Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-12-2024 14:17

General

  • Target

    https://drive.google.com/file/d/1mKXWW2vbvmNgy6gcM-_teUE1FjZSmy-o/view?usp=drive_web

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 55 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1mKXWW2vbvmNgy6gcM-_teUE1FjZSmy-o/view?usp=drive_web
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe72d046f8,0x7ffe72d04708,0x7ffe72d04718
      2⤵
        PID:3028
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
        2⤵
          PID:3488
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4484
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
          2⤵
            PID:4456
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
            2⤵
              PID:4940
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
              2⤵
                PID:4772
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
                2⤵
                  PID:5080
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
                  2⤵
                    PID:4736
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4988
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
                    2⤵
                      PID:1716
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
                      2⤵
                        PID:4700
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5316 /prefetch:8
                        2⤵
                          PID:2476
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
                          2⤵
                            PID:2696
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
                            2⤵
                              PID:4408
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
                              2⤵
                                PID:4116
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
                                2⤵
                                  PID:5472
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5640
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1948 /prefetch:1
                                  2⤵
                                    PID:5848
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
                                    2⤵
                                      PID:6116
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1948 /prefetch:1
                                      2⤵
                                        PID:5804
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
                                        2⤵
                                          PID:5816
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
                                          2⤵
                                            PID:5532
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5412 /prefetch:8
                                            2⤵
                                              PID:3076
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
                                              2⤵
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of SetWindowsHookEx
                                              PID:5300
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
                                              2⤵
                                                PID:4884
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
                                                2⤵
                                                  PID:2540
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
                                                  2⤵
                                                    PID:5636
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                                                    2⤵
                                                      PID:5648
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,2561996317885760526,9229643034193827477,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5096 /prefetch:2
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:988
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:3584
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:2352
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                        1⤵
                                                        • Enumerates system info in registry
                                                        • Modifies data under HKEY_USERS
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:4016
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe628bcc40,0x7ffe628bcc4c,0x7ffe628bcc58
                                                          2⤵
                                                            PID:3076
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1736 /prefetch:2
                                                            2⤵
                                                              PID:2940
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2112,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2152 /prefetch:3
                                                              2⤵
                                                                PID:2084
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2300,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2272 /prefetch:8
                                                                2⤵
                                                                  PID:4080
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
                                                                  2⤵
                                                                    PID:2276
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1
                                                                    2⤵
                                                                      PID:5472
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4556,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3712 /prefetch:1
                                                                      2⤵
                                                                        PID:5580
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4880,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:8
                                                                        2⤵
                                                                          PID:6136
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4892,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:8
                                                                          2⤵
                                                                            PID:5100
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4980 /prefetch:8
                                                                            2⤵
                                                                              PID:5992
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5236,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4712 /prefetch:8
                                                                              2⤵
                                                                                PID:3676
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5240,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4380 /prefetch:8
                                                                                2⤵
                                                                                  PID:1852
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4448,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5080 /prefetch:8
                                                                                  2⤵
                                                                                    PID:4688
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5176,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5376 /prefetch:2
                                                                                    2⤵
                                                                                      PID:1564
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4644,i,8168624143763712620,4860402343730249471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5280 /prefetch:1
                                                                                      2⤵
                                                                                        PID:5724
                                                                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                      1⤵
                                                                                        PID:3160
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                        1⤵
                                                                                          PID:3640
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\PROCESO DE INSOLVENCIA.pdf"
                                                                                          1⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Checks processor information in registry
                                                                                          • Modifies Internet Explorer settings
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5384
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:6048
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=317360FC67E1A780BE560599390FA82C --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2228
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DBD5A451EDF3745BF6187F2A960ECB01 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DBD5A451EDF3745BF6187F2A960ECB01 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:264
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2CFC44D194F673DAEAF6FCD516D8A465 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:6096
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AACBEAE8BAE73D5F53B7353E76142415 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AACBEAE8BAE73D5F53B7353E76142415 --renderer-client-id=5 --mojo-platform-channel-handle=2480 --allow-no-sandbox-job /prefetch:1
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:4828
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=79872D61B44F69BD606A960081A720C7 --mojo-platform-channel-handle=2712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:5400
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=151434C6AD50AADA34EC773BF8388CC4 --mojo-platform-channel-handle=2460 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:5684
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:180

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                            Filesize

                                                                                            36KB

                                                                                            MD5

                                                                                            b30d3becc8731792523d599d949e63f5

                                                                                            SHA1

                                                                                            19350257e42d7aee17fb3bf139a9d3adb330fad4

                                                                                            SHA256

                                                                                            b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

                                                                                            SHA512

                                                                                            523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

                                                                                          • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                            Filesize

                                                                                            56KB

                                                                                            MD5

                                                                                            752a1f26b18748311b691c7d8fc20633

                                                                                            SHA1

                                                                                            c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                                                                                            SHA256

                                                                                            111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                                                                                            SHA512

                                                                                            a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                                                                                          • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                            Filesize

                                                                                            64KB

                                                                                            MD5

                                                                                            2ecf75c023157c1c6d68d7c7ddcddf75

                                                                                            SHA1

                                                                                            39147f16f57622f7d35d648e818a5b5af6d7db4e

                                                                                            SHA256

                                                                                            7ae334afec3ba364c117808a7dac977065b7ef4bbc398fc004a1bed32b805c95

                                                                                            SHA512

                                                                                            b87af5f8a83e3430e375b0ca209ecb29c9c1614fa2f38872250557632071dff96d0af15b6d7d85e07e57e265330eb3bb601463add465867a3edbc4e84bb4d793

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                                            Filesize

                                                                                            649B

                                                                                            MD5

                                                                                            eeb8534e51d2dcdd0a5fc5f9d670e577

                                                                                            SHA1

                                                                                            57dcb170ffeaf49026fe7e6a060c509fbe45891d

                                                                                            SHA256

                                                                                            8a283d74ee5cfb83a13ee16676126d858af928609ab51c5fb4394a0ec8b9b591

                                                                                            SHA512

                                                                                            2b66b542745294cb12646236e8d6f2bd28b69ff0d442de46fdd5ba959874983fd8beaaeebe6b3e6928b0bf614908bc592b7b4027bfb4faadaaa1fda0806cf9e9

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                            Filesize

                                                                                            192B

                                                                                            MD5

                                                                                            52b5af48d70d674416c46ac763f2cee9

                                                                                            SHA1

                                                                                            9bdbbd6e3a2161ad06ca6532ec6e5394420eeabe

                                                                                            SHA256

                                                                                            9d4eb118677b7f8c133578016ab5db73f5be39ec8687f156d1f54f76f62c5c82

                                                                                            SHA512

                                                                                            93e5ed2a05c2b85f9d657db581886360613cedac9f412baa4f3d2aabbdecfa28dc11b6f79b61c75679157375120978aa6060315bd10c86f4e00684c5d5b0bdd8

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json

                                                                                            Filesize

                                                                                            851B

                                                                                            MD5

                                                                                            07ffbe5f24ca348723ff8c6c488abfb8

                                                                                            SHA1

                                                                                            6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                                            SHA256

                                                                                            6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                                            SHA512

                                                                                            7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json

                                                                                            Filesize

                                                                                            854B

                                                                                            MD5

                                                                                            4ec1df2da46182103d2ffc3b92d20ca5

                                                                                            SHA1

                                                                                            fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                                                            SHA256

                                                                                            6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                                                            SHA512

                                                                                            939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                            Filesize

                                                                                            2B

                                                                                            MD5

                                                                                            d751713988987e9331980363e24189ce

                                                                                            SHA1

                                                                                            97d170e1550eee4afc0af065b78cda302a97674c

                                                                                            SHA256

                                                                                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                            SHA512

                                                                                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                            Filesize

                                                                                            356B

                                                                                            MD5

                                                                                            00156925feb90b5b647397ebba5e09dc

                                                                                            SHA1

                                                                                            bc4e3c3d7673a42833fd79b727b653564478b3cd

                                                                                            SHA256

                                                                                            62f177319b53e9de850eb827a66b4dcd3eda8f89571a40c713cbdb536d8235e2

                                                                                            SHA512

                                                                                            ce8ae01898e7bfd7fbb9dfe7ba9326e86eb06475c9d56da0e3b543aaaf3e9708b6c951263930646a5e56e7e237ab9943192662cfa2b7d4af07069a0bb64f291d

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\MANIFEST-000001

                                                                                            Filesize

                                                                                            41B

                                                                                            MD5

                                                                                            5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                            SHA1

                                                                                            d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                            SHA256

                                                                                            f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                            SHA512

                                                                                            de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            9KB

                                                                                            MD5

                                                                                            a41e40998ba621cab80d5678b61007bc

                                                                                            SHA1

                                                                                            ba9501aa68faacfe7c8bb7b979c8beeada1333e1

                                                                                            SHA256

                                                                                            0c5791764675d94aa645d22833fde6c56f68b5098d641009c3ab54f3decef288

                                                                                            SHA512

                                                                                            7e26ec9e57c762a4913ab664e9af1b291a3b0e1724b57f635224cd092b682e1f8c455277f5eee94ffa494d5eef1ea68955eb9833fecab4d0bfeecfd50078c4b7

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            9KB

                                                                                            MD5

                                                                                            7a33c5972aa02b1af080c411e92b95b6

                                                                                            SHA1

                                                                                            bb28889aa146f94d6b5f8e86de63665a60741598

                                                                                            SHA256

                                                                                            cde5880a1a8cc79f8476a30a43bafe8cbec64f3d24271ef72d35f2bb1524a517

                                                                                            SHA512

                                                                                            04b5e896d3c98fcd57ef383b6a21f84d5ec84ba6780ca134b82c568499ab8b3f7bd92598199d15537afe0a99209981f7489ea201dcf49ff5f8c631d165b00e62

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            9KB

                                                                                            MD5

                                                                                            42f8b7b6536e2dc33e280eb30dbba447

                                                                                            SHA1

                                                                                            936b27ff62dcd18772081c448fef4434ff132f8b

                                                                                            SHA256

                                                                                            25ec49bb7aeb3b681fbef77e19c02b71640e3d1c1fc994b5120ad7d018b529e1

                                                                                            SHA512

                                                                                            7cd9f26cac197746a1df4cabbde80eac38b6f790a7620393c4b8601b96f5b59f27c618e6086b3974e9455a06c2f6e2d9010c7ffa50fa32a22286963ca3a067ee

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            9KB

                                                                                            MD5

                                                                                            43967cc8b36331a6f5f26ba5caf86621

                                                                                            SHA1

                                                                                            f17b1399615efd1d9a6355fb7c345ec4a2f05583

                                                                                            SHA256

                                                                                            ab4c94340d7bc70e45df8d77ecec25f7a4375d3909667dc8e8365fda480ab24b

                                                                                            SHA512

                                                                                            6c10ab80e49be160fa503e48367e9071bf3adb8903dc1f337a4f68ee5fc23e00dd15e11840e409231f115f389681eef400a6b835bdada0ab164385d9a743ce0d

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                            Filesize

                                                                                            15KB

                                                                                            MD5

                                                                                            6855a5521757fc6c85afad5c8cc3510a

                                                                                            SHA1

                                                                                            85c04d39fd9e091dabe594f0279985bb3116244d

                                                                                            SHA256

                                                                                            94d65301a9ee770c187208780a229850bd802197e1750147337e5e3285464e03

                                                                                            SHA512

                                                                                            2618a719df326fd80be4297f310cb7eed8af8050218a459509e12f352a41a6dcc36ddc8fc938f2f5d30d64bda21c3b796ddc4ca7a9407a736c9ece9e2d1078a5

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                            Filesize

                                                                                            72B

                                                                                            MD5

                                                                                            921832cca1d24ba8dec00c002ecf8b85

                                                                                            SHA1

                                                                                            aba42a53096b6c89e1a5bf41b04f7ba2f0b155be

                                                                                            SHA256

                                                                                            e53a40559756199364639d8ee144a622126007ffa10fa55120db225d17df982c

                                                                                            SHA512

                                                                                            9789372e1909e51dee5661b59fd9ecd24f97bc86e981ef19b986a38d7e97c8bc1afd6cd208aa9e6171edf70435990b0a9d1ed9d3dc1d01b1d8e598f726d11577

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                            Filesize

                                                                                            231KB

                                                                                            MD5

                                                                                            fa0454185901160187e34e50cd31c904

                                                                                            SHA1

                                                                                            105d8aaa4dbbf50a6eb8c92233dd6c3535f81f69

                                                                                            SHA256

                                                                                            e846f309f6f170f6cdacd4d9d059d6ce1fcf7f7fc703a318e94a870cbe9c7849

                                                                                            SHA512

                                                                                            0767c9f3d76af503f3c60bf67c38ec5a4cdad19781e42de717984be3b3016a10d55fade6323afe2de97b67690dd7bb9988f56e9adfc33a7ce695911119f3c999

                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                            Filesize

                                                                                            231KB

                                                                                            MD5

                                                                                            796ea3f7862ce8045cdbdb501076c744

                                                                                            SHA1

                                                                                            1dfd884320cc2523a4c55ee8e04bc7094965d56d

                                                                                            SHA256

                                                                                            1008809715c79a05671285d89d6b428f634a8e44aba8413590b34967b871726a

                                                                                            SHA512

                                                                                            183f7f409c34fb912606f38346c617c925966b0ca97951cf0f8dc79fd0978f6b8085f0ff7c523bfd7b08197b3563e9600817072378eab7755402a35ee1dffb88

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                            Filesize

                                                                                            152B

                                                                                            MD5

                                                                                            99afa4934d1e3c56bbce114b356e8a99

                                                                                            SHA1

                                                                                            3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

                                                                                            SHA256

                                                                                            08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

                                                                                            SHA512

                                                                                            76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                            Filesize

                                                                                            152B

                                                                                            MD5

                                                                                            443a627d539ca4eab732bad0cbe7332b

                                                                                            SHA1

                                                                                            86b18b906a1acd2a22f4b2c78ac3564c394a9569

                                                                                            SHA256

                                                                                            1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

                                                                                            SHA512

                                                                                            923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

                                                                                            Filesize

                                                                                            68KB

                                                                                            MD5

                                                                                            f26bbba7e176ea7ee28bb8d1bb559e46

                                                                                            SHA1

                                                                                            04efbece4b8f5160b177211e1451a649b844b775

                                                                                            SHA256

                                                                                            e1fd5de2bdb5c05b81918158dd6f841338028f72ceee214de7c67813ed2a8155

                                                                                            SHA512

                                                                                            c23a748d54d6829127e50a912a0af1f8e9e611bb919a972697a0e71ba812843dc51642f4d72dfae6b6cfdbc65503828456a7773338e1fa83a2d88f889741fd45

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

                                                                                            Filesize

                                                                                            62KB

                                                                                            MD5

                                                                                            c813a1b87f1651d642cdcad5fca7a7d8

                                                                                            SHA1

                                                                                            0e6628997674a7dfbeb321b59a6e829d0c2f4478

                                                                                            SHA256

                                                                                            df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

                                                                                            SHA512

                                                                                            af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

                                                                                            Filesize

                                                                                            67KB

                                                                                            MD5

                                                                                            b275fa8d2d2d768231289d114f48e35f

                                                                                            SHA1

                                                                                            bb96003ff86bd9dedbd2976b1916d87ac6402073

                                                                                            SHA256

                                                                                            1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

                                                                                            SHA512

                                                                                            d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

                                                                                            Filesize

                                                                                            19KB

                                                                                            MD5

                                                                                            2e86a72f4e82614cd4842950d2e0a716

                                                                                            SHA1

                                                                                            d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                                            SHA256

                                                                                            c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                                            SHA512

                                                                                            7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                                                                            Filesize

                                                                                            63KB

                                                                                            MD5

                                                                                            226541550a51911c375216f718493f65

                                                                                            SHA1

                                                                                            f6e608468401f9384cabdef45ca19e2afacc84bd

                                                                                            SHA256

                                                                                            caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

                                                                                            SHA512

                                                                                            2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

                                                                                            Filesize

                                                                                            41KB

                                                                                            MD5

                                                                                            e319c7af7370ac080fbc66374603ed3a

                                                                                            SHA1

                                                                                            4f0cd3c48c2e82a167384d967c210bdacc6904f9

                                                                                            SHA256

                                                                                            5ad4c276af3ac5349ee9280f8a8144a30d33217542e065864c8b424a08365132

                                                                                            SHA512

                                                                                            4681a68a428e15d09010e2b2edba61e22808da1b77856f3ff842ebd022a1b801dfbb7cbb2eb8c1b6c39ae397d20892a3b7af054650f2899d0d16fc12d3d1a011

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

                                                                                            Filesize

                                                                                            215KB

                                                                                            MD5

                                                                                            2be38925751dc3580e84c3af3a87f98d

                                                                                            SHA1

                                                                                            8a390d24e6588bef5da1d3db713784c11ca58921

                                                                                            SHA256

                                                                                            1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

                                                                                            SHA512

                                                                                            1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            c1d556828804d23be3c08095ce2ab9b0

                                                                                            SHA1

                                                                                            25e24ea10c079aee4543ec840a21554d96aa646c

                                                                                            SHA256

                                                                                            2f71a5925f5173d6fd3ceffbbd63b23930b6cd8a8dd3f5f98d09e83453fe6c3b

                                                                                            SHA512

                                                                                            f473ba80baebab13529f286279af93e6cc012ee1b6b618a16d1bd20f2c26a29d868d487b30e480932982d673a6cbb522449405f73a40c170a5a61bfd225dc944

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                            Filesize

                                                                                            480B

                                                                                            MD5

                                                                                            5be823e754fc25bb15f1a4b579b6b677

                                                                                            SHA1

                                                                                            381cfc0ff13bc5278b7b02c480aa95560d6c00c7

                                                                                            SHA256

                                                                                            920e3681ee17f448dda4fb2e4dd201b1d8687ca963947c02a2e4082f6c935ca8

                                                                                            SHA512

                                                                                            927f74ac0ac5ea2d6aa5fb4b50f57c9fe9b702e23f7e1fd531684b7a16f358d673bb8a4025b720b9b76bf19f47fa5dad0356aba8b5b9b890d29009cce7b688a2

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                            Filesize

                                                                                            4KB

                                                                                            MD5

                                                                                            19df61f8ce3f47055c9629d4b030b195

                                                                                            SHA1

                                                                                            2e14672613f134cc9a05c3115e977af5f7d72200

                                                                                            SHA256

                                                                                            cc711f9cfae801196316d09dce043d9818bd775bcb3ec65bf533541dee8da537

                                                                                            SHA512

                                                                                            1bfab863ef1714ba12c54142e0e2c608297a62375102682709b364c760eeac458f191787925903bd74e31802b645095467c3f98daf6f7d886761b33cc070acfd

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                            Filesize

                                                                                            5KB

                                                                                            MD5

                                                                                            14db9373a6d0333af3125ae07d0bdcbb

                                                                                            SHA1

                                                                                            66c230013320f8196636efe4d0b026f3e367a829

                                                                                            SHA256

                                                                                            96cb18ed2adf6b0243573319f8613c1b20285adc5a8683fdd6767a9472ef79ec

                                                                                            SHA512

                                                                                            de563e061a41b4ebf7251819c684ee3324574dad59f7f5961e1cfe9ed5a7f8cb1f9c8f64d82baca61311bfe573f1ad5471ee07452f2317fb1dd98fd106bfbb5e

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            9KB

                                                                                            MD5

                                                                                            c30174bb264743f0363933fbe7f43b01

                                                                                            SHA1

                                                                                            86c5f0e14a82194df6ab843dd1b416c10e83434b

                                                                                            SHA256

                                                                                            ddc77ba5f5a8c51aaf2ff00f9f6072766b14d4cbe8212814e4a0ff0cf6f17b3f

                                                                                            SHA512

                                                                                            1edd326854e606399c4af2af0715385d15c743c8b456662a44baac7f90238177bfe33825a7bd60b214e6bff4d6ccc93cd7aef8d937744b05327368ea4c5af0cd

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            326eb645db922f9309b83fe1847de67b

                                                                                            SHA1

                                                                                            537da06aab51a16d8520840d3310accc898c5ca8

                                                                                            SHA256

                                                                                            ed18b577fa02a85dc4bc712c6ded2612047bb1751d5b9720fefb390945a61db7

                                                                                            SHA512

                                                                                            d82d3c2154249f6ffaa514df2b1af157428f51b57e267dade9372eeaf7ea905c9c1b596dfe7f52a34bfd158720cc44b36fe01e38133b366675144fb4d8c5d9da

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            8KB

                                                                                            MD5

                                                                                            95c99d2ad87764ee088041f877f69059

                                                                                            SHA1

                                                                                            6953cbaaffa6af4adfb23c5c5b56e9a29a60c3d3

                                                                                            SHA256

                                                                                            7b977cebc73969fee0c3b3873ea62f44db56da1b06e1a758af32d4d2f7d366de

                                                                                            SHA512

                                                                                            fc1fed856e13ab8ec69daa1aa7bc23802783cc75c4d10963a7597757100f1dd533c0690baee596f6141567a9859ed79e6f4c8352ed81ce05eac296ca80213f19

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            d8a89f67c3be7dd7be5c7121f4a5e9e9

                                                                                            SHA1

                                                                                            681ecdcf2f7b0837dc625d471b1709c339f17dc9

                                                                                            SHA256

                                                                                            56fb369ef57acbdbdf3c3df946b05eacf3cfad0f4033b11ab2649e2f3128a68b

                                                                                            SHA512

                                                                                            6b53a0d4037b678404986fbab5ffad845e7bb4afe81c2618f0732e67509a99cbcf05e5313ab75f5bf49d3c4acaa9c516546ca283625f240eccb3a7701b612dc0

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            5KB

                                                                                            MD5

                                                                                            c4a4625c2cd0b0504a53115d190c274e

                                                                                            SHA1

                                                                                            a744e48a26e0ac85a65e619de04adaa3b2cdbe59

                                                                                            SHA256

                                                                                            01e0f01c35178ac2b5cee4988cb3cabf3f5fdcd33559bb9891b4efd389833a67

                                                                                            SHA512

                                                                                            1586da2de722e50fc82aa96a9ff24db9f0703fdccb866455c5076f322ff3ac34f0bc7bce86d3530b8e5706cd1ead5f756fc5246a7fb97f49558682c5dab96835

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            c31de9d82a6831e618cc6681fb2f0de7

                                                                                            SHA1

                                                                                            43fa0c43d861d208381e6c7c89f19da29fb351cc

                                                                                            SHA256

                                                                                            4a45c1250571f9902bf6756035aa29fb5fbc9a90a909ac86d8b16fdb944aad5e

                                                                                            SHA512

                                                                                            48c919506fdf67d4e307ce34c26a6a6b8dfe15cb1282b046669d6b4966a2077c76797386577c52e884f1b2864dbe61462878183b2cdd832499ecd324909110e0

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                            Filesize

                                                                                            72B

                                                                                            MD5

                                                                                            8a86514966f91ed8ef6e3b2dcf8808fb

                                                                                            SHA1

                                                                                            49f0abf4ab2322b0f449bcbb2f1c58e4128c1b47

                                                                                            SHA256

                                                                                            1d108479b6f0094acef835d8bcfdaccff32e51843ccc016771a0269763516e7a

                                                                                            SHA512

                                                                                            3a38ec6e61de162bcac78800e5844275ea2a1adab29089e99b6bbb93f02077bae709a94615f82a5b45d2649b176787bf770e0750b1bd1425f25b076be93f7499

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f4bb.TMP

                                                                                            Filesize

                                                                                            48B

                                                                                            MD5

                                                                                            5386a57e4ebb8c1f1e9cde348621ea51

                                                                                            SHA1

                                                                                            e7758f3917d73147b254894467ac6dabc9d4170f

                                                                                            SHA256

                                                                                            069cb84fbca23080c80bba07e9b8e233f2b1408838430049a2a875db621bec83

                                                                                            SHA512

                                                                                            099adf7abfa7461cd63e9f13835b29b6dec656d176f0023d29f39e3d5142d35a78099001aeda9e97b60840097f858902cf6868b58fbe6d635308bdee10125ed0

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            029f473e72e1989f9d58742cca3112af

                                                                                            SHA1

                                                                                            9a1259c5e537ea1226e462ca3463d119cfee7353

                                                                                            SHA256

                                                                                            bc7a59e7d3a2b40a80973f29c66750a2e3db9de568e0fd46c45e5eeca2155391

                                                                                            SHA512

                                                                                            c91bf15934d9d7a8803d5bb2fb4fafa7e8820bbd8f7eb8ab5c4b4d82934943a5d5e3640ded5de42f1e37ed1edff9f40ea7df89500f0d068eee0e248d0ece3938

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            0f0c31bbae5015f3eac67f234a9d1fd3

                                                                                            SHA1

                                                                                            36fd55420016b65c598389d7c7ba693d4aaedaab

                                                                                            SHA256

                                                                                            f3aa471bab8338f20384bf6485306ce31ad0cbf10018fa2a4d0845275021b0dc

                                                                                            SHA512

                                                                                            01b7eeb9e47986511dacb2f160a9af65517eaa07ec957732dcd6e39d075df0800c2a4e09ce904ccd8b34d215ebc089467c69e23a11f615a8d9c391d8ff01565e

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58917d.TMP

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            69e5f614c3acb548f2448cf37ed61ce6

                                                                                            SHA1

                                                                                            5a25c23eb0b309f34fd6c9481a469fd05cd344e4

                                                                                            SHA256

                                                                                            158850b55237aa169142ffef35afcc0e0eb0994314665444409d6c72a342c07e

                                                                                            SHA512

                                                                                            37b3d2132e9d499e3e1509877d4ee947ec9ad114f879fc008df7df539bf3f5e938051ca70f9009886f14957aa22f30d2213d9d1d773b74b480077702184e903e

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                            Filesize

                                                                                            16B

                                                                                            MD5

                                                                                            46295cac801e5d4857d09837238a6394

                                                                                            SHA1

                                                                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                            SHA256

                                                                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                            SHA512

                                                                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                            Filesize

                                                                                            16B

                                                                                            MD5

                                                                                            206702161f94c5cd39fadd03f4014d98

                                                                                            SHA1

                                                                                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                            SHA256

                                                                                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                            SHA512

                                                                                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                            Filesize

                                                                                            11KB

                                                                                            MD5

                                                                                            0442b2e032efcf0a527bcaf84f294d14

                                                                                            SHA1

                                                                                            1aead8e9f925e15587ae7d4fd131f1817da7e3c6

                                                                                            SHA256

                                                                                            eda5ee0c18c15d8e9fcc6585265d7516808cbd14f78b283731decde28e70db64

                                                                                            SHA512

                                                                                            a8a16aebe8ef9adb1038b03c1136d5f678e0f40ad34a159df6b782fe7af34d4a527cc23dc526d15813b0a15709a2e5da38dacfa75a8bd6564c0eb99d12b2af7a

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                            Filesize

                                                                                            10KB

                                                                                            MD5

                                                                                            7c663813993ec01bcf0404a75ee5541a

                                                                                            SHA1

                                                                                            1be74044c931217c5c611329e8462be6ecc880d2

                                                                                            SHA256

                                                                                            ba4d5fae51d8813635010d8eb0e56a0c81778e1e2278f329cf29bf53d95c96ab

                                                                                            SHA512

                                                                                            de93cdefec5e7f8ec14923f2ab8cbc9e937e8941ca7af2018d2dee7bf5ed36e0098ef93467534e44801586484af173e9759bef04220333726bca76835c89f01e

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                            Filesize

                                                                                            10KB

                                                                                            MD5

                                                                                            17820ce85714be7375634f22c959eb29

                                                                                            SHA1

                                                                                            d960a0d48d9659c855f630c87d8e264f41db0ed7

                                                                                            SHA256

                                                                                            3f7679e0a4d3814df4ca1992c0b7d95a78ffaf14b47f45784200db8e1c2144bf

                                                                                            SHA512

                                                                                            3c1960c580d9409881f9b086ae49a909d34efde2abd3a23bb2c74d0269de1bdf6fe4ce555896f3ea801c7bfd0057345cdf0ff8d8ecc269d7de63d98be3a9f032

                                                                                          • C:\Users\Admin\AppData\Local\Temp\64f8380c-cfc7-417a-8df1-1bb391c6731a.tmp

                                                                                            Filesize

                                                                                            1B

                                                                                            MD5

                                                                                            5058f1af8388633f609cadb75a75dc9d

                                                                                            SHA1

                                                                                            3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                            SHA256

                                                                                            cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                            SHA512

                                                                                            0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                          • C:\Users\Admin\AppData\Local\Temp\scoped_dir4016_1866463605\47b15e8c-c3a5-4e72-81ea-af60300e336a.tmp

                                                                                            Filesize

                                                                                            135KB

                                                                                            MD5

                                                                                            3f6f93c3dccd4a91c4eb25c7f6feb1c1

                                                                                            SHA1

                                                                                            9b73f46adfa1f4464929b408407e73d4535c6827

                                                                                            SHA256

                                                                                            19f05352cb4c6e231c1c000b6c8b7e9edcc1e8082caf46fff16b239d32aa7c9e

                                                                                            SHA512

                                                                                            d488fa67e3a29d0147e9eaf2eabc74d9a255f8470cf79a4aea60e3b3b5e48a3fcbc4fc3e9ce58dff8d7d0caa8ae749295f221e1fe1ba5d20deb2d97544a12ba4

                                                                                          • C:\Users\Admin\AppData\Local\Temp\scoped_dir4016_1866463605\CRX_INSTALL\_locales\en_CA\messages.json

                                                                                            Filesize

                                                                                            711B

                                                                                            MD5

                                                                                            558659936250e03cc14b60ebf648aa09

                                                                                            SHA1

                                                                                            32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                                                            SHA256

                                                                                            2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                                                            SHA512

                                                                                            1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727