vidar | 3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/05/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.8MB
Sample260501-warefsav6t
SHA256 3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705
MD5 16beda08072cb06c5e75a741018d927a
SHA1 67399fe752d7946a31b630bbab600a15c1b0b89c
SHA512 148d7ee437ebd0b5d058be365cd94988ec45ceb51b8fd420694f75cdc2ba216bc4164769e14d09cef307db462f208b8c040cf7bd27b5ed009a3ca42f664ebf32
SSDEEP 49152:5qwiMrDNBP8GpGKUVH4+G3Jw1OU7rg+GTeviOmQp:5XvzpBP3C0QghT4iu
TLSH
T16DD57C07689100F8C09AF73194F67A95FB35B80847393BE72B525EB02E7B7C09936B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery vidar spyware stealer

Malware Config

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/4928-1-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15
behavioral1/memory/4928-23-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5788	chrome.exe
1984	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4180	chrome.exe
4180	chrome.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe
4928	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
5500	msedge.exe
5500	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
5500	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4180	4928	file.exe	94
PID 4180 wrote to memory of 2144	4180	chrome.exe	95
PID 4928 wrote to memory of 4180	4928	file.exe	94
PID 4180 wrote to memory of 3244	4180	chrome.exe	96
PID 4180 wrote to memory of 3244	4180	chrome.exe	96
PID 4180 wrote to memory of 5788	4180	chrome.exe	97
PID 4180 wrote to memory of 768	4180	chrome.exe	98
PID 4180 wrote to memory of 768	4180	chrome.exe	98
PID 4180 wrote to memory of 3772	4180	chrome.exe	100
PID 4180 wrote to memory of 5528	4180	chrome.exe	101
PID 4180 wrote to memory of 3772	4180	chrome.exe	100
PID 4180 wrote to memory of 5528	4180	chrome.exe	101
PID 4180 wrote to memory of 1468	4180	chrome.exe	102
PID 4180 wrote to memory of 1468	4180	chrome.exe	102
PID 4180 wrote to memory of 5700	4180	chrome.exe	103
PID 4180 wrote to memory of 5700	4180	chrome.exe	103
PID 4928 wrote to memory of 5500	4928	file.exe	105
PID 5500 wrote to memory of 1508	5500	msedge.exe	106
PID 4928 wrote to memory of 5500	4928	file.exe	105
PID 5500 wrote to memory of 1984	5500	msedge.exe	107
PID 5500 wrote to memory of 2136	5500	msedge.exe	108
PID 5500 wrote to memory of 2136	5500	msedge.exe	108
PID 5500 wrote to memory of 2136	5500	msedge.exe	108
PID 5500 wrote to memory of 5716	5500	msedge.exe	110
PID 5500 wrote to memory of 5716	5500	msedge.exe	110
PID 5500 wrote to memory of 5948	5500	msedge.exe	111
PID 5500 wrote to memory of 1112	5500	msedge.exe	112
PID 5500 wrote to memory of 5948	5500	msedge.exe	111
PID 5500 wrote to memory of 5948	5500	msedge.exe	111
PID 5500 wrote to memory of 1112	5500	msedge.exe	112
PID 5500 wrote to memory of 1112	5500	msedge.exe	112

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdc79dc728,0x7ffdc79dc734,0x7ffdc79dc740
    3⤵
    PID:2144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,17990564444073333240,17056124307500155775,262144 --field-trial-handle=1992,i,10824985335808975080,381952391965959594,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1988 /prefetch:2
    3⤵
    PID:3244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,13066007342905431893,14848867693724171046,524288 --field-trial-handle=1992,i,10824985335808975080,381952391965959594,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,3425650216473066436,2824335044145331054,524288 --field-trial-handle=1992,i,10824985335808975080,381952391965959594,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2540 /prefetch:8
    3⤵
    PID:768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,6520433311870903139,12826452298207813806,2097152 --field-trial-handle=1992,i,10824985335808975080,381952391965959594,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:3772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,13634353499763755806,10910885878124557342,2097152 --field-trial-handle=1992,i,10824985335808975080,381952391965959594,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:5528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4012,i,6743159043398263611,8506576970242421910,2097152 --field-trial-handle=1992,i,10824985335808975080,381952391965959594,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4028 /prefetch:2
    3⤵
    PID:1468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4528,i,13443653752167936523,11880722592877785543,2097152 --field-trial-handle=1992,i,10824985335808975080,381952391965959594,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4604 /prefetch:1
    3⤵
    PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffdc75bc188,0x7ffdc75bc194,0x7ffdc75bc1a0
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,7089747653483051896,2964747377391970628,524288 --field-trial-handle=2328,i,4401130244021015370,10989884158456747828,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,7037507237010637055,13799389092751729265,262144 --field-trial-handle=2328,i,4401130244021015370,10989884158456747828,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,12405102779091817837,15136838710007388502,524288 --field-trial-handle=2328,i,4401130244021015370,10989884158456747828,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,7625781075247894508,13676486391374091461,2097152 --field-trial-handle=2328,i,4401130244021015370,10989884158456747828,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,5266867701861564757,13425017296127925083,2097152 --field-trial-handle=2328,i,4401130244021015370,10989884158456747828,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:1112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 13f374999b25bda87685307e5455ab44056efae2265ce14b5aa63557fb6f23e5
MD5 a611c0d36a9759814f9c698761df85a4
SHA1 e4fcdcb2aa88168404ea1ea27f1a5358d8f993a7
SHA512 fbca0ca9594d13ff574edbc7661935cad79f7b9c174a938be185d8a76630b8011104357b7ba05c975ec6c257b5dda6cf22b86da53a66ec660b895f90f2b27a11
SSDEEP 1536:s3jXrhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRh:SPh3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T19C9312BA5E2646E7957D4AC176AE7908CE12130D709FA9CC326C638C61D41CD2B63F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce180cf0fce9a4a96685bbb0c58efb5750080d37ce961b69a74ae38b49eb68c9
MD5 2abcf056d353616a5983a10f17185a31
SHA1 40d71f06b42cf03d05e8dba44f76231dd24d9fd9
SHA512 5bff16b6683201694139145fd708bf7d834e97a5792e68cfb43b011e13c0e993e1cfb6a8c6f450aa2437fe486fb6f3ff1af62a05b918ee73bc195ec5cb0b3e02
TLSH
T1D7D080181275AC31D4A68575548537093E2DED675543533B5473557C0DC7E1085971C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 924e96ec20750cb6a5239ec6615014ae8ebb3de4d3c60595d6c95e7ccd197fe9
MD5 9b2430d85ce0b6612f557c45f7f3cbcc
SHA1 0a1e10f745cd18a847854cf92a1d4154f1e53a18
SHA512 187d6a5fac24a44192cd7964a293cf55a01134f6bd0ced9759bf4dee1fbc0273c5e118208cf3606ca4853d0f0f145448fc8342dac94a0745638e99f4acafd46e
TLSH
T1FED0801C1275BC31D4BA8575544537092D1DED675543533B5433557C0D87E1085971C3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f5ba40f3-432a-4c7f-8e37-0710a00cf07c\index-dir\the-real-index
Size 2KB
SHA256 5b51f70c3570bbfd4ea9d86f36f432638418147665bb29a89d5f48356d8e0a96
MD5 19055d30024d111098b690dc0c91592b
SHA1 fc169d9251ffe65b2ead428befaa3d0eb15765fe
SHA512 be928c10e6741ace93d39b6f75cd1a1061ff1aa88693b6b276ea1fe13c2ef26716d9ac8fc9252aca4b992f008dcf0940a1bbbac03337a442afa9638f8de07e62
TLSH
T12F51D98D8C972B17EDAD42B244F6145833381CDE1B4C5617BCEC56348C8B6A528BB354
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f96e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f5ba40f3-432a-4c7f-8e37-0710a00cf07c\index-dir\the-real-index~RFe58f96e.TMP
Size 2KB
SHA256 dba425564d65007ec7ae752649ab8eab87301405bc2752aa34c6383d6a0a6d58
MD5 84c75acce7a62ed40daf9a5e301146cf
SHA1 e9c2a1b96945fcadef9f0ea2f9cb04e64643faf4
SHA512 4db6312f789f3e0d50b91394cd6f926972c60ee1ac6b235dbd97183d999e45304f6c24497a391f8d506cbd46189dabed8992517a1042cfb4ed6e582c4f8e6d22
TLSH
T1B651C65E9C420B31CD9082B349CA5069333E68954949AF0B34ECCA33ECC37AE3D6A385
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8b36e43232843fb1ca0a21c3344b07b38856ebf257f21ab46a9d549b0c3ebb3d
MD5 17f746a1e16b815f29f47fbfe1bd0e04
SHA1 70444643c16c033c890d0cf51b379e21ca230a63
SHA512 00c05a2bc0221ca19f81599bf311a4bab64f83d9dff7e36467b2313307a50a35175b7c5808b3b4c775c9c7c4ab148ded42c222ccd602d3db07d8cbc621cff13c
SSDEEP 192:P+x3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C524640A7B787001EDE3D9725CB080771E3CA16DCF22A6915DB654694EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 849d874673d707abc357321e10458b395c5f4440b658b839d7474f3128a7a592
MD5 e63e2695c405f6dc223d33b6c7d51be4
SHA1 8171ab139a22d5f84a24c88afbf9db3aac2edfcc
SHA512 77e7933574c58bf975c4e244166859383e20ad879bba244be0c1c21243ccfb388608305a2bd002d14cfbfcd0040648636102db5c96119edffbe222e56ca47956
SSDEEP 384:nsiFavqMg3sNK8TUNTUlIm2TJvuxOiGcNLqvfqZpVhFL/OiRYV/Vw1mRQCe0wrNx:XFayv37wgzmxrdZpVRRYk1mu/0Ur
TLSH
T130C24A36E854EEABEDE78FC9A70A7A07DEE41167C58C4AD4CAD81E0E00971DE5307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f6b41943612aad0807f8ed8293014c85ba6f5b88949e44888d981fdd679eccf1
MD5 a090c7259641cf705b06a1047dff7ede
SHA1 e4f000acbe68690c365ffd1c9d743e3d255569be
SHA512 b994dec5dd3898ba6c04024ebdfe0e3e7944474251d73ded7898f9460b4773e4a145c94ceadb96b3c8520edab87fd50c5edc2335ecf89e93e413f7aee625abcd
SSDEEP 384:n0iFavqMg3sN+8TUNTUlIm2TJvuxOZv74qvfqZpVhFL3LrbDRYV/Vw1mRQCe0wrr:PFayv3Pwgzmx0KZpVbDRYk1mu/0Ur
TLSH
T176C24936E854DEABADE78BC9E70A3607DEE44167CA8C4AD4D6D81E0D00DB1ED530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WZt7rmGaqhWj

Path C:\Users\Admin\AppData\Local\Temp\WZt7rmGaqhWj
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1608-69-0x0000022593D10000-0x0000022593DB9000-memory.dmp

Download

memory/1796-140-0x0000024B80CB0000-0x0000024B80D59000-memory.dmp

Download

memory/2004-52-0x000001A6821D0000-0x000001A682279000-memory.dmp

Download

memory/2064-164-0x000001E068730000-0x000001E0687D9000-memory.dmp

Download

memory/4928-0-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/4928-21-0x0000029955C40000-0x0000029955CE9000-memory.dmp

Download

memory/4928-23-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/4928-22-0x0000029955D60000-0x0000029955D6C000-memory.dmp

Download

memory/4928-1-0x0000000140000000-0x0000000140104000-memory.dmp

Download