Resubmissions

04/03/2025, 16:36

250304-t4hcjavry8 4

04/03/2025, 16:25

250304-twxr9avtbv 6

04/03/2025, 15:38

250304-s3h21avjt7 10

04/03/2025, 15:35

250304-s1s47atrz7 4

04/03/2025, 15:32

250304-sysewatvb1 4

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250217-en
  • resource tags

    arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/03/2025, 15:32

General

  • Target

    nezur-faking-unc-v0-9bo7ts6at0od1.webp

  • Size

    176KB

  • MD5

    d444757770ebee84843f2922c430a3b5

  • SHA1

    ae36d68db168d69bfe90fb22f703b638070b7d8d

  • SHA256

    20be8d6207184dfd8d235813a15943d41c17434c5ba8d044f182161dca2b33a2

  • SHA512

    a242ab595865991219f8e82a1d1d4c5d01d71a308a8e4ddc4b3746cd199f7890c1c283ba9c815977938a474046d089c05b4490e5323c225d8412f0340418d314

  • SSDEEP

    3072:8ihYfiRKLglPj0xMczOFm2HYyEOEvnYONFs8jNDGCsekDyJNO3:Vh67glPj06KOFFHYyEpnLNZBrhA

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\nezur-faking-unc-v0-9bo7ts6at0od1.webp
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4624
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7dfacc40,0x7fff7dfacc4c,0x7fff7dfacc58
      2⤵
        PID:4248
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1832 /prefetch:2
        2⤵
          PID:3856
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1412,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1868 /prefetch:3
          2⤵
            PID:4648
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2180,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2432 /prefetch:8
            2⤵
              PID:2576
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3108 /prefetch:1
              2⤵
                PID:1268
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3096,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3252 /prefetch:1
                2⤵
                  PID:4044
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4596,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4632 /prefetch:8
                  2⤵
                    PID:4604
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4720,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4784 /prefetch:8
                    2⤵
                      PID:2192
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4800,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4784 /prefetch:8
                      2⤵
                        PID:3280
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4904,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4672 /prefetch:8
                        2⤵
                          PID:3996
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4748,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4780 /prefetch:8
                          2⤵
                            PID:1692
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4584,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4660 /prefetch:8
                            2⤵
                              PID:1048
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5024,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4972 /prefetch:2
                              2⤵
                                PID:484
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=212,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5092 /prefetch:8
                                2⤵
                                  PID:2848
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5108,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5088 /prefetch:8
                                  2⤵
                                    PID:1232
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4552,i,5754871414153540879,9210571435952144830,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3492 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2032
                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                  1⤵
                                    PID:1288
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:3952
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                      1⤵
                                      • Enumerates system info in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:1884
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff7b4f3cb8,0x7fff7b4f3cc8,0x7fff7b4f3cd8
                                        2⤵
                                          PID:3440
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1972 /prefetch:2
                                          2⤵
                                            PID:2572
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4384
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
                                            2⤵
                                              PID:972
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
                                              2⤵
                                                PID:3288
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
                                                2⤵
                                                  PID:3160
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
                                                  2⤵
                                                    PID:2912
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
                                                    2⤵
                                                      PID:2064
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
                                                      2⤵
                                                        PID:1572
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
                                                        2⤵
                                                          PID:1352
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
                                                          2⤵
                                                            PID:3296
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
                                                            2⤵
                                                              PID:4840
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
                                                              2⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1364
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,17128775216576124846,6038978427976648436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 /prefetch:8
                                                              2⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4536
                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                            1⤵
                                                              PID:556
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:3248

                                                              Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                      Filesize

                                                                      64KB

                                                                      MD5

                                                                      b5ad5caaaee00cb8cf445427975ae66c

                                                                      SHA1

                                                                      dcde6527290a326e048f9c3a85280d3fa71e1e22

                                                                      SHA256

                                                                      b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                                                                      SHA512

                                                                      92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                                                                    • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                      Filesize

                                                                      4B

                                                                      MD5

                                                                      f49655f856acb8884cc0ace29216f511

                                                                      SHA1

                                                                      cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                      SHA256

                                                                      7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                      SHA512

                                                                      599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                    • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                      Filesize

                                                                      1008B

                                                                      MD5

                                                                      d222b77a61527f2c177b0869e7babc24

                                                                      SHA1

                                                                      3f23acb984307a4aeba41ebbb70439c97ad1f268

                                                                      SHA256

                                                                      80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                                                                      SHA512

                                                                      d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                      Filesize

                                                                      649B

                                                                      MD5

                                                                      fe9b22649c5ddec2c18f1a78859f839f

                                                                      SHA1

                                                                      6c229c94c939b9a5e4b814fe08302a17da26e67e

                                                                      SHA256

                                                                      5bf6aa74fb5ec8c4b1de271594a7f50b8b966d45849d746803944e54bc2d5294

                                                                      SHA512

                                                                      025f08283a26d6102c84b07f990b84c1643dae2931b4170095c2719b1fc61db1e435194204f7aaef5636ce7172576c3c73305ce076adcc4e96e5ce00698960cc

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

                                                                      Filesize

                                                                      851B

                                                                      MD5

                                                                      07ffbe5f24ca348723ff8c6c488abfb8

                                                                      SHA1

                                                                      6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                      SHA256

                                                                      6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                      SHA512

                                                                      7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

                                                                      Filesize

                                                                      854B

                                                                      MD5

                                                                      4ec1df2da46182103d2ffc3b92d20ca5

                                                                      SHA1

                                                                      fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                                      SHA256

                                                                      6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                                      SHA512

                                                                      939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      05be90a299a109ea281d962a1983bb77

                                                                      SHA1

                                                                      6ed9dae0ab9c51b89a902765daa9d0687ecbe30f

                                                                      SHA256

                                                                      8cc1248f4d20239fdaaee78731adf80de4d8dbe4c2bb705454ccb5e1a97d207a

                                                                      SHA512

                                                                      65e8e1551f065f9889165a84997b571745d22bfdb7e6c840640ef0cef2d69653af8f6eb7e30d11d447300ed6a52e4b8621a7d522c553a2181e205614d9faeda3

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                      Filesize

                                                                      2B

                                                                      MD5

                                                                      d751713988987e9331980363e24189ce

                                                                      SHA1

                                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                                      SHA256

                                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                      SHA512

                                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      f947a7d05d290534ba1da8a6beddb4ea

                                                                      SHA1

                                                                      e50f1647a8fd0675cacd8ef787c86c81757d89e8

                                                                      SHA256

                                                                      ce37c44725df33b947be2c0d3fd1fd575530a16efc646f9c01f74460ba11b8a0

                                                                      SHA512

                                                                      42db2565539bb71411b9dba276e0a81cde058652dcbf0baf240f3ac11b91bf92659b18d3ed5ef8ae754d19e8210d5a6dac8d9c50195cca89ca56bf73d11309a7

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      a41327315be9833d3d6aae1522abc77c

                                                                      SHA1

                                                                      b2d1f1c23c49a1b7c679d08a069e2fb964ba936c

                                                                      SHA256

                                                                      ba1e675a61ea4658aa9e34c6e3734a2a2e000ca0241d1d8b57f7ad5796a1655e

                                                                      SHA512

                                                                      f94f3dfe379afe080eb7b0373843d58981ac3278e546d6e1fbcf12ea84109879aee55b3941e7a24ce01d029b12dac9a19e548fc68b66634e946bc4f7d2c26317

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      68367380b6d00cfdac9b3be04f5e1ef1

                                                                      SHA1

                                                                      77e1bb396a9852d7d796055dbb24ed2ec8169aa4

                                                                      SHA256

                                                                      b09bf4013347f3868ae9130dfe4cf571c3af77d753a9591c3fcc22415afc51be

                                                                      SHA512

                                                                      3d7851be5da3555f93d60065583370d24f1d36e8d22e3252a0c0b5d09a57279e7d561ac47f244797155bef5efebd00babe84d9011431bd0b26e5e13676d5dd23

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      43f1238bf39abd7b57c1c950b25a7d9c

                                                                      SHA1

                                                                      7144a885059f637926a1fd4dfb9a370b703ee320

                                                                      SHA256

                                                                      b9009ec776770aa2930cbbbce7ea948006578a46f63b409dcffb3ba6f209e5e7

                                                                      SHA512

                                                                      e78ec78f0872a1bc4b6462b280876507e379164950a48055ebc507e6dff476504087810c8538145b8839c3c4855f442f5c6e606e6feef18004e6fe6a986fc162

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      05c3dd74e1004a70904df8cbdf9c5f03

                                                                      SHA1

                                                                      28c59b0c53562688081747ecbbe018ad5e76f5a2

                                                                      SHA256

                                                                      6ac5d94f692ad4763c109aa4fb5a7dc8751508f55a09e8ac14ddadd9e69c2488

                                                                      SHA512

                                                                      f84aec6b8148afa5ace383985e5aed82b01ce67e709a7b624f7983124a5f9053f1fb393d1dee7d3bf2e726b16591d88d46c0ef08920d5523142f0298501cd079

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      8d497f5b2b53a93f52c21796f0940f4a

                                                                      SHA1

                                                                      8f6281e2a0a3c2daf30f1c85c683ed4de22ce7d1

                                                                      SHA256

                                                                      ab210c3b44e498382588c68b677b2792cd5488f39788be23a8659d8731454401

                                                                      SHA512

                                                                      52c2650fd4dc377063d18ce1def2bfc4028252d714f9b32fb349900de826d82a92a99f41bf06d61879c8f949b57c87534f1695af357a75662bf752c094b3d577

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      2ba4feb3989b9dca15cbfeb99415ebc0

                                                                      SHA1

                                                                      12015b093f4ee00768876f322c4714aefbde20be

                                                                      SHA256

                                                                      acdd4c854186db0a29df774df4f1db5374fd58ec73f7d13a96e438ab3c7536c8

                                                                      SHA512

                                                                      3fa47f06eadd44e89594bc8c5c0fc814c2bc28889729049603c7e1ed881feb82abc138e9883e1b3b7541de6a715915d0aa22f1f4feee517cbd4656f1ee9fe62c

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                      Filesize

                                                                      15KB

                                                                      MD5

                                                                      3f33085aadcb8643f351f9de207ef1ce

                                                                      SHA1

                                                                      2213d4f21d3f2a18cc1af2e7f3a037b887011586

                                                                      SHA256

                                                                      2ea5753ff63378f7eb50760365ef351d5975e0525ca8b3e817d8c45d2ce423fa

                                                                      SHA512

                                                                      a5c8d137c5285e540549b44978a22a7de8b674afbd362e507083a30cb554d1685cee8b06520291b27fc2584ba8c51192d94a65dcfb5924658657bd907ad079ce

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                      Filesize

                                                                      72B

                                                                      MD5

                                                                      afcf3a9752679cd13831b9d6178b4891

                                                                      SHA1

                                                                      89c4822a20558ef96a1025abd35ea4bd58b73e40

                                                                      SHA256

                                                                      80680dfb36829a8261d041cc43245f420e88a561c1e3a2614898bf4d442c93e6

                                                                      SHA512

                                                                      b854f740fd4676954e86e07e37af54cb186996fbd283ac8e72691667e45836f1a5299ada175030b3220b3e92069c593a9f88053f8a836bf6a7dab0161f14233a

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                      Filesize

                                                                      246KB

                                                                      MD5

                                                                      fe9c85cca1fbac9910c6df4c40fb28af

                                                                      SHA1

                                                                      0d4a6f8573b0c47769f7c7b7ea421d9ccb8d2355

                                                                      SHA256

                                                                      bb7f73d7c2b36546067cb04ff5a87442b394b564d4aa009241b99ed14c397825

                                                                      SHA512

                                                                      e51c22614adb823cd7e591029c5299e3eb9619fea37251caf69ae3c516bd92c84034d055cb57ebed1b4016bef940d4ae023daf32778ee002530ff521f508c191

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                      Filesize

                                                                      276KB

                                                                      MD5

                                                                      df0d06a13461c40518e13d71b7ee0211

                                                                      SHA1

                                                                      fd34e031eba4c345482badb55310abea99919667

                                                                      SHA256

                                                                      770fd74a6e9a89c59bc0e055783f2f1f3e89633a316c87c90eb30b2723812afc

                                                                      SHA512

                                                                      9ba2128a5e470c552feb0a041ea9ea90cf851cb5c7dbed6b83b0699b38b17afbda2a0aaf2b17755d96380260b7c09eb07ce90f7894ea93c5e936c9438c3efaa9

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                      Filesize

                                                                      246KB

                                                                      MD5

                                                                      a672617d3c9815410194856bceb726ab

                                                                      SHA1

                                                                      af493afcec335924eb8e6b8449f32d31d0fbda4b

                                                                      SHA256

                                                                      9fc5a163c676f05769cc4f50e85e684b45fb3d717afdab68d15f23394e15aa9a

                                                                      SHA512

                                                                      1bd0075d3c1f1cbe939cc670af306ce9a5fdc6f4e30bdfa027dca7096bda8858d12bc5e23b37dc26ff79c968136938d61f7bd813648625452218c625688169c2

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                      Filesize

                                                                      246KB

                                                                      MD5

                                                                      e6ecdb5ac87b6c89fac5d0310e9a52cf

                                                                      SHA1

                                                                      27356da8e18221348eb989b50642c45fbe9023c0

                                                                      SHA256

                                                                      96dbe33509bb8ed93aae056c681bfbd8b6530e24355aa9437c2daf63fb367295

                                                                      SHA512

                                                                      39a706dba730efc5420f8cbbc02e0606aed9f63aefabd23e13c700b287d2a0995e3c4e6af16659d141533e39fdd2eee0303c0b914728665ce752106ae85f0656

                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                      Filesize

                                                                      124KB

                                                                      MD5

                                                                      bbbae87476f0b7f0ba5ed7222ad6ba09

                                                                      SHA1

                                                                      4a363e896bc117e70c2a11f2400de8697caf35fd

                                                                      SHA256

                                                                      cfcc4939f4c2948ac444dd2e53439fb2a211be24b8e119c33c41a541c731b2d2

                                                                      SHA512

                                                                      79876ab9188ec3e60c4def0f2adef3e2779b60360de86dc7f31d54e300a6d4bd251d84a8bf94c45a3d6e204fe17133c2428532332b6d6eb5b72ce855f856871c

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      648295913e8e74a91d84a0bd6dfa0efe

                                                                      SHA1

                                                                      e42c17ec7e237fa16204bd204ba0d47c2e7aa057

                                                                      SHA256

                                                                      3f46ccf49be312c1e7b3cd94ff1d27970975d6a80e052769daf31c772adb260c

                                                                      SHA512

                                                                      6e3f03fade65388ad14c2443300f79d028986a7863d32ad731a3b1aef4bc4937e7cb150c814947befdf4d2a8510f70368ad35621ae854b9037e46488df7423e2

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      fe68444a298dfe7ce3afb15e1e04dc2d

                                                                      SHA1

                                                                      ce8500b8bc9f8033bf5f6b28174d04852e996cde

                                                                      SHA256

                                                                      4fa17fcbb66e9306869abf881cf02c7b890bd34c34852c8a8f0e276bab375ba0

                                                                      SHA512

                                                                      ed3aec46de266977a45e00363f3e258e53e9763fd5304861d2a7582344f6364f9dba20d5a13e6c2eee42e6bb875eec2f3e900f45cc64bf911e7055008c2374c4

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                      Filesize

                                                                      5KB

                                                                      MD5

                                                                      3c8dd7cbb00ce9a766e0ca4c3df7c868

                                                                      SHA1

                                                                      fb27fedb281b16dae2c674333ffc637fe76f8064

                                                                      SHA256

                                                                      338160eb150016da7b0728d04c3a9da83fd68b049d1bdfab7eca70bb912e02f8

                                                                      SHA512

                                                                      e42b4a3be169cd9ce224f6bb213e23260d0d38bd01d3b537f4d467957207109e71fdcee74cd05df7163307c204cf984670b6402634249d409d2b4a22c3d43b6a

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                      Filesize

                                                                      5KB

                                                                      MD5

                                                                      4eeca2e35d48a04abf80039e3462d433

                                                                      SHA1

                                                                      14cd55000a607a6be40376ae62ff82af5b0040a4

                                                                      SHA256

                                                                      9d560e5998851f459e22c172ce2b7567b1cf5a11c766b676291bca5aeb567411

                                                                      SHA512

                                                                      2e110f8f41f387ff1dc2d728803c98e7f8a1692ba3a429f1c3fedb7d9a62d5f7f41e5d0c66c75d7e3ba8c51c42adab46564a2c8249a2a41fa7d9a64dba4b979f

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                      Filesize

                                                                      5KB

                                                                      MD5

                                                                      92bcff1b7a5db020859406ecb32817f8

                                                                      SHA1

                                                                      2d35ba1e97a4eeb367cbb3ade2e2f8c7171a3dc4

                                                                      SHA256

                                                                      4b722f38f5268000d4626c775d21d9a05efd54f59a0cc10ef2d63acd6ee42939

                                                                      SHA512

                                                                      d86fdc5db81d4e0ebe0ae34cd58145aa2156124cd5be6b525e184cba7f1379b8988c87391e51cc9733ce3efa0883242c4b4dd7990f2a14b6c78eb3caef9ad2c6

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d930e395-c341-47ef-aa49-740a1e567a06.tmp

                                                                      Filesize

                                                                      1B

                                                                      MD5

                                                                      5058f1af8388633f609cadb75a75dc9d

                                                                      SHA1

                                                                      3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                      SHA256

                                                                      cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                      SHA512

                                                                      0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                      Filesize

                                                                      16B

                                                                      MD5

                                                                      46295cac801e5d4857d09837238a6394

                                                                      SHA1

                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                      SHA256

                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                      SHA512

                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                      Filesize

                                                                      16B

                                                                      MD5

                                                                      206702161f94c5cd39fadd03f4014d98

                                                                      SHA1

                                                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                      SHA256

                                                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                      SHA512

                                                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                      Filesize

                                                                      11KB

                                                                      MD5

                                                                      e39a84c3628e670103fe705f56c70cbb

                                                                      SHA1

                                                                      9ea699976c30cfbaa66f45924c2ad2f823a632d0

                                                                      SHA256

                                                                      f0d56e9a761662ca1dd980012005c5a782b66b045a1c8338a8057b21722d0fec

                                                                      SHA512

                                                                      b63f3d6c4662cb03052d5bd1ed159f2b44cd415efff9c7eba029bf018b82502063e6e00486d862da5b25971a12851107427c940fab16f4368a05177e1915141a

                                                                    • C:\Users\Admin\AppData\Local\Temp\scoped_dir4624_1221534763\CRX_INSTALL\_locales\en_CA\messages.json

                                                                      Filesize

                                                                      711B

                                                                      MD5

                                                                      558659936250e03cc14b60ebf648aa09

                                                                      SHA1

                                                                      32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                                      SHA256

                                                                      2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                                      SHA512

                                                                      1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                                    • C:\Users\Admin\AppData\Local\Temp\scoped_dir4624_1221534763\ec61430e-65ce-419b-adf3-559081a4fa7f.tmp

                                                                      Filesize

                                                                      150KB

                                                                      MD5

                                                                      eae462c55eba847a1a8b58e58976b253

                                                                      SHA1

                                                                      4d7c9d59d6ae64eb852bd60b48c161125c820673

                                                                      SHA256

                                                                      ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

                                                                      SHA512

                                                                      494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3