of 224	2244	chrome.exe	97
PID 2244 wrote to memory of 224	2244	chrome.exe	97
PID 2244 wrote to memory of 5584	2244	chrome.exe	98
PID 2244 wrote to memory of 5584	2244	chrome.exe	98
PID 2244 wrote to memory of 372	2244	chrome.exe	100
PID 2244 wrote to memory of 372	2244	chrome.exe	100
PID 2244 wrote to memory of 4832	2244	chrome.exe	101
PID 2244 wrote to memory of 4832	2244	chrome.exe	101
PID 5536 wrote to memory of 2252	5536	file.exe	102
PID 2252 wrote to memory of 216	2252	msedge.exe	103
PID 5536 wrote to memory of 2252	5536	file.exe	102
PID 2252 wrote to memory of 1944	2252	msedge.exe	104
PID 2252 wrote to memory of 5184	2252	msedge.exe	105
PID 2252 wrote to memory of 5184	2252	msedge.exe	105
PID 2252 wrote to memory of 5184	2252	msedge.exe	105
PID 2252 wrote to memory of 2008	2252	msedge.exe	106
PID 2252 wrote to memory of 2008	2252	msedge.exe	106
PID 2252 wrote to memory of 4156	2252	msedge.exe	107
PID 2252 wrote to memory of 4156	2252	msedge.exe	107
PID 2252 wrote to memory of 4156	2252	msedge.exe	107
PID 2252 wrote to memory of 4544	2252	msedge.exe	108
PID 2252 wrote to memory of 4544	2252	msedge.exe	108
PID 2252 wrote to memory of 4544	2252	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff1aebdcf8,0x7fff1aebdd04,0x7fff1aebdd10
    3⤵
    PID:5144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1972,i,13292432599244763978,14192648127283754706,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --subproc-heap-profiling --field-trial-handle=1576,i,13292432599244763978,14192648127283754706,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    PID:2480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --subproc-heap-profiling --field-trial-handle=2388,i,13292432599244763978,14192648127283754706,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=2552 /prefetch:8
    3⤵
    PID:1336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,13292432599244763978,14192648127283754706,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:3204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3204,i,13292432599244763978,14192648127283754706,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:5624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4228,i,13292432599244763978,14192648127283754706,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4240 /prefetch:2
    3⤵
    PID:224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3184,i,13292432599244763978,14192648127283754706,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4532 /prefetch:1
    3⤵
    PID:5584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --subproc-heap-profiling --field-trial-handle=4776,i,13292432599244763978,14192648127283754706,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4772 /prefetch:8
    3⤵
    PID:372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --subproc-heap-profiling --field-trial-handle=4808,i,13292432599244763978,14192648127283754706,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4932 /prefetch:8
    3⤵
    PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d8,0x7fff1ae9f208,0x7fff1ae9f214,0x7fff1ae9f220
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1880,i,3458047809459792487,14882902440837876364,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2292,i,3458047809459792487,14882902440837876364,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1952,i,3458047809459792487,14882902440837876364,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3520,i,3458047809459792487,14882902440837876364,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3508,i,3458047809459792487,14882902440837876364,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4544

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2784

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 0823868c26bb2f528587442196997605da4cd135bb0f409bbdc66e0e7153d6e7
MD5 7866a1cd6e927aa2f1a74bfb7be617ea
SHA1 1e7ce68a0cfd7ecc5db1155b8b225de3a60b1500
SHA512 33b98f44bacf68c0590f706f5d3ebebdf0aa2a259c31336f8120e2e822bfed8441c76a0114c0676c0eb1c7f1484fe42fa727216ef395b19dfb91385b5cb42e68
SSDEEP 3072:PZW79BZS0lwR6BsmXWqqbx8TPgS5yCY0VLJbdYvjIBE:I7pS0lVUbxOgY00VLJbu7IBE
MD5 SHA1 SHA512 SSDEEP

Submit Download

35771bb7-1bf7-41f4-a124-42c60b277d89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\35771bb7-1bf7-41f4-a124-42c60b277d89.tmp
Size 35KB
SHA256 00ea0cdefd5438009bb6a6b7e0843db6b1c41269c0931f77cd873c15c05ddfcb
MD5 7f07198f82d84f781a865a46b1b23c9d
SHA1 cc6445ba263edc833944553a5a22d64bbf7194e6
SHA512 09809fe75577bac6d2ce13128f52edf519474449ed71a04bd2022c44a3b323c42a04ace2a894d997c2d73fffac0492f22c19e6b97028ea0faa103da5b3c075ee
SSDEEP 768:rF5BLv7I5wCPFdV6Zi63ECgb+GAx38q80KSwmsaOCjB:LJUV6ZL3dtUmxRjB
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 502d629a47554eea903ec1d625ce8f8455b10505212a994297976cf089dac722
MD5 d2169ec78e0defecf4855bdc71e5816e
SHA1 85c3c1e1354e886f81e373c3d036d9439ae601d5
SHA512 7217c2395b976dd85d0f1d868385a801f00f34a71c7da49ba64146b7f87449663148545b5329f0e3d9a1c82425c6954e8f9ce5257618609baa416a31422ec9d5
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 9189e702f674209bcf057a42b5f93ec9b26797a6f06068611b9c0fb5c0f999a7
MD5 9fb3a1b1006405cecab23955588d8715
SHA1 fbf9db0417ed74f7c182a24df5cae73991b6b613
SHA512 c524b6506dc9c733c2f097be95261a346a9ef40451d85b8a91bff477f934a06b91da0c45e0dc49ab144666427648a945eaacf951bbfa16dba182effbef2fc247
SSDEEP 768:WF5BLv7I5wCPFdV6Zi63ECgkYGAx38q80KFfdmsaOCjB:eJUV6ZL3UtkmxRjB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5536-0-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5536-1-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5536-25-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5536-146-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5536-158-0x0000000140000000-0x0000000140189000-memory.dmp

Download