Malware Analysis Report

2024-10-10 07:26

Sample ID 240611-nrfqaavgrf
Target sample
SHA256 f91d32810260f25e95f93341f8ed47d6ca2d554ce9dbca78ab553a66117aedf6
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

f91d32810260f25e95f93341f8ed47d6ca2d554ce9dbca78ab553a66117aedf6

Threat Level: No (potentially) malicious behavior was detected

The file sample was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

Suspicious behavior: LoadsDriver

Suspicious use of SendNotifyMessage

Uses Task Scheduler COM API

Checks processor information in registry

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-11 11:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 11:37

Reported

2024-06-11 11:40

Platform

win11-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html

Signatures

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3016 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 1188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 3228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 3228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3016 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffc2d763cb8,0x7ffc2d763cc8,0x7ffc2d763cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14387995553364151289,858978572801159387,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1864 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,14387995553364151289,858978572801159387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,14387995553364151289,858978572801159387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14387995553364151289,858978572801159387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14387995553364151289,858978572801159387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.0.1316055155\1499854275" -parentBuildID 20230214051806 -prefsHandle 1752 -prefMapHandle 1744 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae5b9176-b523-4524-8e77-5986fea68b3b} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 1832 25f1f025b58 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.1.336057283\955894247" -parentBuildID 20230214051806 -prefsHandle 2328 -prefMapHandle 2324 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c4a9e74-e4c0-44d3-ac27-e188f43c7e56} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 2356 25f12289658 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.2.1705847552\2049734800" -childID 1 -isForBrowser -prefsHandle 2920 -prefMapHandle 2984 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99109e72-247e-4393-970b-7ac5e56784dc} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 2756 25f219d9b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.3.205433411\961972006" -childID 2 -isForBrowser -prefsHandle 3576 -prefMapHandle 3572 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b04c49f-95e2-47be-970a-efbb72d36f70} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 3588 25f24a36b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.4.771520193\93906941" -childID 3 -isForBrowser -prefsHandle 4984 -prefMapHandle 5004 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7424e895-ed2d-4eed-8e1c-e192eb18e16e} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 5016 25f26961c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.5.1146958561\292129384" -childID 4 -isForBrowser -prefsHandle 5160 -prefMapHandle 5164 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a745ff4-394d-4c6d-94c0-05ed13460504} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 5148 25f26962258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.6.1522341870\1229845542" -childID 5 -isForBrowser -prefsHandle 5436 -prefMapHandle 5432 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2166848-78e2-4fc8-854f-28e87c80a4a9} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 5444 25f26f13158 tab

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.youtube.com udp
N/A 127.0.0.1:49834 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
N/A 127.0.0.1:49840 tcp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 push.services.mozilla.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f2eb94e31cadfb6eb07e6bbe61ef7ae
SHA1 3f42b0d5a90408689e7f7941f8db72a67d5a2eab
SHA256 d222c8e3b19cda2657629a486faf32962e016fc66561ce0d17010afdb283c9de
SHA512 9f7f84149885b851e0bf7173c540e466a2b2eb9907d8b608f60360933328cc75d9d1b63640ea4ecc1e64ecc5dd7ee74d82903f96a8b4418ca56296641a8c0703

\??\pipe\LOCAL\crashpad_3016_JMRMKOLNPYMGNTXK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d56e8f308a28ac4183257a7950ab5c89
SHA1 044969c58cef041a073c2d132fa66ccc1ee553fe
SHA256 0bc24451c65457abc1e4e340be2f8faceae6b6ec7768a21d44bcd14636543bae
SHA512 fd5798559f4025ec3408f5550b8671d394b1ec83b85fdac8c005b0cc3e183272bdd07db15a156a572c9c5e5798badf235dc10aae62a052efa8dd9dfdbdca8189

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dafc2bd97d1f509d59ae17465abfa863
SHA1 690f82982cdecec53fba75f8f92cfcbf5550fe67
SHA256 9bc34598f0a5ed291119fa06390119273ec085b739bc8b01412f066a19cd9a53
SHA512 bf0658b81bb38874cc7d2dbbd005399003ea45061fa4b17fb6e0e407089468b1bd7868a0d75197f173fe562341cd37dbbba489e3624acb7bb9b39b7c5c68a31f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 62675346c7e6632193dfda996c2478f5
SHA1 bad5b233cb4601e89ef5aba99a84def3c209f700
SHA256 88e1f86b302e47f73ee420dd01f0a8d0fb1963d1fed42e57aee3168237e02c68
SHA512 102f43692b9d4c3a35292f1996c089c2182c78d6a3cba24713e0884b3acd24a04a61b83249ea2e60952e5437331443b85235c098a0ec95140e24e614c603d312

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5d1cdc496329597a031722a7d8a8d5ea
SHA1 05469a70b122f28d0d0f25b4d30bc46521d41564
SHA256 a6dd9a603731923c01745fa7a3c8754e67677d9522c50782e810c71c8b5732ae
SHA512 0195cd17c2d31b8303e273640455ea4efa338ff8835474a39731ddfe537cdb8f48b26a976e13842da41be8c5ffa14331b1fa873af6689bc17d51ed9f832cb6ad

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs.js

MD5 f1176ff449271e9704760c36ff983f50
SHA1 228c3911af1d6d69593a150d4a9cdc27c008c088
SHA256 37718ba3bd709e613973f10e7c9e425f8d50944523458ef00977a255ad7cf52f
SHA512 d415639828e2e34287890c312eabc800d77eee04f912e5bc19a6ca684dd7a380d728c4f725f8cf8ec66ee13da9b8457fb97fe6fea69675424fb0332e196074f5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs-1.js

MD5 8b6e4f0ab91c99bb5ec0c21da16856c4
SHA1 6b4e78e1f1b4f37e5c91db9c9be158bb909dad42
SHA256 68f192e6b9c1fb45f056691da3811c7d51cad7e1fe0e60db50ea39e7da365ff7
SHA512 1f2a5a29c9798b674f715f6b4de12f6d15b4da5e2bc1733e803a167f3cc67d131c28c04500e6284e07d7954942537492cd51e09d868e354ebfcaf4e50c037de2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg2c1myw.default-release\activity-stream.discovery_stream.json.tmp

MD5 f2b09c9bbac325d8e217f707b3bb88d3
SHA1 368bc7eda64c9f49b8265a6ece4674143cb535e6
SHA256 009f0a6c6e6d015411b22f2c51274ce06abb8db3cd413a531c1506f5c921ac44
SHA512 fe5d325eb058c1f373aa01090327924e53bda500edc3cc62c2c652f94a7e209b69721e220a89ad3e3c7709142d4632b89364c4798d1a6c89f505def0b7ed315e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4

MD5 da98f6f47f367e3ae5067d2a780b3d22
SHA1 adade124e3fdf1a4676adead5257308f7882156e
SHA256 70b9711b6771d3b58edfac1abaa34bcebd2f4d24d9e54eb6edc648d4ddb4086f
SHA512 05d51a0ee70ba798d63c34361b8b0e0ada2b21eb6e9251c6a7b044554a98594c25071b0e051ab1ad5e352146b22321a71b1abef01bf7ab3f6be0531a869c612b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionCheckpoints.json.tmp

MD5 700fe59d2eb10b8cd28525fcc46bc0cc
SHA1 339badf0e1eba5332bff317d7cf8a41d5860390d
SHA256 4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea
SHA512 3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore.jsonlz4

MD5 f61d90ade1718050a84a08f9c7e7ce72
SHA1 a62b0e8d03f33ad94bacd7ddc72739e1c719e8ae
SHA256 bbc1e93ab60b9db857c52997994961096ce5ff0658c8d121acfc7414ee6ab3de
SHA512 1ce5e2945732cc896028f983eda6a74c3336c713c60a8fea7c8a05e34a0cab595019831ac9795f6f230306034beb1abdb1fa268833746c36506417048eec1437

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 e9aa12ff0be6d995ed86f8cf88678158
SHA1 e5ee38fc2ebef0fcbc3059dee29b39f7daf21931
SHA256 f35cd8ef03ac924a59943c5dfffc31ab67a8b5aff272e9f47ff776aabc7ee561
SHA512 95a67acd2a4784b87d73910c1f1f590937c9d9b901e98448556a37eb8137ae5f458f1c673d65a46cf7d6b90bee5fe6b102ce3eeac9e819062cd9c5c2418bcbfc

C:\Users\Admin\Downloads\SendMeasure.mp2v

MD5 90fa973ad593a979bcd3d5635cfe2e15
SHA1 a36432fef3b02fc02a0bef99363f27aa61d43697
SHA256 f117a3f402faaefcac2b2a4281747cf96d3615ada215e923a6ac5fc305169b4c
SHA512 d0151d5bc0ef3c5f9c1761f0cf9f588e68fed9c32ef5901b94d0985aae5c1b3a8aab500972bf514487c0a41140f75ac87b0cde8a6c0674cd4f0042fc977fdfff

C:\Users\Admin\Downloads\UndoExport.edrwx

MD5 6a29e28ed8abdd53377f13def7ba74cd
SHA1 3203e66969c48fe3ac5c6499ae18310ab1133636
SHA256 2e5feb1b19856f9b978dc157c89da8ce92c411dc68428d6536d8cc3856fe9f94
SHA512 abec47131034d85631bcb46f0ba8b51de2d64f1e7982f571cae0438d01e8847797c8194e6a43156e87f9fe4e8e1d9e598c68b8e004e63e36c548fd6a57d2dc66

C:\Users\Admin\Downloads\InvokeMerge.vst

MD5 d03f05b46546628aad49c8dee3980735
SHA1 1f23d1a3041e1538fb0a532052d2793e90f450c4
SHA256 0f8e468141d14ad1723699582ff156c42da4872b005b8a5d046cc3699bbd42c6
SHA512 65aab3e5d1cd1953d62edc9497135496fa9eb010751105e58e8c1d185701b5262e6e757a7228bfd7bd8d628f9f151d44ae8e0101872ea2e97ea97b7b59fde7e7

C:\Users\Admin\Downloads\SubmitConnect.mpeg2

MD5 2545e6769a0f80e6d2b294b2aec410fc
SHA1 e8dbc00693695ca34f4320cb6c5fb7172c68678a
SHA256 3dbebaaab5f1890b200955c45641c9669e76dc71c9c983efb63f25b34cae54b5
SHA512 b37ccf1927d316a7e8e4c1d2b89a8e74bafdd654eda9b4c74be2f474a804b4b807c8718bef5b5d46edcd4f666c19c429da7046ae170a5aee85733c8d884612a5

C:\Users\Admin\Downloads\InitializeImport.php

MD5 6765d6b69c2b17ed1906bb2955b6e4c0
SHA1 a5d8a593b7b21988f572a128738741f4a73be925
SHA256 cc09ff879761eb62dd8a973beb8871f0e9c88600a7083a35179f4c2fc415ec9c
SHA512 e8da5391774bb33af8b1ffadc7f99ae4db1721714a25c49e0aac600277d5190727f63b283f9c96d8b2f2025e164457b781c6dc83d453ffb841d9e746ca27cfc6

C:\Users\Admin\Downloads\ProtectPush.pcx

MD5 19dcc97a643fbd98f6b2a628e8a593cd
SHA1 dbcbb53982d7a222261c027bcfab27e5c45dbd2e
SHA256 41bb4b52a9bfe778f60c94fb805e84d5f5014972348a8963d0b2b02372f358ad
SHA512 217975cab79cc6cfdd875f14bf7877e838071ae135d7cef1cc8981a8e76c2af46951c818f0cc4e509b786b91c31f6cb5f26fd4be0361858b3c42fd17332fa3db

C:\Users\Admin\Downloads\ExitPop.bat

MD5 128bce1121e3e6390382c83a1cc32114
SHA1 73eaa5f5926bb11367113d13d287c65c5f23fefa
SHA256 52cb06708ddd2aa66afa99f842e951411379b8107a5f7574dfef2a60830fdf5f
SHA512 2b311861f21b27460ba1648ddded8430039a8c81b27691dd61d826525bb3c457b8f3b003b9dfe0def81598913feab98cbc2be208a642529b919c3fc9e07aa6d5

C:\Users\Admin\Downloads\SwitchOpen.AAC

MD5 d57c98bf9ee72965a9d41bc85810ef65
SHA1 58a115a437493faeb5117279ed63c000334c6cc8
SHA256 3dff58f6f3b55baa5e56eb3befb73e33093a2acbdc8930c9fdeb4821a09c783a
SHA512 a2bb16a2f1be7acb34d98a89623a4033cb11bcc78e887a327e26a6499f5fc9b17c820f81d57b36b263f36c193128ed3b10882db799f441f19a0457863dfe333e

C:\Users\Admin\Downloads\SyncClose.dotm

MD5 744f4367d6c247aee8adbb3510a65f62
SHA1 21a8268d3e2eaa9a1d7f5985384b7fe34e8f1382
SHA256 d2d7f00fb41b0cc328eb26023ed27711fe2d7ce81600c56139bacc8e360774b7
SHA512 c8ead0002256c5cf6d68b50b34d50e7e229fa4781c4969b2454087b66f91f2d121d2a776530882781c74cdd8958a1940acc6c15a110fcfbb833c3b57463480a2

C:\Users\Admin\Downloads\PingHide.ppsx

MD5 707848f34ad0e080609714d76f99a51d
SHA1 52355aee690c55af33a42b960f20cacc847c726d
SHA256 9c5afd2b9fd35f2a4763b22a28caa97463e7f9fa73b9f2a899b3297007dd1883
SHA512 a1266725df815a612dadb2c3b438a27b48b4a272a73c37f3ba656e78a6104428825d5268c0cd7f9a865958bba399fed4af4132280a7c05a1259713ce6339b450

C:\Users\Admin\Downloads\ResetUninstall.xht

MD5 9341f6d18ccbe458dc268bed524369e5
SHA1 8e1a4155c1faeefee378a1aae777ed9bcb32d73e
SHA256 77f537c12cd88ed95b8e3512df12b58e3e734ee818021b6a461e280ba6fe5134
SHA512 19fed03e75a4c450bd14e1dc958a7e43f50072947f639040a1f2380a03b9fbd79a4b8d2302958d21d84dd9d2b580034339b4812026f22ef2bec476a3d5f34ab1

C:\Users\Admin\Downloads\SyncEdit.csv

MD5 02b79540a613722ed6cbd742493a302a
SHA1 2aceee512e0d6764dedfc47798b8b584221d1ac1
SHA256 3561070965b4d8586aca0c711c4588f3d904d06371e4658ecb58badc9c4810fe
SHA512 ae7e20c7d67b7564ff918aff1ed6335592dc173b1ef8a1ac1121e285e0be2c49a9f4b1e1255da97713bc0d658cf6b5dd1ff2a5cd9cd32a034df1696419ded628

C:\Users\Admin\Downloads\CompareSelect.mpg

MD5 9e786b58714a4b4febca194c9f6cb5a4
SHA1 8b0214a2ca1a23a6e8ec3090c302da97ab5638f5
SHA256 540bb0147ab905e105c43744bbb7f0cbcdf12f786e8d4f50784c3b4b08f3eb00
SHA512 9fd4e9bc323338e557f7bdea5175cabfc369d130fbcdafb060aaa7d0cb9c79a0e43759bdbed74ee292cbf949f4b590ef64a99150e62c04e231c37c96ee216e00

C:\Users\Admin\Downloads\ResolveExport.mp4

MD5 97a84486639c7ba65dc70310596305bb
SHA1 7680925a223f40fb310dcf664aca8b6d7f52bc7a
SHA256 f3c5d346d7bf2549c5bfa13b8ab9732e9fd8058ba544d17044df513a9c8503ff
SHA512 07074f964f96ea00429f84053243bfb6bd73ed27ca20836096ad1532179e58073cf82af5d02a4808f1ad4a5ee47ade16ce3797305c5d6bb60b185f5aa98a827c

C:\Users\Admin\Downloads\SuspendMount.zip

MD5 9ad58fae2cd561dac3012b9b08afff51
SHA1 ef452de266bd9a1b6743cdd2e48f13616112e5e0
SHA256 5bd78e5d0da905da4ee6481a77a3697c256affb2ba3ad7fb5fdf89214d6aba93
SHA512 30d8e37420722b82008ed248cb3efc726fb7d74565514165f7fbd4ce8e73b64251a81592ad84d55b48d4ef71e10b735d0db9d92e929680b8c7716869cd34199a

C:\Users\Admin\Downloads\InvokeOut.xla

MD5 60180132a0c10fc05a10c139050ac5c8
SHA1 5d12e1b221842f0c34641f2f6e37f81f121067e3
SHA256 cbedfb02a2c7cde453cc5693260d8c6a8032c6b181eb9d3760570014b687211c
SHA512 0bb359fc03fee810ebdde600837eb9477de3c1974197890ced5e785d8f7cbe7bacfea22cb86b939d509af06a4005a86d260b93d027dc566e0c9c3ba2a1c44706

C:\Users\Admin\Downloads\RepairGrant.tmp

MD5 ba9a3171228d8a7d1087c0ab6ead139f
SHA1 ddc6695fe165b430b668b5e61cb32e1f9c0e0f9b
SHA256 faa20ec716216fecb3285f1db0ff767f8c613b7c08b1bc87743003b74ee686bd
SHA512 73c57379becd1be1de166b72005d954d0452d61a4561d025e9701726a1662aa151b866faa835b337fff8c44e5cd1ff479b5c121e336583f2193b78259ef93f6c

C:\Users\Admin\Downloads\StopSkip.reg

MD5 e96a2b00ff8927bca50945ca7ab30a3d
SHA1 512191293611ec2f10540a81cd9b445b90207dde
SHA256 94d52be168baf8a83e78b22452a2da07b5234f8be2419f7f3bb075a1cbd8d5b1
SHA512 8bcab34fd3d837f07e2236659465e3c3ae4f31b3bb6bbcc8883afc0e456bc5ef74978a18f2573760b2b7afece20bfd72957550ecabd3e3df40449de1cdcf0da3

C:\Users\Admin\Downloads\SkipSet.ini

MD5 42a182fe3524d4ccedc9f24b6cfce0b9
SHA1 9d7493e3190129e86409612f59837061235c8cb8
SHA256 5429d73bf5608cfc64a310a9143bc2941985019bcdb53302f33672485137dab4
SHA512 4a1c803364baefadef6004603b9532a685f2f18b7c8ed0d8c7f053d2b26d79b355451166623d959668a3cca739722ebeafd999522201a61835540d7e829044cb

C:\Users\Admin\Downloads\LimitImport.png

MD5 e2f0a8f19dfe6defd224e55dd7d69f1e
SHA1 19fe5cab9854ee617215e413295c158fdad70fad
SHA256 4a51226cb30c876d35ec576b614aec47c2e99211997feafda2a1342806320582
SHA512 cab6f0b72c4c01f66589442dcc987b3cfce93bb1f06954c0045bea59ed8c95155c8f0ae273bd1b16256dbb7cd80ebf38fb38c6b6294411c299786e5edfa4d271

C:\Users\Admin\Downloads\EnterComplete.ps1

MD5 84c1b9081839ef460174e25d1d1a9649
SHA1 0e0994097ecef1367741f616f7ce11c9dff8cfc8
SHA256 2b888cf2c9c284ddf5a0a5366c8979e809d9e401b24b880d912826b6a93bfadd
SHA512 e6d60321f059f368e1335c35bb2f1ed8175d52ece50e3694eff2e628ac9923b06a429ffe87969dbfcaeb8668dec95668d4444221c2f1bad7cbf3cd60a9f39796

C:\Users\Admin\Downloads\GrantTest.odt

MD5 595e07aa9d18f2c45eee89d21985c9ed
SHA1 c768ad92e854cbe67204a6cdf094563a82c750a4
SHA256 ca3f3cd35788cb1925ffa1c3374077e8eb7d186f08b95c654e4c3e9843594bf8
SHA512 b0acd190d25ccbe204df24552040155d2b0237404db732ae97681340a0b0c6a654c8c0fdb52c8d4d8c1f29b04a0ee2428c45d24ec09d4ef3b5d08b1bb8c4e063

C:\Users\Admin\Downloads\CloseMeasure.3gp

MD5 56239051c9dff240f2ab0441f0a709a7
SHA1 5ff1d75a968bd8476277138a80f2b5b3e01550f0
SHA256 5a36d568ecfcee9f310ab8ffc99bc4c22a99c854a91c39e0be217123bf024b5c
SHA512 5ab773c09750498043ded0cd112be7be60724cc58e0b593a5c0b528250ab83b0eefcf7f0c47ba7b3b4c22825a5d35c2c490dc133f34171b0eb36ac33875f08b6

C:\Users\Admin\Downloads\ApproveShow.wmv

MD5 a6f63ca9371e4c2639f84a537f96e347
SHA1 f9e558ca606e6453724e88f8ce60f43169c7e02b
SHA256 741ffb19766387f186d269a95b98d58b58158a4551e52d3d905d5f9ef7bd33cc
SHA512 cae16417e56056077d3ed0a4c976d8aab7412ef1efa92dc2787e92602356ea98715cb279cf305242e3269609894173f8df3f777dcac0f8355fd8165d72a22887

C:\Users\Admin\Downloads\OutRemove.mid

MD5 6cab3b34a3a3b018132a33fa8d0044d4
SHA1 cac257062def8fbe122ccb3fa0dd7e86cfb84032
SHA256 e64f57ce0f05ac0646fc72887cad3a632cfd62b6a8585a329da1486fff69b0bd
SHA512 760b314765469be8f3d9a0cfdf2a900cc30f69290ba7fa004c52b26ec8adb2f972d876cca95800562cb03c404bd41f6fad48020b4d3e8faebb80c55d901cd72c

C:\Users\Admin\Downloads\GroupPing.ttc

MD5 8defbd1cf9f6e59e40b2d52211008004
SHA1 0135f0c5450fbe7ac958cdad7c629338a4465f05
SHA256 1a4f65416e17353348bcf14c46c5650d0fc746f61bea53885ce3ddf6a1383006
SHA512 fe2a2eccf4188f6a99244f60549abe7326a43348d8760e67de5c5485a48f5082548f798c86f53960ca31a812929dbc305678ee57905f983b972e2e16a10c8a7c

C:\Users\Admin\Downloads\MountProtect.edrwx

MD5 811e6a72688c3b8039b8b2f925000496
SHA1 2dc27b657fe11c516048613188a2f91f51885b07
SHA256 c3b1a85e7e60be559e668a247992c5d50d1666bcf6027cfeb625170094dc5b7f
SHA512 fd488f9f7b6880ee218a2aa08ddcf383bb621a7ce62d84b39ded57359f7d9ccb52751249dc8b606586167230bcddc1a6faa2b56096704ab0324b6bb6ab1e06bc

C:\Users\Admin\Downloads\UseSuspend.mhtml

MD5 42af824ce717df1a5fa24a3fba3fde59
SHA1 e5f8b82c9c007c4dae91e829088a1497951227ab
SHA256 b1f5750fae040ae51a33c9330c6900c7825d0d4fc460fa8f76e2df9c98a47f97
SHA512 8107149026404d50ae30986f1f7d968698fcc723c5e740b66036600063c6cf573ce999b82004daa1dff10bbe029d8d3f51955b76d36561ea52e05e337e05d89e

C:\Users\Admin\Downloads\CompareRepair.xlsm

MD5 0dbf436e6416104ff1ddbb2a1d95c41d
SHA1 7f5d2799e3eb455361354ae36969a8b526fc7df3
SHA256 f7d4f51820f1c3adb7500d0c46a897255d1db3a2b68033038d8910d475dbe924
SHA512 4a246866bc5d16678c1d0edee392debea352cf2d67bcaec2bb705a0583da736e055ebfebb2bbdeaacc4489fe81846443779ba54775575519fb020f0dbe088b5c

C:\Users\Admin\Downloads\SendReset.vdx

MD5 fac7065205b08903013afd3d6d345eb5
SHA1 de9af125c7dadeed0fb16f62c5dcff9d7b06dec6
SHA256 cdccb0cf70ddd84bbbb575f772eeeb44128b476cebbc3bb9a03f25bfa718cb34
SHA512 f12af744952e6ac3ab5339a70e9456fe2aa0b2d2cddaf0d21f82fd126306d64470eb77e9f74dd76fa2d3d932ab63f9b0867abcd8bcd696e1f8abcfe820c148d2

C:\Users\Admin\Downloads\FindUpdate.ogg

MD5 413604d8f0739b6298650a962f66b6fb
SHA1 6051025f753b683433d6228e5209da7b00820913
SHA256 24951cd8037c0a8d8abfe989710a34d9f12117ec8f284812ccb8d6a4830d5e72
SHA512 ad6eef7b99aed48a36694f9934468f6d9a4ed55efd64890a056c43c9d325a30a20b3fca73158527b0a0c65efb6228cb2095c79a012f4a3a6befdb1aae8105842

C:\Users\Admin\Downloads\InvokeWrite.DVR-MS

MD5 12fb562006899adf1ab37fa80e55dfc8
SHA1 2564fcbfb6977855978162858676878cb211c28f
SHA256 deeb405a5f34c27e1034802d0497736eb8b2b02fcbce3e3d13c61271a4244143
SHA512 c4573c0c996a9a45b04df15b3f72ad4e2d9f13a05af3358cdb3fa179cd833855bdea5ea93ced2938ea0b4ba6606113b73eb03b3c73bff449a494db27f07c6352

C:\Users\Admin\Downloads\CheckpointPublish.html

MD5 3ef9ca36a3289ee070b22b0fc62ef413
SHA1 41ca0ae21c7abf6e488da8f102b87b539dadcf75
SHA256 b7699277a29a57176b0e2b2e8dbf9cbcc5d59378929ba81f4209513f4b88bfe1
SHA512 ee965d9394c8b77c265973d1cdecfca59a7cfa1efcde19baa355c96388ace0ddc870867620b6519077760295b2c3ca2af4d18e7ebbe968b81f12b13fbbd80384

C:\Users\Admin\Downloads\StepConnect.svg

MD5 7dc386027e39e23032b56cae0394a7e7
SHA1 ae6e78c0b24aeb8e84dad177fea833074a5ff6bf
SHA256 47a4f447aad37913c69569febed8878ffc67da9fe1ab1f50b03c3f2e0444faae
SHA512 740c925070d2d584041904ce7dc6dad211c2eaf8f034025572722cdae32735a8bf1ce6b363e69563f767c8c787792e066acf77b93652ba09b32272143a924e35

C:\Users\Admin\Downloads\DismountTest.inf

MD5 146325e1d190042dd712d4cdce097b07
SHA1 836e6ca97ffa1df08f6edb1bfbf7709b4de3865b
SHA256 3d83da08fdc84e1bbd1dbc5e90b3063c1d64d9b87c6858d10f10b256a1deb037
SHA512 86f79326d89a9cad3f172ad6907035a7f65b58ebd8a45af47dbf67914b87a04b1fac80df1021a116dccf946fd7907826423944491254d01452aa142f94fbf287

C:\Users\Admin\Downloads\InitializeShow.xltx

MD5 11b67c0a9d77bffeca777da7a5deddb2
SHA1 c096640e72d70990280dd68e6bf642e2e25692de
SHA256 234af7f88c88ac4d9dc4dedc86c490eab8926ab4debbd083e8fcd02fdc5e474f
SHA512 989c5d983735d8a7a9236fca1e03755fc0e8386f0887a21298998429e3a8f297aab590a63287b18177098c5b8a710f22ce248e4fa67420f7022a0509190007a6

C:\Users\Admin\Downloads\SubmitSuspend.asp

MD5 c5b190a3cfe88154bce0f514b9077877
SHA1 57a95c34707d4c0a8c7f6ec415b2d5cb3a67869c
SHA256 4bd3e936075fb822598116cb37810ee4ba320e35371659b91b2fa94c9a4b8e29
SHA512 b410d5aed5193e5e449912934b01feae3cac6454c134c7a20e2a2599538a7a79e266a5d68631b29b0e6bc633646ae972baecdfea7c1149e67285daa8bd02a6e6

C:\Users\Admin\Downloads\PublishResolve.lock

MD5 6377f05d091abe87158a565cb9f5167a
SHA1 e86b199923fc490be4d88a65932f98a8a5469246
SHA256 4d23bf9bbf9ece67727cfc478e7678955df4c10f4da1e1f45639a4e8c4bdfb2f
SHA512 b25efe533b70e62d5aa350ef27f3dc706d20d2864eb21d3d61a1e2c86e384efb08cf23571229d37b5f4c42778596689d2efd69b7fc00b7dbc6cad99fb51070e3

C:\Users\Admin\Desktop\SaveSplit.clr

MD5 bbc638077d89bbd6ea6bcb760fcc20ae
SHA1 7ab3ea0caff4ce45940603edec539f2f63a19da8
SHA256 404e5eb8fc6ae278f9c36c4f51e784a75a57d69d56ac3569d514851de25b39a7
SHA512 c6f21a377b036cdb0122ba3afb5a7bdbfecabd45aebab27cf96d15a06e107310c119846d9ff8e68a38b2bfcb99cd111bec03bf23a7e435da6ac2d4f1d3f18bb9

C:\Users\Admin\Desktop\SubmitRepair.ppt

MD5 8a0a3bc2b38738cfca2f9b8741978c1c
SHA1 c3eef2a8d8d9ae6d72125614a9f5ff8dd172940a
SHA256 4ac1300d0f5101e17d537df02660e00d87b2273d57fa7cce0caf9a6af6333719
SHA512 569206e8491ab3e127aa6d8c13b4ca906b1fdc0c4b547e732a935cca7394251387d0db69efdc32fa7cb3acb6b89de18766b628971d26a6f020e4e2504aabfaf7

C:\Users\Admin\Desktop\AddFind.asf

MD5 72216069ce5b4a55a11a8c3baa4127c6
SHA1 03de519ac30d844e8caae1d1074efea9bf0613ef
SHA256 42ac26341515a32278a590d04f6bab8c0ee2799496b6a22c27d4c6a27f90725f
SHA512 457dde9beb16e8456ee63f47d8616202e0a0a762de8213cf3f37fb1e80b51f447dc93f32ed6564bebdff0e911d91ded10965882cc83533e1fe772c108c1949bc

C:\Users\Admin\Desktop\GrantCheckpoint.search-ms

MD5 7e5912ffe8be121bd86807e485a67552
SHA1 e6d95a189627fcb56e114f34df3da999e0fc501a
SHA256 9392ec683f46a2507dc733c8ce5d0fb0ca896e7d37c365037030ac0d688a60f9
SHA512 d4df05bb6bb96f892da2e39cedf3dfa182baca783a1571413961a5c304870744d133d9108f4579027c933dda222aab948ed9e5bc4b3c2be4b6450cf96e3eadfb

C:\Users\Admin\Desktop\ExpandUndo.ram

MD5 f77f7a19d98e118119213f57fdc9a5ad
SHA1 088c596e84d43ea241aaaa5e62cb6455ddda2b76
SHA256 b7f815f27f00a1766abe375f1d2dae7faf76d45d04b038205f872f7dc8255ca5
SHA512 b766984dfb9835136649943f8b28a0c73fe3817fdca6196afc58a3f209580976346b0742302210944adeb41acd3392df90d23a89609d2042ccd97159f54a6da4

C:\Users\Admin\Desktop\ExitGrant.tmp

MD5 ddef705810dd3a0ec27cda7d1ac81133
SHA1 5fa9e12dbccf67eecf37bc812064b151e8bc9df1
SHA256 740be6cfbc863446692f095d45135c505da09f7fe82a5ed664dd7bf303ec9e9f
SHA512 109e891effe0eec409105a61adffca6c1e1dbdb5420db5c7ff3784aa50e7f371413a0a8808868f6da07dd23a6fac9200065aaad11404c95fe91d220005f886b5

C:\Users\Admin\Desktop\EnterUnlock.ppt

MD5 3e74416909bb5d8e06b73886819118ec
SHA1 13b107f78021b83d6cf6616b0190bcbe055e24b8
SHA256 d47e522a9725ee84d0b04a50f90253f571bce214d4a4bf762cf53ed459e998b4
SHA512 f3716b6460642b9dcb47bc0696d7c3da02be5d381aa42e4da7728f874ecf5623f6b14ed21646d99aa4cf432120c490f1879a17961a78eceef552da95d8670fd5

C:\Users\Admin\Desktop\EnterDeny.3g2

MD5 6cb80fbec33caf2b09f0d39eb2732180
SHA1 621cc7f6bda1d3c3924a0d801f7cae57d25d0b50
SHA256 50fb3a335041c027cc7d1c66275d181f5e69acc2ffc2605252ac15893302c769
SHA512 c64174c7fdc1fcedc21b7d0315c332a939ffb1e74ffb8cb0120b8873c678bfc4104bdfe8669faac6ca2159589227b98f201f1201ab03fba37e5bffd53f468d0b

C:\Users\Admin\Desktop\DebugPing.emf

MD5 da2a6a7862cfd6d5b3f4cb8967b98cb9
SHA1 f25b7202e3ade6d2fa1d73d55124f6e26a111d37
SHA256 4d7d182086c2ca3fae5ebb1dc2238ddd9c35f4dd99921427117065283c9b771d
SHA512 3edae58a2ef7b316fcd502bdfee2ff509034b64486154f763dcdcd38da7389aacebd8059ae9045cf18ace24cf1b4c31acc24553f99af9962165373d7024b1aa2

C:\Users\Admin\Desktop\ConfirmAdd.asx

MD5 8ff05a646376f7bc520027978c364992
SHA1 7fbe6f406c61791b9e4385973d0d127d38c3b29c
SHA256 62b612ae70efee2d7bb60c1e9519a3ca9d28f5b6ce11dca51169dac8211c60c7
SHA512 469591ee40eb39edcfd0066bc68ddc0a32ddaa3d41bf03ebf58285b0318dd95353a7b6ed686a5a586e2a5990fa959ea68de2aa86f304fa1b09fc00dfe4d4ff73

C:\Users\Admin\Desktop\WriteEdit.bmp

MD5 a12fae8f34d212077ebd60f4ba09107e
SHA1 2822ba7819aba15d90d87a47154e920e6ca40c6c
SHA256 d4d5136f3ff274d1269f30e91a778aa13b144801c3009327b04123d21bd4d570
SHA512 c11101921433c3a7ada2f9ca46a306353bd8a0cd3fbb4e4fc10ffbf97d99b3ba0c3a791b80698c3cae0d21b49b0c7cd6e05cfe1f1af6ab383951537da9c82116

C:\Users\Admin\Desktop\UpdateDismount.mov

MD5 c99d8761293af59214fefc016719f509
SHA1 428b4dae419848fcb9bb8af428ef71af857f9cbe
SHA256 f79b1bedecbb533f90103f507364757e3ff47966575b6ab744e7f1d1da9f1f99
SHA512 b8385ac5f1bf1c58cebbf04c297fd318de46723a4621a9069211848c6b9b39c27c079863eb9417f4127d16ce6d43a3f0702dbc5c7dae2d9d1cde03e6838bc60c

C:\Users\Admin\Desktop\SkipConvertFrom.midi

MD5 01533954412f99c972749382796f01d1
SHA1 ffd18aa8f775e0c9723a7517b5420a5bb7c9f993
SHA256 f4d47be7993d1f67b3592981bc0988fd3e13e4080d6d435a89dcd5e8c3e0e958
SHA512 f8ce580b06d2c62bfcd79666fd4aec25931f758bfd57e946c10f5a3b00452e7b7763310e647bc66cb3e721338dff6d1bc959c6a745836369b2b6f7728ea417b6

C:\Users\Admin\Desktop\RepairConvertTo.html

MD5 66ba7eec16b9a7cdae9642293c2470f0
SHA1 0d1e532fdac156a1cb1d20e95f5347cc5b11f9e9
SHA256 5b42b7023f0dae290d4cc50d8af99d1e4b663dfac175f5cede08c56e035e60d3
SHA512 d906a4154b4b6559a9be2a7bc42bbdcd6d103be803b8f76e1f31f66c7c42bb01b42148a6592338be86f56045cd5d8e3e0b784eb1c425e8765c292df0be68506e

C:\Users\Admin\Desktop\RenameBackup.M2TS

MD5 80805a2853e7111e01c8cbea46cd9a03
SHA1 d31c154e0e0d98113a523025fe1175bdcf818623
SHA256 d18269a28bd83dbcbc90fd7df8c231589c6fc34da883e73f871dc06bc363af7d
SHA512 fbfd22282678359994885ecdef03d9b3520bb1d3b1a1e79588653a7d58410d2671aeeb520d629111f9d6353a747e7bebad380d025c72056f9d0d0ec18bdcdf03

C:\Users\Admin\Desktop\RegisterResume.vbe

MD5 437775de91eeb7bf567b264446f95201
SHA1 c3f5768b8755fa8e2df67f9e11031ed9144beb49
SHA256 f6f742c328236b29cea415717a9df3560acf2b00532c00ac9e03fa543fab3882
SHA512 5881adabfb15a67c2e1c111879d649d07b1f7af11ae8893cc318864cdcb05f5dd7b3945ab804d9bafe1fd77f6341468be428f10402762f366c57281946bf6437

C:\Users\Admin\Desktop\GrantDisable.DVR

MD5 a18ec92ce902a343fcb65f7ef8dc210a
SHA1 deebd1771b7c04de769ea5862bf55624a90d40d7
SHA256 5e49321cb3f5027ed0c7fb8196ed0c56f2fd10dc981de768a12ca1607e021bad
SHA512 881aa8dd95fa91d87cdd9dfee154b4e8ca0467c344bd1d3692fa3c835caaf0a2cce27e6bd0c1a94696025468348b99af3cbc23c5c8bbcf985ef2a11967120e38

C:\Users\Admin\Desktop\DenyRegister.wma

MD5 ac5e8d4718b110e60f1b0c586d1a5364
SHA1 b605dc53c6ee2cadc264528138b6c59e6afd5386
SHA256 09cbe90815f41953a8a665388d6adaeffc2882b859cb5a2bc3a58b1ecb1556c3
SHA512 cc321c86994bc0bc924f8f1397401ef71d9316c54605c740cf9dd24ccc1fd10ed98f409502c7a68c930768c3cf5df71ccc7585f92acf05e569d6cacbb1bd9cd5

C:\Users\Admin\Desktop\ConvertEnable.edrwx

MD5 445a01a4afbaea9a593392fdde90de5e
SHA1 2921a718d35d50d3abdebce43a962f7267e9c849
SHA256 80b4325f853badd88f3f98175786392e3b4cb40601e52be72efdaf973f063e7a
SHA512 6b4ebf20ad855a621ba2b8275bc464d3f80b03f8542ccbab4a232f809f38c4a8f48841692095ba9bba5787608036807919e8dcf00a5f565522b326c0dacac7eb

C:\Users\Admin\Desktop\SkipUndo.jpeg

MD5 f1d982ebc0f707933835e487d59140b8
SHA1 70cab1fe9db29ef5634bddeb0b1377e135994436
SHA256 9e48b5d55abd08ad69a3c21c6f1a87f0837727d23455d394c8014d58131561a4
SHA512 764e35708e363cf32aba189996184955d3a5bb266d4ea5b723d21c2af7118157189b0d13b53703fe6f170dabf36a08bb00caefdb67875668bf054f1d5b3f3839

C:\Users\Admin\Desktop\UninstallUse.exe

MD5 89602b100c35f407fbe7e311a82af730
SHA1 408d26bb7cbcb5686d76ade4aa135410da2d5d1d
SHA256 8d142d85af7f77566924612b5765d02b8413c6ce2fa198a6585d8137352a7166
SHA512 35bff42ee5a5f0cba6bdfb58edf364e271decda3d5cf7941c4254a05bd659848749f6f5c66ede88632287a889e1aae42c6cce2dd7c5dc3384956a0fe063c074d