Analysis

  • max time kernel
    412s
  • max time network
    414s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250313-en
  • resource tags

    arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28/03/2025, 20:39

General

  • Target

    https://getswift.gg/download

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

  • Downloads MZ/PE file 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Themida packer 33 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 52 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://getswift.gg/download
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2b0,0x7ffae94af208,0x7ffae94af214,0x7ffae94af220
      2⤵
        PID:4320
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1804,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
        2⤵
          PID:432
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2184,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
          2⤵
            PID:4428
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2220,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:13
            2⤵
              PID:4604
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
              2⤵
                PID:1464
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3452,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
                2⤵
                  PID:1888
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3988,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
                  2⤵
                    PID:3628
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4164,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:9
                    2⤵
                      PID:1936
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4304,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
                      2⤵
                        PID:4600
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4444,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
                        2⤵
                          PID:2996
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3432,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
                          2⤵
                            PID:2908
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3624,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
                            2⤵
                              PID:1964
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3588,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
                              2⤵
                                PID:3096
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4184,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
                                2⤵
                                  PID:2380
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5980,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
                                  2⤵
                                    PID:1944
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
                                      cookie_exporter.exe --cookie-json=1144
                                      3⤵
                                        PID:2060
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
                                      2⤵
                                        PID:2748
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
                                        2⤵
                                          PID:2800
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6332,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
                                          2⤵
                                            PID:1308
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6484,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
                                            2⤵
                                              PID:2120
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
                                              2⤵
                                                PID:5068
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6644,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
                                                2⤵
                                                  PID:2232
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6820,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
                                                  2⤵
                                                    PID:1340
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6808,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
                                                    2⤵
                                                      PID:872
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6408,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
                                                      2⤵
                                                        PID:1176
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6992,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
                                                        2⤵
                                                          PID:2320
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6980,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:14
                                                          2⤵
                                                            PID:3660
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7340,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:1
                                                            2⤵
                                                              PID:5044
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4364,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
                                                              2⤵
                                                                PID:3796
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4340,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
                                                                2⤵
                                                                  PID:1672
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3648,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
                                                                  2⤵
                                                                    PID:3088
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=5552,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
                                                                    2⤵
                                                                      PID:4520
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7344,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
                                                                      2⤵
                                                                      • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                      • NTFS ADS
                                                                      PID:676
                                                                    • C:\Users\Admin\Downloads\Swift.exe
                                                                      "C:\Users\Admin\Downloads\Swift.exe"
                                                                      2⤵
                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                      • Checks BIOS information in registry
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:1936
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Downloads\Scripts.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Roaming\Swift\Scripts'; $Shortcut.Save()"
                                                                        3⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3492
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Downloads\Workspace.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Roaming\Swift\Workspace'; $Shortcut.Save()"
                                                                        3⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:496
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Downloads\AutoExec.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Roaming\Swift\AutoExec'; $Shortcut.Save()"
                                                                        3⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4620
                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=RemoveRedirectionBitmap --lang=en-US --mojo-named-platform-channel-pipe=1936.900.4545295638728273064
                                                                        3⤵
                                                                        • Drops file in Windows directory
                                                                        • Enumerates system info in registry
                                                                        • Modifies data under HKEY_USERS
                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                        PID:2692
                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\swift\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x18c,0x7ffae6d7b078,0x7ffae6d7b084,0x7ffae6d7b090
                                                                          4⤵
                                                                            PID:1572
                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,17880283709146197240,644740682258050921,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
                                                                            4⤵
                                                                              PID:3464
                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1900,i,17880283709146197240,644740682258050921,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
                                                                              4⤵
                                                                                PID:2832
                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2320,i,17880283709146197240,644740682258050921,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
                                                                                4⤵
                                                                                  PID:2820
                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3592,i,17880283709146197240,644740682258050921,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
                                                                                  4⤵
                                                                                    PID:3392
                                                                                • C:\Users\Admin\Downloads\Swift.exe
                                                                                  "C:\Users\Admin\Downloads\Swift.exe"
                                                                                  3⤵
                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                  • Downloads MZ/PE file
                                                                                  • Checks BIOS information in registry
                                                                                  • Executes dropped EXE
                                                                                  • Checks whether UAC is enabled
                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3544
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Downloads\Scripts.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Roaming\Swift\Scripts'; $Shortcut.Save()"
                                                                                    4⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:5500
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Downloads\Workspace.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Roaming\Swift\Workspace'; $Shortcut.Save()"
                                                                                    4⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:5652
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Downloads\AutoExec.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Roaming\Swift\AutoExec'; $Shortcut.Save()"
                                                                                    4⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:5948
                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=RemoveRedirectionBitmap --lang=en-US --mojo-named-platform-channel-pipe=3544.6124.5800866415504463073
                                                                                    4⤵
                                                                                    • Drops file in Windows directory
                                                                                    • Enumerates system info in registry
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                    PID:6128
                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\swift\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x180,0x184,0x188,0x15c,0x1bc,0x7ffae6d7b078,0x7ffae6d7b084,0x7ffae6d7b090
                                                                                      5⤵
                                                                                        PID:2728
                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1856,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1852 /prefetch:2
                                                                                        5⤵
                                                                                          PID:1396
                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1716,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
                                                                                          5⤵
                                                                                            PID:1304
                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2324,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
                                                                                            5⤵
                                                                                              PID:2080
                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3408,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
                                                                                              5⤵
                                                                                                PID:1148
                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4656,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
                                                                                                5⤵
                                                                                                  PID:5412
                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4772,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
                                                                                                  5⤵
                                                                                                    PID:232
                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4544,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:14
                                                                                                    5⤵
                                                                                                      PID:3244
                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4776,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
                                                                                                      5⤵
                                                                                                        PID:5560
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=792,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
                                                                                                        5⤵
                                                                                                          PID:1424
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4824,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
                                                                                                          5⤵
                                                                                                            PID:2768
                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4928,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
                                                                                                            5⤵
                                                                                                              PID:580
                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4792,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:10
                                                                                                              5⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:3548
                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4788,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
                                                                                                              5⤵
                                                                                                                PID:5472
                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4104,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:14
                                                                                                                5⤵
                                                                                                                  PID:3160
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                "cmd" /c start "" "msedge" "https://key.getswift.gg/ks/checkpoint/1/cnCQrFFEWuowmayClSCTrHjlwCuWOyRvHtLUBVeNoooVuRSWAR"
                                                                                                                4⤵
                                                                                                                  PID:6080
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://key.getswift.gg/ks/checkpoint/1/cnCQrFFEWuowmayClSCTrHjlwCuWOyRvHtLUBVeNoooVuRSWAR"
                                                                                                                    5⤵
                                                                                                                      PID:2856
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch https://key.getswift.gg/ks/checkpoint/1/cnCQrFFEWuowmayClSCTrHjlwCuWOyRvHtLUBVeNoooVuRSWAR
                                                                                                                        6⤵
                                                                                                                          PID:5184
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6940,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
                                                                                                                  2⤵
                                                                                                                    PID:2536
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1484,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
                                                                                                                    2⤵
                                                                                                                      PID:2024
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5408,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
                                                                                                                      2⤵
                                                                                                                        PID:3080
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5464,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:14
                                                                                                                        2⤵
                                                                                                                          PID:5800
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2732,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:10
                                                                                                                          2⤵
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:928
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5692,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
                                                                                                                          2⤵
                                                                                                                            PID:4416
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3492,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
                                                                                                                            2⤵
                                                                                                                              PID:5532
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5452,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
                                                                                                                              2⤵
                                                                                                                                PID:1104
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4276,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
                                                                                                                                2⤵
                                                                                                                                  PID:5296
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1648,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:14
                                                                                                                                  2⤵
                                                                                                                                    PID:5056
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5560,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
                                                                                                                                    2⤵
                                                                                                                                      PID:5604
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=5524,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:4880
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=3168,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:4268
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3560,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
                                                                                                                                          2⤵
                                                                                                                                            PID:5516
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5864,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
                                                                                                                                            2⤵
                                                                                                                                              PID:1932
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4268,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
                                                                                                                                              2⤵
                                                                                                                                                PID:3156
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=7676,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:4784
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                1⤵
                                                                                                                                                  PID:4924
                                                                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1416
                                                                                                                                                  • C:\Windows\system32\OpenWith.exe
                                                                                                                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                    1⤵
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:3484
                                                                                                                                                  • C:\Windows\system32\sihost.exe
                                                                                                                                                    sihost.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3556
                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                        explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                        2⤵
                                                                                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:404
                                                                                                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                      1⤵
                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:2508
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:1548

                                                                                                                                                    Network

                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                    Replay Monitor

                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                    Downloads

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      5f4c933102a824f41e258078e34165a7

                                                                                                                                                      SHA1

                                                                                                                                                      d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee

                                                                                                                                                      SHA256

                                                                                                                                                      d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2

                                                                                                                                                      SHA512

                                                                                                                                                      a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\413061c9-bf34-4d75-b1bc-ee2064d93fbf.tmp

                                                                                                                                                      Filesize

                                                                                                                                                      34KB

                                                                                                                                                      MD5

                                                                                                                                                      552786fcf0e50a8ecd88e43b394f78b0

                                                                                                                                                      SHA1

                                                                                                                                                      848f2669a2d7b8da81aa9797262b33177593de47

                                                                                                                                                      SHA256

                                                                                                                                                      fc6a20feae62c3ee06254d88c2483306eef0cbeb3607c07a88e8b5e7715edfa5

                                                                                                                                                      SHA512

                                                                                                                                                      ed1dbbee3101728cf5b6c24e92a26be9510aee250a0e29266a3d740ccb47293cb9634b9ae923a29da7ce23f03eceb119824ae3bbc165578148c767cf8c1e38e0

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

                                                                                                                                                      Filesize

                                                                                                                                                      3KB

                                                                                                                                                      MD5

                                                                                                                                                      f9fd82b572ef4ce41a3d1075acc52d22

                                                                                                                                                      SHA1

                                                                                                                                                      fdded5eef95391be440cc15f84ded0480c0141e3

                                                                                                                                                      SHA256

                                                                                                                                                      5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

                                                                                                                                                      SHA512

                                                                                                                                                      17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                      Filesize

                                                                                                                                                      280B

                                                                                                                                                      MD5

                                                                                                                                                      046b1cdbd636e82e7711ea1fde31d7e3

                                                                                                                                                      SHA1

                                                                                                                                                      f5fa4183cb259a99b4148ee957a5f76e80a77ada

                                                                                                                                                      SHA256

                                                                                                                                                      40328502d95af4c1db45d98abe8c4e9214d80a8df7f0b8f19f81edd5e121f90a

                                                                                                                                                      SHA512

                                                                                                                                                      460ba5792f0df64289ff4057d04615973a7844b2fd2c14df554600c141d720fcf13d9e9c8449ac57e50fa074a81887437918970881b4d48f7a7ee3521bac8eb4

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                      Filesize

                                                                                                                                                      280B

                                                                                                                                                      MD5

                                                                                                                                                      cbc9fc2d9ad2df85283109b48c8e6db0

                                                                                                                                                      SHA1

                                                                                                                                                      721ea0dfafd882d6354f8b0a35560425a60a8819

                                                                                                                                                      SHA256

                                                                                                                                                      7c21b286b304b2b42ab3502158aef04892b60c63007b8ed7172dad86a4bcebbe

                                                                                                                                                      SHA512

                                                                                                                                                      09594b5f33704cf367960376e5abc8cbfa7baead59c3f199ffd365a9a9c2159b45f6596d597ebdd033db5436c000faac3c5b2fb39e97fc17b102d03831265609

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

                                                                                                                                                      Filesize

                                                                                                                                                      352B

                                                                                                                                                      MD5

                                                                                                                                                      f48ecde00d89d25a56b82f0939c6fc5b

                                                                                                                                                      SHA1

                                                                                                                                                      5a9c0c70423655abc2f67edef2dd48b3db4d1702

                                                                                                                                                      SHA256

                                                                                                                                                      0423ca512c9e7fa67ca75ce9a6f49dcd8c8fba5bdc3cc1393b07f491bca1a5a0

                                                                                                                                                      SHA512

                                                                                                                                                      7458aaa7de0b3bc1204c98f7cba6b1b0393e759e7fc4f3f317d36d3361f84b516deef81d847ec8d0d65d5767c37b0fe647a15857fa9f1f637e12acc315d8f6de

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

                                                                                                                                                      Filesize

                                                                                                                                                      158B

                                                                                                                                                      MD5

                                                                                                                                                      399aa491efc7e4408cbf4164f632f3b5

                                                                                                                                                      SHA1

                                                                                                                                                      bc23e843678770edb45e28c08e72c89822046a98

                                                                                                                                                      SHA256

                                                                                                                                                      58390f8ec021ce531eeb159dc05f9a071eb4f2db501bf3283a0807ef23b46c53

                                                                                                                                                      SHA512

                                                                                                                                                      1db2b6b2f8fcd0385bef58375231de7ec96aa7378574587f587f307b6557eefbade0692b1537391d08099d69472fd59604af87d0bddcb9920812636b5896cc7e

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

                                                                                                                                                      Filesize

                                                                                                                                                      3KB

                                                                                                                                                      MD5

                                                                                                                                                      f0a7984f5b75d791c54020643cfb4967

                                                                                                                                                      SHA1

                                                                                                                                                      923f4ed9b4b35dfb149111e527bb41bf0fbef8de

                                                                                                                                                      SHA256

                                                                                                                                                      c7b551b589419da6b4ceab1f8e932a3ddd82564ced25e451f727f307cebc5589

                                                                                                                                                      SHA512

                                                                                                                                                      8b0deb113d56aaa9f740d3f8a59fb04b3b11cb4acf208f4824934349698e1ab4d12c76c07fa6d4602f4d2cc9066bef1a6764fd1622de7da1319b34ef3c96a87d

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                      Filesize

                                                                                                                                                      3KB

                                                                                                                                                      MD5

                                                                                                                                                      efbaec0590812485cc52b6174da45d96

                                                                                                                                                      SHA1

                                                                                                                                                      328b84c97805f51437ed30fcc2be7369ad0a8180

                                                                                                                                                      SHA256

                                                                                                                                                      dfdfeb1d7b40d7c8f75088e0e26564bdd82a9ccc89e2e9396372e65d25e25f87

                                                                                                                                                      SHA512

                                                                                                                                                      affbe7d1ad9cc091e53441f755d2826d008654cdd56f9ff7833bc30707ec6045f1e526eac5fc35fc6ef7ce9bc240bfc7bd3a25396e64051f134e78b911725e7d

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe579cbd.TMP

                                                                                                                                                      Filesize

                                                                                                                                                      3KB

                                                                                                                                                      MD5

                                                                                                                                                      8916312674d8e3f33dd4482a05da9a9b

                                                                                                                                                      SHA1

                                                                                                                                                      d0c66cf0b1edd4ebe5f951151d0ea10287e513d1

                                                                                                                                                      SHA256

                                                                                                                                                      962c491d8de5f4d517e53ec16f54057ea083c4a75ff82f1462dcced42155aa71

                                                                                                                                                      SHA512

                                                                                                                                                      4a14669781f0e734155824fd5889b9f0fabf15702b407fd936e0a96dec203bb7c1afc7b4c6050de373e6b6d5772b22b916f31640bd63cdf3769e11ad30b53503

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

                                                                                                                                                      Filesize

                                                                                                                                                      2B

                                                                                                                                                      MD5

                                                                                                                                                      99914b932bd37a50b983c5e7c90ae93b

                                                                                                                                                      SHA1

                                                                                                                                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                                                                      SHA256

                                                                                                                                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                                                                      SHA512

                                                                                                                                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                                                                                                                      Filesize

                                                                                                                                                      69KB

                                                                                                                                                      MD5

                                                                                                                                                      164a788f50529fc93a6077e50675c617

                                                                                                                                                      SHA1

                                                                                                                                                      c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

                                                                                                                                                      SHA256

                                                                                                                                                      b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

                                                                                                                                                      SHA512

                                                                                                                                                      ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

                                                                                                                                                      Filesize

                                                                                                                                                      9KB

                                                                                                                                                      MD5

                                                                                                                                                      3d20584f7f6c8eac79e17cca4207fb79

                                                                                                                                                      SHA1

                                                                                                                                                      3c16dcc27ae52431c8cdd92fbaab0341524d3092

                                                                                                                                                      SHA256

                                                                                                                                                      0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

                                                                                                                                                      SHA512

                                                                                                                                                      315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

                                                                                                                                                      Filesize

                                                                                                                                                      107KB

                                                                                                                                                      MD5

                                                                                                                                                      40e2018187b61af5be8caf035fb72882

                                                                                                                                                      SHA1

                                                                                                                                                      72a0b7bcb454b6b727bf90da35879b3e9a70621e

                                                                                                                                                      SHA256

                                                                                                                                                      b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

                                                                                                                                                      SHA512

                                                                                                                                                      a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      a1e766fac705b300d42251d432c24594

                                                                                                                                                      SHA1

                                                                                                                                                      86d2dbba3fd7b6aaa7a36414c91b72b56092138e

                                                                                                                                                      SHA256

                                                                                                                                                      c1c38f82c4978dfb928a6218f49ee3be29dfb39cc3fc785e2de85375495ce180

                                                                                                                                                      SHA512

                                                                                                                                                      629306eec7c60754610b8247c6eb9cb3c01ea295d425474be0a1156daf9000170a429b27bcb8ce54541b2a515111bc4d703bc073ac49ef615e765761a657a9f6

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                                                                                      Filesize

                                                                                                                                                      3KB

                                                                                                                                                      MD5

                                                                                                                                                      2250b99cfe7c1125900f9e95da3891bf

                                                                                                                                                      SHA1

                                                                                                                                                      dd5882d9bd982e7fd324cb0567c80d94a5499cf2

                                                                                                                                                      SHA256

                                                                                                                                                      fbf879c3ab8ba08b38b3532c95afcb7f5aece2503a929f04d16644b75ab43256

                                                                                                                                                      SHA512

                                                                                                                                                      4c98e6c4c921ea7ce3afcaedb2d4697a6da002509b563c95be5d5f45d199dec0405176695ccc0c428e3ec298a2b5a9117be25cf5cc0a3612ad7a9dbb27013f50

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      MD5

                                                                                                                                                      1f0f5c51a2c7e301b07c1d2d7328a422

                                                                                                                                                      SHA1

                                                                                                                                                      3a180d403a53e27d4abb320f97096bd86487b6bb

                                                                                                                                                      SHA256

                                                                                                                                                      e5b012b3e8c80b0c36d4efb5b7b627267ce182bfbba114d7a47485765a4e7b38

                                                                                                                                                      SHA512

                                                                                                                                                      3e24185a61a6d65da794f0e9f611bb50fe2d249cfcc6e85c389e72773bbc5ab0fc1def725a45bef07090e9d26747a9a294957d927b8b472489ec8fd352982a16

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      54b203d9a2784d5746e11f667598ad90

                                                                                                                                                      SHA1

                                                                                                                                                      e7aba11772b37da11fe7003d36a97b97345e40e3

                                                                                                                                                      SHA256

                                                                                                                                                      3614aa2ee3264ec7203163e1c0cb164d4ecabee5ab8c7c7d96d901803ac3bb8a

                                                                                                                                                      SHA512

                                                                                                                                                      6f1a22bb706264ab6e46a083baa917078c1756e47e923efe494850367d58dac7faf501db6fe69187e02ecb461d2e44d1ef230f665347ae4e7150dc23d725eae3

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                                                                                      Filesize

                                                                                                                                                      111B

                                                                                                                                                      MD5

                                                                                                                                                      285252a2f6327d41eab203dc2f402c67

                                                                                                                                                      SHA1

                                                                                                                                                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                                                      SHA256

                                                                                                                                                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                                                      SHA512

                                                                                                                                                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      03964bd670d42482df1e75113e19bf04

                                                                                                                                                      SHA1

                                                                                                                                                      6c368f584e7074f540c5f063f8a53edf67a749b1

                                                                                                                                                      SHA256

                                                                                                                                                      1fe738d7d6058876ad67ff68fb92b6d310bc62384905730b4cf626692113abac

                                                                                                                                                      SHA512

                                                                                                                                                      41c2ab33cf42af0f1592eaf7a1c5976e034800ff5afe49cb78deb4c35b367cce3527747cec16d0433077610cb2c17488a52812dec1a6d191e67ccafb3181eb1f

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                                                      Filesize

                                                                                                                                                      2B

                                                                                                                                                      MD5

                                                                                                                                                      d751713988987e9331980363e24189ce

                                                                                                                                                      SHA1

                                                                                                                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                      SHA256

                                                                                                                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                      SHA512

                                                                                                                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                      Filesize

                                                                                                                                                      13KB

                                                                                                                                                      MD5

                                                                                                                                                      dc546e32aa5bc4a1b099653875d08791

                                                                                                                                                      SHA1

                                                                                                                                                      b1e019cdb45cf640f5fd29af6c991f00f2513bf6

                                                                                                                                                      SHA256

                                                                                                                                                      82901bb1e763810af48d914f9519fb6baa88481ca33370bd8b0bc465e109b646

                                                                                                                                                      SHA512

                                                                                                                                                      fad35c598c8e42e7e8df84aab2b93744cbf9a05f51e2a31102ca2401db5d607c18e8e99a854416985dcf3379bb549ae9740b242f74fba3017a7bc2bb273de511

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                      Filesize

                                                                                                                                                      15KB

                                                                                                                                                      MD5

                                                                                                                                                      8111f2987f98c096156a7e80a4d4d9b3

                                                                                                                                                      SHA1

                                                                                                                                                      4fe9b6c5561c3e7dfdc2986c7aafb0c7ff5fb89e

                                                                                                                                                      SHA256

                                                                                                                                                      b5f71d0d2d69f77158ec31562ab768381fb07c64d8c3338a36237681587b7fd5

                                                                                                                                                      SHA512

                                                                                                                                                      f976ec395ad155615920cddf45ed1220373119c791e7f82267fa6cc57becab3cf136ff2bec4317baa353f408d0de45f569f147ac3ef7da9562e7d417bf03a8f9

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                      Filesize

                                                                                                                                                      15KB

                                                                                                                                                      MD5

                                                                                                                                                      31924cf9f0ac05f57f676636439bcb2c

                                                                                                                                                      SHA1

                                                                                                                                                      dae9b634dd280a93d3eb90d051e604081cc69fea

                                                                                                                                                      SHA256

                                                                                                                                                      86d9a18eed0da04093c9d957d5adf7c530ffd2f749852a60b0e90f56d9e2f10e

                                                                                                                                                      SHA512

                                                                                                                                                      677f30287206f6627ff4dae060c4f94c97f7170c6dc3514062a7c55b19376480127efce436778f62a198bf2b55439294b8dfcbed4759fd0020e7d0bcf9e3bbf8

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                      Filesize

                                                                                                                                                      14KB

                                                                                                                                                      MD5

                                                                                                                                                      b6e782fee2fee7d21c049fa1eec886ff

                                                                                                                                                      SHA1

                                                                                                                                                      68b652e960493789b941d5e2bfdd397ecb23d905

                                                                                                                                                      SHA256

                                                                                                                                                      4c119e2543100851375b4a11fcdbcbfea2b3ea15047c5265a843f461cfd46c6b

                                                                                                                                                      SHA512

                                                                                                                                                      ff9ec9605e67bfe464e1932be8aa8382dcb4fa50b5fd32001fdbb5266f4acd80e71b1bd6e13c0e699a2e0249b289daa6279dcce249cbf687129ac4eb388153cd

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                                                      Filesize

                                                                                                                                                      37KB

                                                                                                                                                      MD5

                                                                                                                                                      866116bf6c729ce5cf4f613c97517875

                                                                                                                                                      SHA1

                                                                                                                                                      1f7c8bd3d259434c21a2f50d5a74bca0f73a96d1

                                                                                                                                                      SHA256

                                                                                                                                                      3a336ca9002202873a30c7b9ba9f2fc7caab81421950f67cb6022b66820cc072

                                                                                                                                                      SHA512

                                                                                                                                                      610a38c5cc6f93de41cb251f10c95797b202f1048459298b5e6777b680b1f6381968c349ab757b3715eaab41eff863b02818055fd94be4acb9551c0697bfce19

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      MD5

                                                                                                                                                      600d8dd2887c8d858a8ff41b9e3666d0

                                                                                                                                                      SHA1

                                                                                                                                                      ae1f04942c606931f89c52649a44f5473f9669af

                                                                                                                                                      SHA256

                                                                                                                                                      2f9e8d989815d0b782dcd9673e426ef8af287fab097c1c99aa07e2a7b08f5f1b

                                                                                                                                                      SHA512

                                                                                                                                                      ef91ef2779996136d08fdcd2f3ebfae44b5ccfc6c8320a2373fb894bce02d10a60d64939dbe8b199ab718d031f4743c2523d7895ab348854f58ec8a99041e4b9

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

                                                                                                                                                      Filesize

                                                                                                                                                      23KB

                                                                                                                                                      MD5

                                                                                                                                                      d85bf4c5fef64a0a240c293ad84e6cfc

                                                                                                                                                      SHA1

                                                                                                                                                      c5f7a8a399e6d9a6be8c70a8f472b5caba651296

                                                                                                                                                      SHA256

                                                                                                                                                      f8a649a797dda9337c3f2535ac2d3cc27cc329ddf03775c19639c0e53794a9fe

                                                                                                                                                      SHA512

                                                                                                                                                      c76f42ea671e74a06f747ac09fe6e3fc7efb62fc401d8ea12fa686812836753b1348487d34abf113d6ac0e49c6f3260a9760b36cf1818cbfb4c4a78bafd8ddc9

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

                                                                                                                                                      Filesize

                                                                                                                                                      880B

                                                                                                                                                      MD5

                                                                                                                                                      c79445510481c0f62d3dfa9a56a23b7c

                                                                                                                                                      SHA1

                                                                                                                                                      9e2143a809120f338da8872058f70dc122a0c00f

                                                                                                                                                      SHA256

                                                                                                                                                      34b9aa3a9a6001bc8419887a719d69b452c0f87c5c32e0cf15b87b82c32cc7d7

                                                                                                                                                      SHA512

                                                                                                                                                      821d93e4e231efd42a281644132f3d5c8e0fdcd237276184bd966a4c673c3eb007dea411e240e28583d60694346eff9d36a24cae1661867356d8efe1caf576fc

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe583da0.TMP

                                                                                                                                                      Filesize

                                                                                                                                                      469B

                                                                                                                                                      MD5

                                                                                                                                                      25e92af3404b527b61eeed3baca1b483

                                                                                                                                                      SHA1

                                                                                                                                                      67e88ea416a1c68c7cb6c00bd6022acb58e39aa9

                                                                                                                                                      SHA256

                                                                                                                                                      7d432b7124c1403a21b84e0c874352d15bee1adf0b21605fadeb1f80acc0aa4d

                                                                                                                                                      SHA512

                                                                                                                                                      17f0de1ad16cb52bd08e81d48df8fd9727d9c8461a97f3f192622613c424f685b7ebb4b390391bc13361df39c5511448adaa1c8a96067a0e4d9f77ad960df11c

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

                                                                                                                                                      Filesize

                                                                                                                                                      22KB

                                                                                                                                                      MD5

                                                                                                                                                      56a63f182b2938fbe3e59fbf9681dc08

                                                                                                                                                      SHA1

                                                                                                                                                      b76578ca24fb20b8bd5dafad4296e5a46735a5e1

                                                                                                                                                      SHA256

                                                                                                                                                      36edc2510fb072092e4c6b95efe4521857d9dcb7f0b45afdf5e8ef02e5d19593

                                                                                                                                                      SHA512

                                                                                                                                                      b17246b7c61e26fce1f211311b578d6b3d22c03a042137bb2bb5b23018ce5290a8fbf7a34b2f66fa30b2027296b8a570478f66a144385c320d63c1cef64434f8

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe583b3f.TMP

                                                                                                                                                      Filesize

                                                                                                                                                      3KB

                                                                                                                                                      MD5

                                                                                                                                                      c7569efb2fa9fe93c0ea2f0896f54036

                                                                                                                                                      SHA1

                                                                                                                                                      e231c700b778b624f6065b035e5803fdd8b4db4b

                                                                                                                                                      SHA256

                                                                                                                                                      2422f055fd21adce7a027c3eaab1bbc474345a26cb1b9762b3d7572ebde67d3f

                                                                                                                                                      SHA512

                                                                                                                                                      c394da9a75cca87f6e20cb2abbc2e087d3e374b613bbc960f255ebfc8f01d4349fc8a487ec56ff8141f47566cf021dc33196e42b6295ce5399ff78e5ce4b066f

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

                                                                                                                                                      Filesize

                                                                                                                                                      3KB

                                                                                                                                                      MD5

                                                                                                                                                      94406cdd51b55c0f006cfea05745effb

                                                                                                                                                      SHA1

                                                                                                                                                      a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

                                                                                                                                                      SHA256

                                                                                                                                                      8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

                                                                                                                                                      SHA512

                                                                                                                                                      d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      30KB

                                                                                                                                                      MD5

                                                                                                                                                      d76ff88a49262ce84df21a8b9641e9e2

                                                                                                                                                      SHA1

                                                                                                                                                      bc8be466082cd4321b14e8e087316ae6a60d6cc5

                                                                                                                                                      SHA256

                                                                                                                                                      c7d5d640a754a454209ff7a3adcc34ce4b5fefff5cabf558067c9979365d5879

                                                                                                                                                      SHA512

                                                                                                                                                      1ecedabd4ab74258b51968dcec951500ad25404f26d1d915e3d62079daf93219a9382beee3aa7e6b8ed425e5010063a81c9eeaf1dcbe70262dfd0fe97453a8ad

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      30KB

                                                                                                                                                      MD5

                                                                                                                                                      4c4a91216078cd7bed62e5c76363b156

                                                                                                                                                      SHA1

                                                                                                                                                      a97a725d47fd015fca77f4396e839eb9af98c5c1

                                                                                                                                                      SHA256

                                                                                                                                                      210e49c0cf3d5195cb60ba01ec662e601c6f968432493a7557ff070b79ca180f

                                                                                                                                                      SHA512

                                                                                                                                                      e1325d19ca52c53a55e96dd6b54e97285823f31b44acbd7f8f12d6436ea696da69eb3e6f622bfe6a6ece19a10e60cb9686d318cb37609fd229e1d64f1a777fe2

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      30KB

                                                                                                                                                      MD5

                                                                                                                                                      ea9565cd2ad8bea104bfeb7c57cd47f3

                                                                                                                                                      SHA1

                                                                                                                                                      dabcc240cad23ae82f47e398acea101fd5c1b4e2

                                                                                                                                                      SHA256

                                                                                                                                                      4e5c63c8e00b6de329ac1fed41a51cc51a8d7d5281080e2d391af3865c32d2af

                                                                                                                                                      SHA512

                                                                                                                                                      204b0f64a3dab339b7433a8c96de645ff2b103880e3db9f4ee5a10a8a44e98dc52835a69111a1fdb310354b4c663c4d149816b6279b03654b6ece00f8b9b23f2

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      6KB

                                                                                                                                                      MD5

                                                                                                                                                      70cdb125a7bb8bf79b60a2f906fbe917

                                                                                                                                                      SHA1

                                                                                                                                                      f3b751c037f948f016e08d0c40a35cd25f3fd05f

                                                                                                                                                      SHA256

                                                                                                                                                      294ed72c202784edfa1289d38185bc426d73678a95e33831c842db8a94a9bb42

                                                                                                                                                      SHA512

                                                                                                                                                      fd8cfad3055fe1d2b35d530241643f28d3e0a4e0e33013c00e631b24787c8486a22c0861fdc8b70c3213d64806c2f3fc42e3b96d50d0c4c2c19f6edf51ee307d

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      30KB

                                                                                                                                                      MD5

                                                                                                                                                      67448b3f03922843450fd35e12c5dda5

                                                                                                                                                      SHA1

                                                                                                                                                      29001fce22623afb1fd6b4b9211096e7d6f32303

                                                                                                                                                      SHA256

                                                                                                                                                      7a16e5075044e27c572ba25790cf38873a9c45f35453c2f2ae2b98d111e5c72c

                                                                                                                                                      SHA512

                                                                                                                                                      67602d3693a524a4acc3e67f341b5fc98b9ac2dd895165885b25d7b04e2e25412f3fc5b18a8d1f7531f19de0837665bd666b537955840d980f6f5d8be739e278

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      34KB

                                                                                                                                                      MD5

                                                                                                                                                      5f6a75533395b4a3daab87c7c96203c4

                                                                                                                                                      SHA1

                                                                                                                                                      503747775a771a3e4da43862fc8e84dbb7eb50d8

                                                                                                                                                      SHA256

                                                                                                                                                      28a9757e3dc94609caa4c8127d45a839dde5b0fe8e58b8cf65b36b3a6492b283

                                                                                                                                                      SHA512

                                                                                                                                                      f678799d0e248b65587952ad259127ade9a1486d526d6b59b37cbc660a5e167bce0e660a0af22bb1726de3deff5ddf1dc1782493a6f7fa733cb2d78c0f28457a

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      7KB

                                                                                                                                                      MD5

                                                                                                                                                      99a6e52551191cfcbf427ba712ac496d

                                                                                                                                                      SHA1

                                                                                                                                                      243907169b61bedf053544ad12790cc34e8333d3

                                                                                                                                                      SHA256

                                                                                                                                                      6615ebcb1b48ded90e329c26bbf8e346f237f4909aba6ad4e287f997b1d1a8f4

                                                                                                                                                      SHA512

                                                                                                                                                      7ecdc6da246e8a2f217f1e8ebbc376408d161edf3a2cdf0cf978dfafdeb04bf8a20a769288e9ffd86a157b1c064c9555c20b73009f504196625e9641c219b3c6

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      35KB

                                                                                                                                                      MD5

                                                                                                                                                      aeb23a0250597f1043e217aaa39e9f34

                                                                                                                                                      SHA1

                                                                                                                                                      f71122f5d53d88948fa5dd8575a5fdbf8b4e7a62

                                                                                                                                                      SHA256

                                                                                                                                                      3590d870032d1fc77901095d0710d08128e28eae4680c5dbacf52b1a2b66c797

                                                                                                                                                      SHA512

                                                                                                                                                      5cf3bc88a920592c189576d7d4d3f6a3bdb4f9734372a85978c12120bed36fcaf6dd989c164049cfe69b957f6cd1fe0b1164f135c6304cb8b1a472fa98981130

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      34KB

                                                                                                                                                      MD5

                                                                                                                                                      cab124840a95e6311fa0b16f4adf7572

                                                                                                                                                      SHA1

                                                                                                                                                      4fa2e91e04970f76cf86642a5687192c9a6110cf

                                                                                                                                                      SHA256

                                                                                                                                                      5383d63dff99483454eabb9a35ff6de08074e6f42366d3ba0495783a7366553f

                                                                                                                                                      SHA512

                                                                                                                                                      fa7285c78c84a1d54b03ae88b78faedc23407b3ef12738c446136301f8488ea45abd353da6d5401d4417ccf0a5dee2a82e3b342976a870c59edb03c023e5688f

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      35KB

                                                                                                                                                      MD5

                                                                                                                                                      6ffde66731d8ab0d8cbaa812d974f93a

                                                                                                                                                      SHA1

                                                                                                                                                      ec1698a3f9e688ab464b4ddefb24ee3e392eb7f9

                                                                                                                                                      SHA256

                                                                                                                                                      866ef9ea8c380b2b4e2f4dfc7dcfb7c8d15b952c10d5ed01d3976a99b7bafcdd

                                                                                                                                                      SHA512

                                                                                                                                                      e58a8782bca25bf177e38d76dbe9cf3b9863d0f04a9bcc0e825d6994ce90d3fac8bf70fb770c7e946ee3dae67b4cfd95eceaa0e77f4674dcdf0a88802d1d3f1a

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

                                                                                                                                                      Filesize

                                                                                                                                                      6KB

                                                                                                                                                      MD5

                                                                                                                                                      bef4f9f856321c6dccb47a61f605e823

                                                                                                                                                      SHA1

                                                                                                                                                      8e60af5b17ed70db0505d7e1647a8bc9f7612939

                                                                                                                                                      SHA256

                                                                                                                                                      fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

                                                                                                                                                      SHA512

                                                                                                                                                      bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json

                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      499d9e568b96e759959dc69635470211

                                                                                                                                                      SHA1

                                                                                                                                                      2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

                                                                                                                                                      SHA256

                                                                                                                                                      98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

                                                                                                                                                      SHA512

                                                                                                                                                      3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                      Filesize

                                                                                                                                                      1KB

                                                                                                                                                      MD5

                                                                                                                                                      54842f1e1b484852f346a00fb96d5c8d

                                                                                                                                                      SHA1

                                                                                                                                                      7f9174bcee466076511721bae11e86b844b72c11

                                                                                                                                                      SHA256

                                                                                                                                                      935000dfc0938cf3784c98e770bca986acb47eeb4afcd0b6b9533d0bfcd84c7c

                                                                                                                                                      SHA512

                                                                                                                                                      bb215158f307245213a9e99b575b73cf17725a28f6b069bf2b65e15bf0e3092319b29e9d2daf9ca6021670338221c0d8fdfdabc475125514aa8d17355fd28bc0

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                      Filesize

                                                                                                                                                      1KB

                                                                                                                                                      MD5

                                                                                                                                                      371ac0b948586f6551359d1e5cc7ce6a

                                                                                                                                                      SHA1

                                                                                                                                                      e2e3b8930edaec9752d2a87f9ce512a3dd320eeb

                                                                                                                                                      SHA256

                                                                                                                                                      a187893f567559aa34c3a11386eb2553d56ede8e3ebec1394cdb44550bc3c7ae

                                                                                                                                                      SHA512

                                                                                                                                                      4c4c8c8dccef9569ea5c0decacbff5540487001edf779fe35ece83801e0f26f07e6f36faa8d576f0efa75fdd28593b632a39091a0d128503187320fe661bec6a

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                      Filesize

                                                                                                                                                      1KB

                                                                                                                                                      MD5

                                                                                                                                                      b94a5f9c019b614942fc29d049e77006

                                                                                                                                                      SHA1

                                                                                                                                                      7d22a700e14c52c6ded2a26cc063057b779d5c2e

                                                                                                                                                      SHA256

                                                                                                                                                      ac01c39f1027c82f8d739b7a15c8fc17875bf33f3069f9acf0eb4a0d3b8803d7

                                                                                                                                                      SHA512

                                                                                                                                                      301825dd58920d02a28650c9bd9a43d36d5d896fa72b79b49792a868f2df4d419dd6fdfe245f544f8becaff9585e63050fe2e6979dbc35a592017423a392633e

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                      Filesize

                                                                                                                                                      1KB

                                                                                                                                                      MD5

                                                                                                                                                      dd3474e6a72c08266c25f196f78b13fd

                                                                                                                                                      SHA1

                                                                                                                                                      b70c6bbd7794b49b6b9afa6343987a7f553d1268

                                                                                                                                                      SHA256

                                                                                                                                                      82acd1c6613bb2c907a26be1f61f6556ee03cabf1aa73dad27d012be88e05318

                                                                                                                                                      SHA512

                                                                                                                                                      cf5138ab09f19034fa5d058819956fd0556c56d674268e496dbaded228839d2be576bd74cda26127adf03cce9a8ab485ce6a07c7332a2c65a77ca9b56d92c79d

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\WRLUCZ87\www.bing[1].xml

                                                                                                                                                      Filesize

                                                                                                                                                      325B

                                                                                                                                                      MD5

                                                                                                                                                      fdbb76b0cd38054ecc1a6cb90f174f7a

                                                                                                                                                      SHA1

                                                                                                                                                      19aa5ae4920e035af2c729f417c9463353b18d32

                                                                                                                                                      SHA256

                                                                                                                                                      e8c8b143087685aeff12a418b7fb23fa8724fbb6274caf84c73fdb756e436aca

                                                                                                                                                      SHA512

                                                                                                                                                      e768c92400b85a875a91808790ce1b453d87531c192f6d592280ef1d83608d9d793d1d60526af10eb8139fd4642666bd31b6bc0c8c358503aba3e0852003e61a

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\WRLUCZ87\www.bing[1].xml

                                                                                                                                                      Filesize

                                                                                                                                                      15KB

                                                                                                                                                      MD5

                                                                                                                                                      c9c00c182f946511201b1d55acbdcc75

                                                                                                                                                      SHA1

                                                                                                                                                      a8b8e6d06ec6cf10cd94a4876437b70bb92c46d2

                                                                                                                                                      SHA256

                                                                                                                                                      5ecd9b64cec986a383459bdd72e04f37e7b492d1f52605b72d77a7880b6ecaec

                                                                                                                                                      SHA512

                                                                                                                                                      56044139bb50fac96ac0e25365b702f253df092babce03a0afbdba2488147e158bbc8dfb83380e3a6d5a43c916e8ceedf038d4d0a4cd59fbab4b43fec7c91d70

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57e09519-ea9c-4c69-bb81-f05470b3caea.tmp

                                                                                                                                                      Filesize

                                                                                                                                                      1B

                                                                                                                                                      MD5

                                                                                                                                                      5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                      SHA1

                                                                                                                                                      3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                      SHA256

                                                                                                                                                      cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                      SHA512

                                                                                                                                                      0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6b004162-6b5d-4a33-8898-c40ee8d37f2b.tmp

                                                                                                                                                      Filesize

                                                                                                                                                      10KB

                                                                                                                                                      MD5

                                                                                                                                                      78e47dda17341bed7be45dccfd89ac87

                                                                                                                                                      SHA1

                                                                                                                                                      1afde30e46997452d11e4a2adbbf35cce7a1404f

                                                                                                                                                      SHA256

                                                                                                                                                      67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

                                                                                                                                                      SHA512

                                                                                                                                                      9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xzfvurmj.jav.ps1

                                                                                                                                                      Filesize

                                                                                                                                                      60B

                                                                                                                                                      MD5

                                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                      SHA1

                                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                      SHA256

                                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                      SHA512

                                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\scoped_dir2028_163842310\1544a97b-57d2-4125-823f-e074e8a9ae82.tmp

                                                                                                                                                      Filesize

                                                                                                                                                      152KB

                                                                                                                                                      MD5

                                                                                                                                                      dd9bf8448d3ddcfd067967f01e8bf6d7

                                                                                                                                                      SHA1

                                                                                                                                                      d7829475b2bd6a3baa8fabfaf39af57c6439b35e

                                                                                                                                                      SHA256

                                                                                                                                                      fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

                                                                                                                                                      SHA512

                                                                                                                                                      65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\CertificateRevocation\6498.2024.12.2\crl-set

                                                                                                                                                      Filesize

                                                                                                                                                      21KB

                                                                                                                                                      MD5

                                                                                                                                                      846feb52bd6829102a780ec0da74ab04

                                                                                                                                                      SHA1

                                                                                                                                                      dd98409b49f0cd1f9d0028962d7276860579fb54

                                                                                                                                                      SHA256

                                                                                                                                                      124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4

                                                                                                                                                      SHA512

                                                                                                                                                      c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad\settings.dat

                                                                                                                                                      Filesize

                                                                                                                                                      280B

                                                                                                                                                      MD5

                                                                                                                                                      449766340b409205a02c79c7ddda9e6e

                                                                                                                                                      SHA1

                                                                                                                                                      9a9a64b52d9d2770dbf3389221d91ed546ae3651

                                                                                                                                                      SHA256

                                                                                                                                                      a49176f719fe766442b116ba05b7d235f82c18330a0dd1a58cd45108806a252f

                                                                                                                                                      SHA512

                                                                                                                                                      78423bc612e94a389a8a73fab6df25c054eb90b503f3ee8983b2b5e8eb2ffb34a09bf42fcac7484349513e5cf615afa1cb4c3f8d5d7da3a178ba916992f6555a

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad\settings.dat

                                                                                                                                                      Filesize

                                                                                                                                                      280B

                                                                                                                                                      MD5

                                                                                                                                                      58cfc5be2b9b0bdecb19ab6c6636d57a

                                                                                                                                                      SHA1

                                                                                                                                                      ec5fec37b8247255100e6dddcac66167cd6235b4

                                                                                                                                                      SHA256

                                                                                                                                                      ffe3756c53b7aaa792c6f922eeb123410a7a8265943fb10d1afb17042fbe9114

                                                                                                                                                      SHA512

                                                                                                                                                      f9f727aca33d5ebab38def50f7c5b7881db707fc68473a2c02fd32b9bdd30f21859d8defd3a909e4e42337cf7c2ce332a468fd2d57d36ddcebcfd68d0fbae4e1

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad\settings.dat

                                                                                                                                                      Filesize

                                                                                                                                                      280B

                                                                                                                                                      MD5

                                                                                                                                                      7e00537a42713fc923f030a0ff7b77cb

                                                                                                                                                      SHA1

                                                                                                                                                      91a2c096766b8c09469b73db79d3f7a28d2dcb48

                                                                                                                                                      SHA256

                                                                                                                                                      c73507366739fcfc08809c36c9f983cd6492c06d784348db818a88dcd273e3b1

                                                                                                                                                      SHA512

                                                                                                                                                      4c6dd9aa5fcd9628a2132eedcb88ef1681dad6e5ccdb3af0f0708a5fe942fb2726339dd172aef2f60cc6a85163e872b80f719ff7e92cd2eeee0c11eeec3718bc

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad\settings.dat

                                                                                                                                                      Filesize

                                                                                                                                                      280B

                                                                                                                                                      MD5

                                                                                                                                                      e51600b49842349110c4667a4c557105

                                                                                                                                                      SHA1

                                                                                                                                                      69b589cbd677fa672efea94ae364b6c57e72cb41

                                                                                                                                                      SHA256

                                                                                                                                                      708fce9eac41c20f6cadfbf482a6466d03b0291c4e1739b6914180269948fae9

                                                                                                                                                      SHA512

                                                                                                                                                      b81fcda0c1d25033bb9eda8fc6cc277944798be3ed949f6ae9084701dd3e92cfadc00dc668dc9d9050360d381b4514a4d78cbfd206cb77bc63114795bba27e18

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad\throttle_store.dat

                                                                                                                                                      Filesize

                                                                                                                                                      20B

                                                                                                                                                      MD5

                                                                                                                                                      9e4e94633b73f4a7680240a0ffd6cd2c

                                                                                                                                                      SHA1

                                                                                                                                                      e68e02453ce22736169a56fdb59043d33668368f

                                                                                                                                                      SHA256

                                                                                                                                                      41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                                                                                                                                                      SHA512

                                                                                                                                                      193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                      Filesize

                                                                                                                                                      48B

                                                                                                                                                      MD5

                                                                                                                                                      911cbe6ad1c98443b67000f3f305b85c

                                                                                                                                                      SHA1

                                                                                                                                                      7db9209f4e3583899c0f47fc2c0f7933747a08da

                                                                                                                                                      SHA256

                                                                                                                                                      1adcb04c0ad69b0a219b56ad9b37f598ea60ee418b12f3d467898d6f2a8b8a5a

                                                                                                                                                      SHA512

                                                                                                                                                      f24646786269d75b05377a20b9335dc5cd7ec2d34e38da243edc9ba28bf8ada49c7289a35714541669c5479120ef199afdb70468372ad296c75d096ad425d370

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                      Filesize

                                                                                                                                                      456B

                                                                                                                                                      MD5

                                                                                                                                                      4ae731116d17a968aa6150692ec78de5

                                                                                                                                                      SHA1

                                                                                                                                                      54aa7d60c8c2dfa8beff439b3eab2addca0a8548

                                                                                                                                                      SHA256

                                                                                                                                                      80271906152fa7e44c5d549fefc4f9b0730718a9626c30e1775f1117374cba0b

                                                                                                                                                      SHA512

                                                                                                                                                      9e4d15d82136cddc17b1e4c0670ea7308d30a0a24c5bc3f8c0d45cab3b5066915e72ee8e22a21d6b782209a2f20193287e8c4310452fadc73a3369a6397793b5

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                      Filesize

                                                                                                                                                      360B

                                                                                                                                                      MD5

                                                                                                                                                      2f6de5a92f55d78da743da34b6f54f30

                                                                                                                                                      SHA1

                                                                                                                                                      97e653adc687905c14bd6d194f415a6581e40a97

                                                                                                                                                      SHA256

                                                                                                                                                      4a04b7eca01eaa3576e554c1d60331a7b3d17011476ebe30f9c7adee6b492fea

                                                                                                                                                      SHA512

                                                                                                                                                      3ae74d2b5ac678f8b56e66f2b9e3e7e3a1051e69a815fd6320b4f50f915ba9bbf90d9c0ab35578dbbf1c2504c10eb3c0e7760bc35642146b0f51423275f4bff8

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\DawnGraphiteCache\data_1

                                                                                                                                                      Filesize

                                                                                                                                                      264KB

                                                                                                                                                      MD5

                                                                                                                                                      d0d388f3865d0523e451d6ba0be34cc4

                                                                                                                                                      SHA1

                                                                                                                                                      8571c6a52aacc2747c048e3419e5657b74612995

                                                                                                                                                      SHA256

                                                                                                                                                      902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                                                                                                                                                      SHA512

                                                                                                                                                      376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\DawnWebGPUCache\data_0

                                                                                                                                                      Filesize

                                                                                                                                                      8KB

                                                                                                                                                      MD5

                                                                                                                                                      cf89d16bb9107c631daabf0c0ee58efb

                                                                                                                                                      SHA1

                                                                                                                                                      3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                                                                                                                                      SHA256

                                                                                                                                                      d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                                                                                                                                      SHA512

                                                                                                                                                      8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\DawnWebGPUCache\data_2

                                                                                                                                                      Filesize

                                                                                                                                                      8KB

                                                                                                                                                      MD5

                                                                                                                                                      0962291d6d367570bee5454721c17e11

                                                                                                                                                      SHA1

                                                                                                                                                      59d10a893ef321a706a9255176761366115bedcb

                                                                                                                                                      SHA256

                                                                                                                                                      ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                                                                                                                                      SHA512

                                                                                                                                                      f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\DawnWebGPUCache\data_3

                                                                                                                                                      Filesize

                                                                                                                                                      8KB

                                                                                                                                                      MD5

                                                                                                                                                      41876349cb12d6db992f1309f22df3f0

                                                                                                                                                      SHA1

                                                                                                                                                      5cf26b3420fc0302cd0a71e8d029739b8765be27

                                                                                                                                                      SHA256

                                                                                                                                                      e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                                                                                                                                      SHA512

                                                                                                                                                      e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Extension Rules\MANIFEST-000001

                                                                                                                                                      Filesize

                                                                                                                                                      41B

                                                                                                                                                      MD5

                                                                                                                                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                                      SHA1

                                                                                                                                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                                      SHA256

                                                                                                                                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                                      SHA512

                                                                                                                                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\History

                                                                                                                                                      Filesize

                                                                                                                                                      184KB

                                                                                                                                                      MD5

                                                                                                                                                      94709f62792e26b5c076c1be1eb18517

                                                                                                                                                      SHA1

                                                                                                                                                      a5cd525ed7b61f002c91cad886d3c6a908895e05

                                                                                                                                                      SHA256

                                                                                                                                                      d8dad0ad112c67c66fafa03f058613a2879b13d5f5f5d8040e621437d8eb3a9b

                                                                                                                                                      SHA512

                                                                                                                                                      b373bf380b20fcbcd5b4049cf66845365d5c5d8758e76ab4468f470374f577bb2530d6ee53356d65d5d0773059b61076db22766f3a953cca550f2f0ede77bb74

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\64e94839-648a-4840-89e3-7402d16e4478.tmp

                                                                                                                                                      Filesize

                                                                                                                                                      40B

                                                                                                                                                      MD5

                                                                                                                                                      20d4b8fa017a12a108c87f540836e250

                                                                                                                                                      SHA1

                                                                                                                                                      1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                                                                                                                                                      SHA256

                                                                                                                                                      6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                                                                                                                                                      SHA512

                                                                                                                                                      507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\Network Persistent State

                                                                                                                                                      Filesize

                                                                                                                                                      396B

                                                                                                                                                      MD5

                                                                                                                                                      b0def02d41de7587356b94d0a96fd672

                                                                                                                                                      SHA1

                                                                                                                                                      5602ed42489e6d9ff827a0174d8345d11ca2f32c

                                                                                                                                                      SHA256

                                                                                                                                                      6569dea65a2e43f0e4acf2d2df1a081274aebf2299843d7564dddcb4c8b29733

                                                                                                                                                      SHA512

                                                                                                                                                      f696b5c4668473e78086b3c14aaeabb804f6f9d983915ddf396a23d70cb9c4055342c14a7c3febc4d62218f68945d30f8803c0b336d6df56ca4cf21b1be39abc

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\Network Persistent State

                                                                                                                                                      Filesize

                                                                                                                                                      427B

                                                                                                                                                      MD5

                                                                                                                                                      825807a6174e867a3be3ab9e5243cdcc

                                                                                                                                                      SHA1

                                                                                                                                                      12964351ae45879fe1309a854a2d2743adc47998

                                                                                                                                                      SHA256

                                                                                                                                                      5b57d4d0ed13cb9679a625928f7a47c554b9a2035a5b844599d5e5094bcf7a67

                                                                                                                                                      SHA512

                                                                                                                                                      443ae69b7f723a0713d19d26313a2d01786b0b0ed26eb87b71314c3251ad23660ced4a0038f9387a51426fe04e2999b459ace0b296099650bb0415cedae0ffab

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\Network Persistent State~RFe58eab9.TMP

                                                                                                                                                      Filesize

                                                                                                                                                      59B

                                                                                                                                                      MD5

                                                                                                                                                      2800881c775077e1c4b6e06bf4676de4

                                                                                                                                                      SHA1

                                                                                                                                                      2873631068c8b3b9495638c865915be822442c8b

                                                                                                                                                      SHA256

                                                                                                                                                      226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                                                                                                                      SHA512

                                                                                                                                                      e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\TransportSecurity

                                                                                                                                                      Filesize

                                                                                                                                                      188B

                                                                                                                                                      MD5

                                                                                                                                                      9ba4975964d3641cac49c41d8147fb17

                                                                                                                                                      SHA1

                                                                                                                                                      d0eaa236f1bb8a6b9176ac1d7381ee78714a7ebb

                                                                                                                                                      SHA256

                                                                                                                                                      6e985259c7de37de1d9f6936b5e7a6fb468d6ef1ea7e333afac6946a66d24456

                                                                                                                                                      SHA512

                                                                                                                                                      5b23453d2eeb19714c688f9f5cf2f5ce52b9da8b89ef1ee4f19b36805360757e2973f61455db68c991201f4c0878bdfefaba20e6d528975742de3801f3e1841d

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\TransportSecurity

                                                                                                                                                      Filesize

                                                                                                                                                      188B

                                                                                                                                                      MD5

                                                                                                                                                      0e6571319b8f9b9bbffb1e6628f422a1

                                                                                                                                                      SHA1

                                                                                                                                                      fe2bda67b6720bc44cb1e42eae730593169f8d73

                                                                                                                                                      SHA256

                                                                                                                                                      fc5527a390051c2de52c7575075bcf69d6d1e5c14761dc858b87572526b0b194

                                                                                                                                                      SHA512

                                                                                                                                                      e5b09a8daacd106c48e7472bd704898df90398b44068a35a35a4f24defb831e768d5a7cbacb2e846c88d1e6bf8a7a2e3317c1a58e0fcaec5dee5dcf87ddd112a

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Preferences

                                                                                                                                                      Filesize

                                                                                                                                                      6KB

                                                                                                                                                      MD5

                                                                                                                                                      a021dafdb85f7bdc2011d1838f7d2e08

                                                                                                                                                      SHA1

                                                                                                                                                      034e85a9005319437cddc7717c0a437d3ea05c75

                                                                                                                                                      SHA256

                                                                                                                                                      f8faf1484379f737c88f0c190125ffc375c9dbc83350c2142e42531276d64880

                                                                                                                                                      SHA512

                                                                                                                                                      0bcc81cd58e560546f7c255f43def936572a477a09972bb9e41ab842e2503cc53f4af26fe99adba2f02329fb4b652c832ee9566db3d8a9e7031d7e35524fce06

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Preferences

                                                                                                                                                      Filesize

                                                                                                                                                      6KB

                                                                                                                                                      MD5

                                                                                                                                                      aa5aae4d41497a35b81d79d2a8457433

                                                                                                                                                      SHA1

                                                                                                                                                      51e4c46f4db52cbebdeb18ea41e3eaf19fb4d4a3

                                                                                                                                                      SHA256

                                                                                                                                                      df112606e674e5cc95728b3488d2d9ff96410f57fbccb02fd126518c3545bc0d

                                                                                                                                                      SHA512

                                                                                                                                                      1f441b727d20545ecbc245a13fa909d5b6be4d345f74b1e7aba007d8d1fca6a3ae4112347dea075ec41adb6f9818e52bc15f2e85c220c178cd94ef7a0d61079d

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Preferences

                                                                                                                                                      Filesize

                                                                                                                                                      7KB

                                                                                                                                                      MD5

                                                                                                                                                      eb88bb11c3eb59f53b5e0051f6b2bc50

                                                                                                                                                      SHA1

                                                                                                                                                      277f573e4152c97baf6341e90b4aa1b93823e01b

                                                                                                                                                      SHA256

                                                                                                                                                      566db6fe3f68b497c755d82efb4063a14ea99fdc08a8aa736058e1e9c84d1a5e

                                                                                                                                                      SHA512

                                                                                                                                                      80738ad4c3748f7a43e6362101280e6bdbb1cc016c1c2f2d8ba9efd8c53b0a8373cf8cf97164d82de07d11c13790fcc5faac024d3fda0470ada42ecb13a3e1b0

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Preferences

                                                                                                                                                      Filesize

                                                                                                                                                      7KB

                                                                                                                                                      MD5

                                                                                                                                                      0d7a4bc2fbe8300737b803cb43f315e2

                                                                                                                                                      SHA1

                                                                                                                                                      1f6504f4731494952df09bbf83576e4a104b4a44

                                                                                                                                                      SHA256

                                                                                                                                                      f12ae5bfd9f57ff3e3ab6ad0ffa2b4ec339eaf3a9099282b06c38ab20fe96e30

                                                                                                                                                      SHA512

                                                                                                                                                      f2b1f7480e5087f30d52fff2be9d1d7d3d7e12b27575656b677675712c01c989f7c5e27e9150975d6c78ef6eaa35746f800a4ffe6ba795b509c221acabe3bbe2

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Preferences~RFe58e4be.TMP

                                                                                                                                                      Filesize

                                                                                                                                                      6KB

                                                                                                                                                      MD5

                                                                                                                                                      46976d5ce87a33e3b28ae0c0323fc538

                                                                                                                                                      SHA1

                                                                                                                                                      592873ee1a8e42024dd43a194b357563c72832e6

                                                                                                                                                      SHA256

                                                                                                                                                      fb22f9c3829e196cb3f5a4882a06c72fa7ce479ad4ffdb298f4151edae301c82

                                                                                                                                                      SHA512

                                                                                                                                                      766ce43f019d979fab44af816ea1b06832cf666858ea6e1f3931d63ddfa2f7dd13d0a99987c0f45e863d06cd8c9e7b21ff85c8406257272158deea02f93e1b97

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Secure Preferences

                                                                                                                                                      Filesize

                                                                                                                                                      6KB

                                                                                                                                                      MD5

                                                                                                                                                      03cea43af88b39d53ccd238ab8047598

                                                                                                                                                      SHA1

                                                                                                                                                      59848480fbb1f0d2bbd16ecd80f5b5b1fda87a97

                                                                                                                                                      SHA256

                                                                                                                                                      960bdec0bc8fd84e56d0f5cf5243c3db70e636a4129cdef94b8a788333c51ff3

                                                                                                                                                      SHA512

                                                                                                                                                      9092c366a7e4c9b9d101bf8f03bcf0237ce1a8229913dac6c4734da583a78f054bb6534987cad391cc6a8f850d8fd13b2b228232d22d1460813d182991fed2a2

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Site Characteristics Database\CURRENT

                                                                                                                                                      Filesize

                                                                                                                                                      16B

                                                                                                                                                      MD5

                                                                                                                                                      46295cac801e5d4857d09837238a6394

                                                                                                                                                      SHA1

                                                                                                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                      SHA256

                                                                                                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                      SHA512

                                                                                                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Last Version

                                                                                                                                                      Filesize

                                                                                                                                                      14B

                                                                                                                                                      MD5

                                                                                                                                                      96fb5f155aee0f8cd88274656c58ca83

                                                                                                                                                      SHA1

                                                                                                                                                      1fe86d9df188b0f86ae2d8da8f7c1ef663258baf

                                                                                                                                                      SHA256

                                                                                                                                                      06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91

                                                                                                                                                      SHA512

                                                                                                                                                      fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      19KB

                                                                                                                                                      MD5

                                                                                                                                                      a2f3eef19e3974c1b3d156d0f8709c0f

                                                                                                                                                      SHA1

                                                                                                                                                      cff07388555f7059cf0d38f354117c090d43650d

                                                                                                                                                      SHA256

                                                                                                                                                      9d1b03b6ae49446dad7a4abe3fcbe37538d999d32f1500d89e67433d959f6ea6

                                                                                                                                                      SHA512

                                                                                                                                                      11aeea8c3aec196640cf3aa74e65500dd86147052b13e050ca8deed5193c5daa65cbaa09bf4a6116bbdda4adcce9913f33cb2eaf5576f6c7e079d9f31986c689

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      1KB

                                                                                                                                                      MD5

                                                                                                                                                      51529bd167070eafd1c31533c8734a3e

                                                                                                                                                      SHA1

                                                                                                                                                      9f543b93a74e1ad2be6d5745cb445e7e6b9fc63d

                                                                                                                                                      SHA256

                                                                                                                                                      0fa27e51558e5a89e0a027fae48bf215cf3c9f698a04d1dbc8d9c84d34326b7d

                                                                                                                                                      SHA512

                                                                                                                                                      858df63dfc67877b84086630e42b6fadbdf699a33dc5028662e82dd828a76223970ad8785a1a532a17e91fd6caf26b6d624c0ba76590c5e22344b547f7b9a8c3

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      f84b2487db78594b0b7c8ab5e7f40525

                                                                                                                                                      SHA1

                                                                                                                                                      26052568ad9d287db04e95bfaa2b9652930f7d1d

                                                                                                                                                      SHA256

                                                                                                                                                      4c9adff3c6cf731e45b27027088c14e4e7a80d3bb901b12349ab6ed528366710

                                                                                                                                                      SHA512

                                                                                                                                                      2f07761daa53f2ea638f726626c072a4f6e0638dfc72ac266955f9bc0a29e7d6caa9ce01a6e3b986832aa5edf8de7ddde51538fa26e86c16f8db2077829816b9

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      16KB

                                                                                                                                                      MD5

                                                                                                                                                      3f14d9388c2b5ab82db5082620efe584

                                                                                                                                                      SHA1

                                                                                                                                                      c33fb858371b5516c0ff308bef42691d266c40ee

                                                                                                                                                      SHA256

                                                                                                                                                      8e0fc78e9ee919a8cc22d2740be9036243a75a1aa0d77e20c48e67142dfaa3fd

                                                                                                                                                      SHA512

                                                                                                                                                      119a05ec526852ceae4e54e2a1391badf17706890125ca62e718c055fd7e0b9f694d188e9c4894809c7c194d3c6abb3bcec42e4c4fcf871bfd57a49af2d6ab4b

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      3KB

                                                                                                                                                      MD5

                                                                                                                                                      ab005c605be71365d2862322c6833c75

                                                                                                                                                      SHA1

                                                                                                                                                      e6e92414290510b233ca196e38e7a0805c8b9c52

                                                                                                                                                      SHA256

                                                                                                                                                      5d5b9b317192412818db86b5ebc4c15f699d3b50e0edcdd9925b01abb90c57e6

                                                                                                                                                      SHA512

                                                                                                                                                      5bd34ba9dde7c6a9528575df513b310814b8a6a281df9daaaf7021f37495499e90a34206f08a2a877e3345bb631b8f5b550977c1b7aef1ba752a04a3bed0c531

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      17KB

                                                                                                                                                      MD5

                                                                                                                                                      0b86c45eceed6f19507e9813d64b5195

                                                                                                                                                      SHA1

                                                                                                                                                      10a66434f60cfa6cecd1e5fc60c287826f7c199b

                                                                                                                                                      SHA256

                                                                                                                                                      d0b12e49574a654b9489bb5369b93397909f8198cbe871ba6a36dec3bf94c6d8

                                                                                                                                                      SHA512

                                                                                                                                                      f326da8e1b131542bdc3b296e61f5f62e02e10f9c624d8829a2aeeeee706bb0ad1a5dfbf7a5e26bb1d1065602b8272c962bc4a69dc55c415ca847950e7cc680f

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      16KB

                                                                                                                                                      MD5

                                                                                                                                                      bb559f155fac2f2b9232e518e317632e

                                                                                                                                                      SHA1

                                                                                                                                                      8d1849c5078a275216f904d0ea661d8cac1eef2d

                                                                                                                                                      SHA256

                                                                                                                                                      ff4f89a161ec27569f5dc41eb1fbb98cc60da499d37f48b7befa853fb7d3d48a

                                                                                                                                                      SHA512

                                                                                                                                                      e0fa1556390997e213d5712789cf2efc813c12560f8fb395fe2458fc6157c6fb2dd2a9f555d37970d5b3e3d6d2542157e94ec9ea19999b676686cfe9cc201f1e

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Local State

                                                                                                                                                      Filesize

                                                                                                                                                      19KB

                                                                                                                                                      MD5

                                                                                                                                                      4c9cd324b9dec660f3b4263457616d4d

                                                                                                                                                      SHA1

                                                                                                                                                      ad0c224a091a61736104ee01e2fc9fbd70931074

                                                                                                                                                      SHA256

                                                                                                                                                      a5c98a84c50011c30e637fa3306526180ae8c72062f43c5c9cb8a8a77d19ac21

                                                                                                                                                      SHA512

                                                                                                                                                      249f1c78cd36070859bb7a020969f81814cdfd1f9297fbf3dc7f2a3273f8f2e87aa339c09c34c06525c92573133489263b743cbe075b93ebc148c33c7c908a8b

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Local State~RFe5843f9.TMP

                                                                                                                                                      Filesize

                                                                                                                                                      1KB

                                                                                                                                                      MD5

                                                                                                                                                      fc11f904a2571a2c411c5555530972b2

                                                                                                                                                      SHA1

                                                                                                                                                      7e8b80f59ab310a3c1538a92a56f09e21b3d2f76

                                                                                                                                                      SHA256

                                                                                                                                                      95439706aab56ea8a518fd812d87a0bfd2f4f7064e827b22ef145f548bdb8fcd

                                                                                                                                                      SHA512

                                                                                                                                                      d40766dde2433ea5ee442eb84000d4c418aecb08eeaad7962b5f4f1dd62b40b8dc097537647b30ff5c0fb53eee8c30769db4b9e49fd39f3017ad5275d2bf0cb0

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\PKIMetadata\22.0.0.0\ct_config.pb

                                                                                                                                                      Filesize

                                                                                                                                                      8KB

                                                                                                                                                      MD5

                                                                                                                                                      811b65320a82ebd6686fabf4bb1cb81a

                                                                                                                                                      SHA1

                                                                                                                                                      c660d448114043babec5d1c9c2584df6fab7f69b

                                                                                                                                                      SHA256

                                                                                                                                                      52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

                                                                                                                                                      SHA512

                                                                                                                                                      33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\PKIMetadata\22.0.0.0\kp_pinslist.pb

                                                                                                                                                      Filesize

                                                                                                                                                      11KB

                                                                                                                                                      MD5

                                                                                                                                                      0779206f78d8b0d540445a10cb51670c

                                                                                                                                                      SHA1

                                                                                                                                                      67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

                                                                                                                                                      SHA256

                                                                                                                                                      bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

                                                                                                                                                      SHA512

                                                                                                                                                      4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\ShaderCache\data_1

                                                                                                                                                      Filesize

                                                                                                                                                      264KB

                                                                                                                                                      MD5

                                                                                                                                                      a0fd12b78adab9bc5c9305e4afd07309

                                                                                                                                                      SHA1

                                                                                                                                                      97b4e8cbd2c3856c144cb0c178834862c8322e88

                                                                                                                                                      SHA256

                                                                                                                                                      41d72dadc3295e80c5bdc5dd8a363acb099b80b961ea07a448d12d80046393ba

                                                                                                                                                      SHA512

                                                                                                                                                      9f96554d6f63cef4b2da10ca885ff0505105ef9a3610d9fda2b867a24d3cab397bbb49fc1d0f93e181c1ab8389f0c3fb43bdd49fd61e1d1d6d05bc4f8f6fe46b

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\ShaderCache\index

                                                                                                                                                      Filesize

                                                                                                                                                      256KB

                                                                                                                                                      MD5

                                                                                                                                                      53e4f8cbc956bf1bf8f21984debd4014

                                                                                                                                                      SHA1

                                                                                                                                                      f9e192710cd8880edc0847413de92916af0110c0

                                                                                                                                                      SHA256

                                                                                                                                                      e54c1e381b509797f137b532b677106e2e8f2ca8ec550fb28bc91ed5483974c7

                                                                                                                                                      SHA512

                                                                                                                                                      687fd51b1d854172ed24bf09c822d6602bc47b63d32a53d1d6ba84d433ed0da769c8013c7188ff0e2614284297e326f0af55963e04822bb703c4a20077cd117c

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules

                                                                                                                                                      Filesize

                                                                                                                                                      1.8MB

                                                                                                                                                      MD5

                                                                                                                                                      d7c9c6d2e1d9ae242d68a8316f41198c

                                                                                                                                                      SHA1

                                                                                                                                                      8d2ddccc88a10468e5bffad1bd377be82d053357

                                                                                                                                                      SHA256

                                                                                                                                                      f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

                                                                                                                                                      SHA512

                                                                                                                                                      7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.57\LICENSE

                                                                                                                                                      Filesize

                                                                                                                                                      24KB

                                                                                                                                                      MD5

                                                                                                                                                      aad9405766b20014ab3beb08b99536de

                                                                                                                                                      SHA1

                                                                                                                                                      486a379bdfeecdc99ed3f4617f35ae65babe9d47

                                                                                                                                                      SHA256

                                                                                                                                                      ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

                                                                                                                                                      SHA512

                                                                                                                                                      bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

                                                                                                                                                    • C:\Users\Admin\AppData\Local\swift\EBWebView\Variations

                                                                                                                                                      Filesize

                                                                                                                                                      86B

                                                                                                                                                      MD5

                                                                                                                                                      961e3604f228b0d10541ebf921500c86

                                                                                                                                                      SHA1

                                                                                                                                                      6e00570d9f78d9cfebe67d4da5efe546543949a7

                                                                                                                                                      SHA256

                                                                                                                                                      f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

                                                                                                                                                      SHA512

                                                                                                                                                      535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

                                                                                                                                                    • C:\Users\Admin\Downloads\AutoExec.lnk

                                                                                                                                                      Filesize

                                                                                                                                                      860B

                                                                                                                                                      MD5

                                                                                                                                                      c6b9f3b758b5196475a817e492ae0f14

                                                                                                                                                      SHA1

                                                                                                                                                      a80151402cbd59d7a58a18ef9324a3bfc02714a0

                                                                                                                                                      SHA256

                                                                                                                                                      e8a7010d809ef76217257506067f1807ef5251f604e4a780775818f8e9ab9b00

                                                                                                                                                      SHA512

                                                                                                                                                      4e6ccfce77e78081a8afcf902e5bae0fac0a361b8a4776ffbe55317ec1da2d75c84d48d4ae6706217eebbc7f21f405fb5ea80e956213b556841839681709e3d6

                                                                                                                                                    • C:\Users\Admin\Downloads\Scripts.lnk

                                                                                                                                                      Filesize

                                                                                                                                                      853B

                                                                                                                                                      MD5

                                                                                                                                                      14b30415ccbf80685d0e45a6adbb7ec1

                                                                                                                                                      SHA1

                                                                                                                                                      dc656498a8e1b3722f3e5b7cd37f87ce44dacf0c

                                                                                                                                                      SHA256

                                                                                                                                                      cca0e1f978c4f98231863b9d0ff47f0362e3bbd3ca31d5688fd5bb87b8a6a17f

                                                                                                                                                      SHA512

                                                                                                                                                      8126b648f290e9ac1938e5cd51165713a3db4a76e732e9dfdd1e6de3c94c1fb3f7785b62039818821a806accb2b7b81e203483d206d0370ef123bca0c0935058

                                                                                                                                                    • C:\Users\Admin\Downloads\Swift-Module.dll

                                                                                                                                                      Filesize

                                                                                                                                                      22.5MB

                                                                                                                                                      MD5

                                                                                                                                                      c568dbc5fd90067a6712055023a18568

                                                                                                                                                      SHA1

                                                                                                                                                      1546683eb7ed167b54b9e4fb0a8ae72374f688e8

                                                                                                                                                      SHA256

                                                                                                                                                      ed927320654bccb0164b7c1e8835975ec9f680d607cfea982c7a0a103684d188

                                                                                                                                                      SHA512

                                                                                                                                                      72da4af29fd9aeda9851fc0a0a4ffc8a5b35f260074f2203381a760c94e4b836fe28b11186a6d3cca4d01de65893c0063edfcf355268b689330915ab66339816

                                                                                                                                                    • C:\Users\Admin\Downloads\Swift.exe.crdownload

                                                                                                                                                      Filesize

                                                                                                                                                      20.1MB

                                                                                                                                                      MD5

                                                                                                                                                      532e28bfd55208ef66d609a48a65cf91

                                                                                                                                                      SHA1

                                                                                                                                                      5da3a7f1a437cae4109b4c052b7de697bc58a674

                                                                                                                                                      SHA256

                                                                                                                                                      3b19486b4e14b206ec8ab2602ec6a430f9fce7ef40247b1e1f4c6f004ee468b4

                                                                                                                                                      SHA512

                                                                                                                                                      10c57c4bd1c18242405bb7ac89361121b6169f3444122dbef246e4605b0f793f205a9fb36f5a8d820e9c8617bddb9df65b9590acbaada19a89ac7a064a23a0f1

                                                                                                                                                    • C:\Users\Admin\Downloads\Swift.exe:Zone.Identifier

                                                                                                                                                      Filesize

                                                                                                                                                      26B

                                                                                                                                                      MD5

                                                                                                                                                      fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                                                                                      SHA1

                                                                                                                                                      d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                                                                                      SHA256

                                                                                                                                                      eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                                                                                      SHA512

                                                                                                                                                      aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                                                                                    • C:\Users\Admin\Downloads\Workspace.lnk

                                                                                                                                                      Filesize

                                                                                                                                                      865B

                                                                                                                                                      MD5

                                                                                                                                                      7c17d009a59f2b662e6043c5bd845908

                                                                                                                                                      SHA1

                                                                                                                                                      89b5930cf0dbd9e1b40cad43b84597ceb56e82d0

                                                                                                                                                      SHA256

                                                                                                                                                      990651ab6aa61083a4f08cfcf267f5d6fbb4606fd3060e118d61fb9021fde68c

                                                                                                                                                      SHA512

                                                                                                                                                      33ee773c9dba450a7305492be0a5182914a8c8b65eec3cf3484e2767660460d6bd073cca460e50f33d9be322742da0512f7e27267aa313bbe7be25619d3254e4

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1411137087\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      85B

                                                                                                                                                      MD5

                                                                                                                                                      c3419069a1c30140b77045aba38f12cf

                                                                                                                                                      SHA1

                                                                                                                                                      11920f0c1e55cadc7d2893d1eebb268b3459762a

                                                                                                                                                      SHA256

                                                                                                                                                      db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

                                                                                                                                                      SHA512

                                                                                                                                                      c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1440291455\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      43B

                                                                                                                                                      MD5

                                                                                                                                                      af3a9104ca46f35bb5f6123d89c25966

                                                                                                                                                      SHA1

                                                                                                                                                      1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

                                                                                                                                                      SHA256

                                                                                                                                                      81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

                                                                                                                                                      SHA512

                                                                                                                                                      6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1622606736\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      160B

                                                                                                                                                      MD5

                                                                                                                                                      a24a1941bbb8d90784f5ef76712002f5

                                                                                                                                                      SHA1

                                                                                                                                                      5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

                                                                                                                                                      SHA256

                                                                                                                                                      2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

                                                                                                                                                      SHA512

                                                                                                                                                      fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1642754153\LICENSE

                                                                                                                                                      Filesize

                                                                                                                                                      1KB

                                                                                                                                                      MD5

                                                                                                                                                      ee002cb9e51bb8dfa89640a406a1090a

                                                                                                                                                      SHA1

                                                                                                                                                      49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

                                                                                                                                                      SHA256

                                                                                                                                                      3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

                                                                                                                                                      SHA512

                                                                                                                                                      d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1642754153\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      79B

                                                                                                                                                      MD5

                                                                                                                                                      7f4b594a35d631af0e37fea02df71e72

                                                                                                                                                      SHA1

                                                                                                                                                      f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

                                                                                                                                                      SHA256

                                                                                                                                                      530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

                                                                                                                                                      SHA512

                                                                                                                                                      bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1750896361\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      160B

                                                                                                                                                      MD5

                                                                                                                                                      c3911ceb35539db42e5654bdd60ac956

                                                                                                                                                      SHA1

                                                                                                                                                      71be0751e5fc583b119730dbceb2c723f2389f6c

                                                                                                                                                      SHA256

                                                                                                                                                      31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

                                                                                                                                                      SHA512

                                                                                                                                                      d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1822388264\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      135B

                                                                                                                                                      MD5

                                                                                                                                                      4055ba4ebd5546fb6306d6a3151a236a

                                                                                                                                                      SHA1

                                                                                                                                                      609a989f14f8ee9ed9bffbd6ddba3214fd0d0109

                                                                                                                                                      SHA256

                                                                                                                                                      cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5

                                                                                                                                                      SHA512

                                                                                                                                                      58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_2014423724\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      134B

                                                                                                                                                      MD5

                                                                                                                                                      049c307f30407da557545d34db8ced16

                                                                                                                                                      SHA1

                                                                                                                                                      f10b86ebfe8d30d0dc36210939ca7fa7a819d494

                                                                                                                                                      SHA256

                                                                                                                                                      c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

                                                                                                                                                      SHA512

                                                                                                                                                      14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_2028121958\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      176B

                                                                                                                                                      MD5

                                                                                                                                                      6607494855f7b5c0348eecd49ef7ce46

                                                                                                                                                      SHA1

                                                                                                                                                      2c844dd9ea648efec08776757bc376b5a6f9eb71

                                                                                                                                                      SHA256

                                                                                                                                                      37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

                                                                                                                                                      SHA512

                                                                                                                                                      8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_735899303\manifest.fingerprint

                                                                                                                                                      Filesize

                                                                                                                                                      66B

                                                                                                                                                      MD5

                                                                                                                                                      dee9d3bdd016c697d11e370a995e7332

                                                                                                                                                      SHA1

                                                                                                                                                      ef13d667efd507e160de165f4f1fe918fc728ca2

                                                                                                                                                      SHA256

                                                                                                                                                      a84789942c4436967dba5d0ce45a3f6767bcfebf67b951fbef75cca32e9acd96

                                                                                                                                                      SHA512

                                                                                                                                                      1c798ed77fcaccc5ec237cb6618e6425fb7dbbe5f22b2a969b915987fda4be8ecadc265871832f0b7f9b5656433c27f8495eceb16598294fab80e709b2cb3d68

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1213849776\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      116B

                                                                                                                                                      MD5

                                                                                                                                                      2188c7ec4e86e29013803d6b85b0d5bb

                                                                                                                                                      SHA1

                                                                                                                                                      5a9b4a91c63e0013f661dfc472edb01385d0e3ce

                                                                                                                                                      SHA256

                                                                                                                                                      ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62

                                                                                                                                                      SHA512

                                                                                                                                                      37c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1444119020\_metadata\verified_contents.json

                                                                                                                                                      Filesize

                                                                                                                                                      1KB

                                                                                                                                                      MD5

                                                                                                                                                      28706ad42e4c615a683c2494bc0bd2af

                                                                                                                                                      SHA1

                                                                                                                                                      6b0465b3d5e85a3ea76c646ba8652c4dc0248dc0

                                                                                                                                                      SHA256

                                                                                                                                                      709bbb3e3a17e2b7bbf9f4afdcf465312695342ce4eb203df284233eacee086f

                                                                                                                                                      SHA512

                                                                                                                                                      e95da92f1ad5f56ef61a5992a1b465d46f36eff1fc85643cc5ab3f357b6f14d81a5b5590d0e18d4da5fcc3ac537a469fd0c15b116a3471536707a9716119fa5f

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1444119020\manifest.fingerprint

                                                                                                                                                      Filesize

                                                                                                                                                      66B

                                                                                                                                                      MD5

                                                                                                                                                      5ddbc1878fe757e9fb5be515f8f95864

                                                                                                                                                      SHA1

                                                                                                                                                      fa7d42b5adf36a370a95a0abaa20c6094b2b47f8

                                                                                                                                                      SHA256

                                                                                                                                                      a0b13e5ecb7638ffd1e054301fef148b47ea17bc528779c56d77d4e7a6152983

                                                                                                                                                      SHA512

                                                                                                                                                      ae2a76a48c46a90085a46cf03eca6576ccfdff6d76c64f095c2d657641c73054581b3e8c8738d751f2f8465fe6a2298e01188f807175fd7f4d1995078c7bc1a5

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1779532449\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      76B

                                                                                                                                                      MD5

                                                                                                                                                      ba25fcf816a017558d3434583e9746b8

                                                                                                                                                      SHA1

                                                                                                                                                      be05c87f7adf6b21273a4e94b3592618b6a4a624

                                                                                                                                                      SHA256

                                                                                                                                                      0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

                                                                                                                                                      SHA512

                                                                                                                                                      3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-as.hyb

                                                                                                                                                      Filesize

                                                                                                                                                      703B

                                                                                                                                                      MD5

                                                                                                                                                      8961fdd3db036dd43002659a4e4a7365

                                                                                                                                                      SHA1

                                                                                                                                                      7b2fa321d50d5417e6c8d48145e86d15b7ff8321

                                                                                                                                                      SHA256

                                                                                                                                                      c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

                                                                                                                                                      SHA512

                                                                                                                                                      531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-hi.hyb

                                                                                                                                                      Filesize

                                                                                                                                                      687B

                                                                                                                                                      MD5

                                                                                                                                                      0807cf29fc4c5d7d87c1689eb2e0baaa

                                                                                                                                                      SHA1

                                                                                                                                                      d0914fb069469d47a36d339ca70164253fccf022

                                                                                                                                                      SHA256

                                                                                                                                                      f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

                                                                                                                                                      SHA512

                                                                                                                                                      5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-nb.hyb

                                                                                                                                                      Filesize

                                                                                                                                                      141KB

                                                                                                                                                      MD5

                                                                                                                                                      677edd1a17d50f0bd11783f58725d0e7

                                                                                                                                                      SHA1

                                                                                                                                                      98fedc5862c78f3b03daed1ff9efbe5e31c205ee

                                                                                                                                                      SHA256

                                                                                                                                                      c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

                                                                                                                                                      SHA512

                                                                                                                                                      c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      82B

                                                                                                                                                      MD5

                                                                                                                                                      2617c38bed67a4190fc499142b6f2867

                                                                                                                                                      SHA1

                                                                                                                                                      a37f0251cd6be0a6983d9a04193b773f86d31da1

                                                                                                                                                      SHA256

                                                                                                                                                      d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

                                                                                                                                                      SHA512

                                                                                                                                                      b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2134529957\manifest.fingerprint

                                                                                                                                                      Filesize

                                                                                                                                                      66B

                                                                                                                                                      MD5

                                                                                                                                                      496b05677135db1c74d82f948538c21c

                                                                                                                                                      SHA1

                                                                                                                                                      e736e675ca5195b5fc16e59fb7de582437fb9f9a

                                                                                                                                                      SHA256

                                                                                                                                                      df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

                                                                                                                                                      SHA512

                                                                                                                                                      8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_595576979\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      1003B

                                                                                                                                                      MD5

                                                                                                                                                      578c9dbc62724b9d481ec9484a347b37

                                                                                                                                                      SHA1

                                                                                                                                                      a6f5a3884fd37b7f04f93147f9498c11ed5c2c2d

                                                                                                                                                      SHA256

                                                                                                                                                      005a2386e5da2e6a5975f1180fe9b325da57c61c0b4f1b853b8bcf66ec98f0a0

                                                                                                                                                      SHA512

                                                                                                                                                      2060eb35fb0015926915f603c8e1742b448a21c5a794f9ec2bebd04e170184c60a31cee0682f4fd48b65cff6ade70befd77ba0446cc42d6fe1de68d93b8ea640

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_62905414\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      114B

                                                                                                                                                      MD5

                                                                                                                                                      e6cd92ad3b3ab9cb3d325f3c4b7559aa

                                                                                                                                                      SHA1

                                                                                                                                                      0704d57b52cf55674524a5278ed4f7ba1e19ca0c

                                                                                                                                                      SHA256

                                                                                                                                                      63dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d

                                                                                                                                                      SHA512

                                                                                                                                                      172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_763014261\crs.pb

                                                                                                                                                      Filesize

                                                                                                                                                      289KB

                                                                                                                                                      MD5

                                                                                                                                                      2b59269e7efdd95ba14eeb780dfb98c2

                                                                                                                                                      SHA1

                                                                                                                                                      b3f84cbc37a79eeecb8f1f39b615577d78600096

                                                                                                                                                      SHA256

                                                                                                                                                      ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

                                                                                                                                                      SHA512

                                                                                                                                                      e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_763014261\manifest.json

                                                                                                                                                      Filesize

                                                                                                                                                      102B

                                                                                                                                                      MD5

                                                                                                                                                      a64e2a4236e705215a3fd5cb2697a71f

                                                                                                                                                      SHA1

                                                                                                                                                      1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

                                                                                                                                                      SHA256

                                                                                                                                                      014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

                                                                                                                                                      SHA512

                                                                                                                                                      75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

                                                                                                                                                    • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_895875491\manifest.fingerprint

                                                                                                                                                      Filesize

                                                                                                                                                      66B

                                                                                                                                                      MD5

                                                                                                                                                      3fb5233616491df0ec229ba9f42efdb8

                                                                                                                                                      SHA1

                                                                                                                                                      18a8116e2df9805accd7901d2321c3fa92da1af4

                                                                                                                                                      SHA256

                                                                                                                                                      946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52

                                                                                                                                                      SHA512

                                                                                                                                                      e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d

                                                                                                                                                    • memory/496-648-0x0000025AF3230000-0x0000025AF337F000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1.3MB

                                                                                                                                                    • memory/1936-951-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/1936-973-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/1936-885-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/1936-597-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/1936-598-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/1936-832-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/1936-599-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/1936-619-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/1936-1004-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/1936-632-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/1936-618-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/1936-1026-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/2508-2519-0x0000012FFFCE0000-0x0000012FFFD00000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                    • memory/2508-2621-0x00000127B3B90000-0x00000127B3C90000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                    • memory/2508-2503-0x0000012FFF400000-0x0000012FFF420000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                    • memory/2508-2506-0x0000012FFFDA0000-0x0000012FFFEA0000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                    • memory/2508-2625-0x00000127B3B90000-0x00000127B3C90000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                    • memory/3392-823-0x00007FFB07B80000-0x00007FFB07B81000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                    • memory/3464-719-0x00007FFB07B80000-0x00007FFB07B81000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                    • memory/3492-628-0x00000252E9C10000-0x00000252E9C32000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      136KB

                                                                                                                                                    • memory/3492-635-0x00000252EA010000-0x00000252EA15F000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1.3MB

                                                                                                                                                    • memory/3544-2118-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1864-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1231-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1510-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1460-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-2184-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1198-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-2241-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1387-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1357-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1199-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1200-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1201-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-2819-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-2011-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-2436-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1431-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1893-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-1566-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3544-2077-0x0000000140000000-0x00000001437AD000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      55.7MB

                                                                                                                                                    • memory/3548-2130-0x00000208B9600000-0x00000208B9601000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                    • memory/3548-2129-0x00000208B9600000-0x00000208B9601000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                    • memory/3548-2136-0x00000208B9600000-0x00000208B9601000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                    • memory/3548-2128-0x00000208B9600000-0x00000208B9601000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                    • memory/3548-2134-0x00000208B9600000-0x00000208B9601000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                    • memory/3548-2140-0x00000208B9600000-0x00000208B9601000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                    • memory/3548-2139-0x00000208B9600000-0x00000208B9601000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                    • memory/3548-2138-0x00000208B9600000-0x00000208B9601000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                    • memory/3548-2137-0x00000208B9600000-0x00000208B9601000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                    • memory/3548-2135-0x00000208B9600000-0x00000208B9601000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                    • memory/4620-660-0x000001AA67920000-0x000001AA67A6F000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1.3MB