hxxp://normalnastrona[.]rf[.]gd

Resubmissions

03/09/2024, 15:57

240903-td5p5ssaqc 8

03/09/2024, 15:55

03/09/2024, 15:54

03/09/2024, 15:53

03/09/2024, 15:53

03/09/2024, 15:50

03/09/2024, 15:45

Analysis

max time kernel
257s
max time network
254s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 15:45

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://normalnastrona.rf.gd

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	bootim.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	bootim.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	bootim.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	bootim.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	bootim.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	wwahost.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "126"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost = "1"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\MuiCache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost = "0"	wwahost.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
2388	msedge.exe
2388	msedge.exe
2568	identity_helper.exe
2568	identity_helper.exe
5592	msedge.exe
5592	msedge.exe
5976	msedge.exe
5976	msedge.exe
528	msedge.exe
528	msedge.exe
5876	msedge.exe
5876	msedge.exe
4844	msedge.exe
4844	msedge.exe
5980	mspaint.exe
5980	mspaint.exe
5468	msedge.exe
5468	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3912	bootim.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: 33	4700	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4700	AUDIODG.EXE
Token: SeRestorePrivilege	3172	7zG.exe
Token: 35	3172	7zG.exe
Token: SeSecurityPrivilege	3172	7zG.exe
Token: SeSecurityPrivilege	3172	7zG.exe
Token: SeDebugPrivilege	1940	wwahost.exe
Token: SeDebugPrivilege	1940	wwahost.exe
Token: SeDebugPrivilege	1940	wwahost.exe
Token: SeSystemEnvironmentPrivilege	3912	bootim.exe
Token: SeTakeOwnershipPrivilege	3912	bootim.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5980	mspaint.exe
5980	mspaint.exe
5980	mspaint.exe
5980	mspaint.exe
1940	wwahost.exe
760	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 4192	2388	msedge.exe	83
PID 2388 wrote to memory of 4192	2388	msedge.exe	83
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 1192	2388	msedge.exe	84
PID 2388 wrote to memory of 4772	2388	msedge.exe	85
PID 2388 wrote to memory of 4772	2388	msedge.exe	85
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86
PID 2388 wrote to memory of 4848	2388	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://normalnastrona.rf.gd
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb14c246f8,0x7ffb14c24708,0x7ffb14c24718
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4136 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4152 /prefetch:8
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,5463498418654469901,3077050868072389217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\PushOut.wmf"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5140

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap2235:2050:7zEvent12310 -tzip -seml. -sae -- "Desktop.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:5924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault19edc2e4h05c7h442ch9a8ah80a5875b25d4
1⤵
PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb14c246f8,0x7ffb14c24708,0x7ffb14c24718
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7629737169734268270,11708804575000264238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,7629737169734268270,11708804575000264238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,7629737169734268270,11708804575000264238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:5312

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1940

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:4308

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:4472

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3969055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:760

C:\Windows\system32\bootim.exe
bootim.exe /startpage:1
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
668b113f1d075eed0d43da420bbc8396

SHA1
3d903045367339e0f58ddccb7414858ea174fd1b

SHA256
efaa209694bb8c5857f389a4d9007245ac64acc9c91a9f6ce057560d90863726

SHA512
e128b12f9b701fa15e20025a20ea21e5d8a3df91fd20367aa8083a7b8d3a2f77de5e5aad885e41185b598b013e2b1f4071b2ae3cb339f7277b33b6429dcf5b40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
5507ed12e1a03d29ba6d0793e3d5dd00

SHA1
171a510ab59852faa87bf6686a7789bbd6daa2e7

SHA256
d1c18832803f15e62aa18b00aaec924bae73548f779378ad88e8166301ae8fa6

SHA512
ec08de50a0d5f8a087cfe2d46e931c4d526d621fa49fc291acda38bca8740aa2e173e833aedc0b812626583d91748a6fe620e2911dca3da959144572584d6bc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
317218471e7a333c380636867ea9f76e

SHA1
2b07ce95fd54351204e095f89d2b800be23b5374

SHA256
95743015d335c91aede8694a3ec476185d966aa309d3e231f5046959e749d50f

SHA512
97a06a1c0d00bd32f3d9e0f47b028bacb530b54ac53b767c72f7af5e588d57203fde31b5cd585ba083f0a66cfc0375cf356db7fc2585603c6f231ec7c951c408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
e9332934208a7b2381bb722e13c3be81

SHA1
a9f613ce72ff8e8c160923be5dbaa8e51463f1f7

SHA256
2dfd84979b1ca19643b58e58af7c91f6215be6bb9a35252dde5e34b19410a9be

SHA512
20b239a693a02ea78eea6285f76fbd1c7ca5756530ac1ac3a6d9d73ada11799ff5f13b7d4120373b3820b6ebf14aa1ccf7156c19994964a6f55b5a49b0453802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7dc57122cba87a4b5330e53c8f6d1d54

SHA1
2ca8ba440093be622977bb5ef04a30beda48924e

SHA256
2d8ed1c40c94002d0ce115398b799a0f8f2e7e89ce19c8f2869f75e0a81b85e1

SHA512
e30f1ff99df4a0d943345b158f8631d469d4ff09b1925e61df9345e6688cba79fb6cfd5758c8e9257b83f7e0a411ffab8ef1e6803d8ff66d0121baa1c72cb85b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f01a89bcb0299f4f64e9c4e9dd8345b2

SHA1
a74a0ca23e7b820d51b69141475a3352f7be4855

SHA256
2e26ddc7128c75cbdab6279d025d1a23f437b64a6a5c572d9eb3c09ec10ccf4b

SHA512
388b17b161afc9fd920a0682b80ef03a5ca415d509a832d099f7d23f75d7f898b82bbe18e292fa954487b1a5651c52026a40a01a8682e7a509a0e5c120191554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8c7290ef4a7026283610a028b228e3c3

SHA1
cc2e5a9842c157241c74b6a07def4102bf81a7c5

SHA256
9898cdbc7913d60edfc8c2d4bbaac74053a89127a9e6dcc191329dcb2962945e

SHA512
dacb5bbb8f27741012225b06ed3230ddfc06ee3cbd052919c8541a27ac9a1ed73f240841db6027fb759989407f73f8d766d009d549c7e6b530973b3ce1dcb1db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8852e8199265e90c5e39eae05d9f8907

SHA1
cf642e9b2c1b8e49f2dc2481ae2b158980ba94f2

SHA256
d680486a237a28ce492092738459dcfda0d9f2af59f95a6b53805e76a5edf828

SHA512
321406668838e28abe6994b0a829b6e9af993c31e1546bf2f5526d57205b2c966972942d29ebaf0c82aa218a04bfa04f55d39a35d8861933044ae9cd88f2e019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b76f2c8b7be5ac90de51f918b032fc38

SHA1
9540bc7c0e022645634be545856caa8f4919068d

SHA256
fbe9114370be08a74853bcee5257522c57c0eff95314cb44c8a146b91735afe1

SHA512
39b374f6d8cbcf4b0c5aa3a1492f859e5ff1ee7ebccbe6d909cc9339f0a065d18cdaaac4923029d0a5fd6d72dffa3091e7cd00df699f932cb359adb775c1224c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f555215fe4612b9a590b8b00a35aba6c

SHA1
1fa4a8ec60375bb2c5f2164acd40ba3bb9f71ff6

SHA256
e913af35a9efeded834f3293bf468d2a44083ae3614c2476990c1b1ec82f6fbe

SHA512
551b8e0f7dc96215f44ae27fdf8033c2795f9aa2670fa0206753db3c88d023639c8ab1611c9c91d07c2b34214d73a3d5b461f3f69391ba9d0999e09e0da1732e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d880e6ba3e597335878424e7e7e1cd31

SHA1
e9f9e26c12a386cd7b00a9b2770b1c4cbaf38a2f

SHA256
b30d914179d16b4187efc35921925237ddebb66a8e6d42fb680314387301ddae

SHA512
a0ddfd8889e9b8bbf20522385d6fe27004d10cfec373f4b8a3d71b6e6deec9a7dd5722888dacac4b46c6d7fcf66ab5349d85ab57f21e4430bb436c267c6cba8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
595b8292d3c97c0b95b07aebb6f325f0

SHA1
21b01b90574e1cac0b8ae27a8a99a6081f58ee27

SHA256
c22f099c1844aa2e362f3edb770fb90857e0cc2520c5680cd2e31aa69d55b1bf

SHA512
be5c3f386cc0f9e11690363bf2feddcff4984fa4311d0c781b504529fe3939accc281ba295a2cd0ca43192e378b320215125d893755db28fe5666ee33b85e758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
a1ba6731644e0c390f47f0389445e22d

SHA1
90de56205d768cfacef853a474a9ad710ffca04c

SHA256
cd20aae7a2fef5da9274edeff0a6592a27bd390b2aec1568c3e75f861df6643a

SHA512
d26e44ac7996c6189801af8322c8c9f6b05a65834ab855b8e763d27ef20e1244109514d826f775022f00fd58d9a925005058e1143c45a31401b13937a6176a36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
018633d932a1c2b425b26ba0d6bebc91

SHA1
1ac37a0c92169cfa5b496ce189eacba2e0c74288

SHA256
ad094a4ba1b93f836a8758016f2ac30690ec8eb5780c8652cfaa9e782bc05f1f

SHA512
34a8132cc3a2aaaef77bcc804a8a721f4158fd092246eddeff85c5c555e496e5dea952a36d1ecb7d83b172ce6cfcc038872590ca7d0ea5bc1e63dbb388ae03e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583d14.TMP

Filesize
203B

MD5
aba2239bf121ff4df9a18c153724b475

SHA1
e92e4c1885607dc2cdfd46ba5e773588687e8cbd

SHA256
718ea4eb4fffa63055299a522d1c4e68f5561d48632499ce21741aae65dbb4a1

SHA512
5e03f44cabf3b011b9e41410bf2fb116df038e91926191c3720a3bb48b82c47c09a53f4688b01fd5f7191b198baf3c0c0f3260ce672e96e4e92055aae4ed0c3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b826e67a170b1f7f1f6692f1e3b32aa8

SHA1
f4c08e7d29e2e36ef2178f14ee926cae488f477c

SHA256
c9220ab695f0215ad97246a95f0d767e8e696d35447eb2b77eb34fd7d06d153e

SHA512
f1a155300bed47f07093ea8c5a65fe9006d300e77cd4e1b5f113813a2a2153d2e96263d78d6a2edb4a4b988bf44eb9caf6ae29ed31c70a36469008d46d86ec69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
85a457835b17c4afdd3fce07c200e28c

SHA1
c5219d6f24667e81c0dbf7b5b7eae278fb63c938

SHA256
1079136b98cc78ca5eaa0d9d4696199bc956a9a5f67cc9ba16c557a48a882534

SHA512
821b85d19e7299cacfaaaec56d795f8b68913442cfa5d14adbc75c506740e570669ac9c004a240054f37c6de96e583c73fd60cf649afb14cdb66f32b55eb0272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
901c71547090536c58d8a7a18993d4a6

SHA1
ce97e0e773faa7c6f03c2994cf65efeb6cd79a72

SHA256
8dd1077d90eac674ac2428781f10d8d214e4d20542c3d2e9518df32ee106f451

SHA512
6ebb2f45a21352f9acc6a2a8deade218910c07d1978912a22ab10ba2bbd1ffd974801e3d476db9871525dea28c9c1adaf73b54dbc6fd32b74e6ed6e6429a9df1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState\_sessionState.json

Filesize
143B

MD5
af6b577dfcb368967d6ffd5d830eb697

SHA1
6886b41c6f07ada168e623e7f46fce8250039104

SHA256
8d4e3f0520fe7df69bf17f5f8178810a2be7dda235ab9aa6d90dc597ba908dde

SHA512
50ceecb40d7fcce350842529b636510d96b60107835079acfa154795f6dd024f1600f3d4b0723129bcdc7e4ae467461f2c801c6865f719108c83d1fc1c5cdfbd

Download Submit
C:\Users\Admin\Desktop\CompressRemove.vdw

Filesize
406KB

MD5
6906c14223b41100eb01695643a99c70

SHA1
8bf2ea3ca8df97c84229734e5995f0b8e1d9c7df

SHA256
d2722509466c924f3ca7cf11f449c6f9f091171b3d42d03f2342f673dd98af0d

SHA512
bedf8d7d99a144a515a9ac051c2137c77ef0dfc38dc7946729b9680d1eabff7d0f0bfbe60c6373e39498a40eadc64424c8a41a8215d16ff62896a14e87c11cc6

Download Submit
C:\Users\Admin\Desktop\EnterRestart.mov

Filesize
615KB

MD5
8463fd78c3d7b391d43dffe7bba861b8

SHA1
aedc647b3af7fbeaf55787734019ecdb13cdda3a

SHA256
e0fd9ced48fcde26d6e407203cefba45bf1b33ff01ffd6fe241386c177951fa2

SHA512
6781ca803b4b1ddc5928bdb3a62aa81804212293e935f6c93afd3763577e35d8e06280798f8045b13079657e0417819ed73492a3b75577b97b68d34d8f382354

Download Submit
C:\Users\Admin\Desktop\GetTest.cfg

Filesize
267KB

MD5
339d7d474930fa9a94b5b86a0e30a835

SHA1
a1b359b17c4b5bffb0cb881ce8bed4cfb8452ac6

SHA256
c27cd9af01b7e16808522ab680da3acbadf73740fc482bc9305e797b33295d67

SHA512
fe74ab331f2158ebbf4b919ecbb17b07bf7abc52c697e4a44682e4ae2f36927de56db30309a863eea2f55bde17c0d5c1a606130426f8b9757c08826361bafe32

Download Submit
C:\Users\Admin\Desktop\HideRemove.dotm

Filesize
592KB

MD5
309e4be8609ae984dbc6cb25b9b9403e

SHA1
42a5d67d5157f35ee86acdbc8dcf4d003ab7f834

SHA256
c51d5a0bb6e652c6a1df0faf1d942ad65bf3f649cb941a6e1ee06bfbd2f758e7

SHA512
26b37afdb963799c23c3b9c763b3f76ebf79c1df56d5508d2691a39900af3a5e07dd13e6f6c585c9dc5d69fe97ec644efa30aca24e31bef23e7b3990832cd2f3

Download Submit
C:\Users\Admin\Desktop\JoinOut.docx

Filesize
12KB

MD5
59019401fc73c5f1359c4c9569689963

SHA1
8bcae3c5fef3e9c7495e1c1fd3409bebbba6d417

SHA256
770af80475b9a57a4ffba9a7a4a744af46186ad0b08945a0dd51e9c56df7a255

SHA512
23957dd6d79304a6c6a1b70da2b5beaff9de3c767857c4165ba470c3562f313698377a209ca33c78a88a2a12e56c61aac7db43a4dc1fce918fed9448216da089

Download Submit
C:\Users\Admin\Desktop\LockRemove.jfif

Filesize
684KB

MD5
48e9eee46bcfe1237077212ba8a91b26

SHA1
376d10b013931776797e33384cc306245d3a50f3

SHA256
6f36b79ff49caae1daf0b6c5f99c46c66f2e91341a986449d557bfb7c39cab2c

SHA512
fbc5213d6b918bf04894e11e869d21d3caf0e9dbd5640f7b483b4db76b3c0759753493f7c79068343158df805027906d6b099c1345370656c5b92f85235d80a9

Download Submit
C:\Users\Admin\Desktop\MeasureExpand.mht

Filesize
429KB

MD5
48df59cd04c3a39ec017a8fbe2b7f466

SHA1
8f63f02964fa3987653821b7d42492e27fdc2a75

SHA256
852bc002a28b6e05ce512c6afe9985e3272b451c8620e3520b1d663d03dd4c6c

SHA512
e6943bb0a36fe6cfd7d6ffe093b730d9a1de6b0bf5309e218c1b233936d6d863f84c8631fa5d29be22b1a1da01a2663707c3044b0bb96ba15adc1a8d9792bfed

Download Submit
C:\Users\Admin\Desktop\MergeReceive.ttf

Filesize
661KB

MD5
b4212c342b05fa188d8f2ccedbf36d24

SHA1
7285fb2608d772165dba5fdc70741ea6eafdf5c4

SHA256
e4f6ec0c616105b833635497251f45c75790b0637f78ef3cdbc7cff4ae7c3afe

SHA512
23937497e6e5b674f2b7139b4e90bf5f26032469d345ebcf5e338350b7e0e19c435006e6b7a9be0a7d86abd099a1c30c839883fe2dc73ba24865d15a1e584d99

Download Submit
C:\Users\Admin\Desktop\OpenRedo.cab

Filesize
499KB

MD5
c26c9a3d33fa5ec3c16416ed7d674bf1

SHA1
9bf1b63ffcb1a82a5b5c294c50365f9fda98dbcf

SHA256
f1cefdeaf60dd0d675a8afa1924ff4599979f80ad71a1552d3244bd3f38faf0c

SHA512
bfc1652da35ff0dd86a8ee8de85bed1fc619e42aeaa9994e3cad6ad322cebfa41817f15cbbd46f62111a3fd56b4e99ac7cb8866dd6ad537e198bb796f0b42f31

Download Submit
C:\Users\Admin\Desktop\OpenSearch.wma

Filesize
638KB

MD5
4b9a5266293b52d21c2191fa27a59443

SHA1
6578bce8678aa228b74e3612c2c8ea5ca7e0f303

SHA256
6e873a9bbb80199c07167b759185f3fb8f178f7530032507420dd8331b75eea7

SHA512
63b9760be4586dac33e8346a75925d8dc787553a295342daadce79cdb546f1503b718973d1ccbdd57d634b9b32f7b41ad00e7456a2f9acbd3a89edebc1fd3f69

Download Submit
C:\Users\Admin\Desktop\OptimizeWait.xlsx

Filesize
10KB

MD5
a27dfa77d603357ebcccf76b5090a36d

SHA1
2fe62d3d696f89d8e260549b8ce0031f3421a63f

SHA256
3cb37b50c3a4ff2e33b3de9629c23c695a52c418e69508667d2a660772c69755

SHA512
40a1d3afe228ae08aa87e8187392f62d2a0455dab379a6d7c10f24600eb8cb65f16ec891f2c671f3a94689ee669c5366f9ba9135c8640f1ea3105750c73c34be

Download Submit
C:\Users\Admin\Desktop\PushOut.wmf

Filesize
545KB

MD5
5186c46caab05067171eec19493720e6

SHA1
8a1527a527f92462f83fdbac5e4843edfb27de5e

SHA256
48319d5cf418f9aac751d88d6c11745cd77f77bcc33597acba9740277f152a2d

SHA512
3417ddb612dbfd8905ec288802727da335a31c38d34838b6eada9423a2a3e46fb4b4a501fe227e5e2f2ba260c3287847c66c3455bb727ff09faa0e3b576cb67a

Download Submit
C:\Users\Admin\Desktop\RequestProtect.avi

Filesize
522KB

MD5
1a774f0d9192c7b5afded221597ab79c

SHA1
5d0259debccbd464c83b1b4d7ac3ccf1557db22f

SHA256
02849a768e5408cd35285ad55c5857e148c5a5d9ce5cc28054fe3aee321f6992

SHA512
a20356477670df323ad77e21a98595707a31c9aead275f7e3f242f0d9b38aaf4d1064af03208730e818e4460163e777fdfc5b8fd351a7dce9040532547be6605

Download Submit
C:\Users\Admin\Desktop\ResetDisconnect.easmx

Filesize
568KB

MD5
5f68ec8e2d01b6983f40f228f0bb16ab

SHA1
7fb9e750168a97fa5806116242b5c7ace27fd06f

SHA256
1c2564cb9c0601097b2061dba1355d94ddf55591de50374a7ca5503aa4c507d7

SHA512
522358e237d69bc86e2631de7efc105cc7807681e7c31e49731cc21f37b7b42d2f5359cbc88689a2a1fc2cdbfae7c978b037c8d965468af9ca31b989a2810d02

Download Submit
C:\Users\Admin\Desktop\RestartWait.bmp

Filesize
476KB

MD5
425f7bfc95a2dd22f6c3f8920f275091

SHA1
900cacf482025de017b166041e298e4471b41c86

SHA256
08610f313da3ffc6a6950cddb0029c052d05949477c3750c57aa3a2bd8a53f6b

SHA512
472347e8ece22c1deddc41aa6d73075f3e4bd902e44214912801532ef39b867ed67e4b7daee9aae832b7f1c8483f3ad15228ff04d4c90e4f4da71f70a5f1dc0c

Download Submit
C:\Users\Admin\Desktop\ResumeDismount.wmf

Filesize
243KB

MD5
ba30b3ef54911397dc6d70d54033c415

SHA1
ca5a99959d9f334e8b761bf4f7ecc153f8db113a

SHA256
a5f3273a41444495a0520545720311759adfa20385156ac9d18a99d4a5a76508

SHA512
f0f4363f281277fa0b8cf47823a95dc767649b7bea8e79f34e4cb2520860ef47967ce0cf2e6f6507c3a70ae90e787dafbd52d352595f8281d634d47eee4733ff

Download Submit
C:\Users\Admin\Desktop\ResumeStop.odt

Filesize
952KB

MD5
344438ddf597d2fc1f8ad36e0ef10cc1

SHA1
e419db39990eb789c83625d977e5ca04793c4f93

SHA256
d2183fcb8f34dc6dd90b87bcbc3da8305d2e7ec65a894e507f53e22e122da503

SHA512
d4897146af6b481ddd246f8146b7c1fb55eef779eee4cd3490cc9d2f671612f9a48b0298c21a407472083ac23f531de065383ff902d0723ff36712a641182c04

Download Submit
C:\Users\Admin\Desktop\SaveMeasure.tif

Filesize
290KB

MD5
a19f3c2d91d436d2843c4b6b45faf186

SHA1
26af503d5c1f9d14144ed728815716ff71a016ee

SHA256
53dea8343c7086c3a5d06f22a5f6f58f4ff8db518c860191381d7bac6e8b183f

SHA512
91aedeec785438655e8dbaa6c3f23f46fefea5ff7edef141375f6f50589968d04dfc96617edca90c88771df28ccbb522ec0ec941b9365225fbcd42d7b5034081

Download Submit
C:\Users\Admin\Desktop\SplitCheckpoint.xlsx

Filesize
9KB

MD5
77d28eb922d50af8b683854c56ba013c

SHA1
8e81f901bd0d90e939b3d12b0d4ec5751b1efb7d

SHA256
b4c5fea9114064aefebb86a3c34354c984f3f1376bfbed4c94d613377cd64811

SHA512
e419ad5e1eb95f37fe6c3b96f598416693a7fb1bbc769dcd186800fed9c257777612f87689dbda71bc97464832949ab6b9923ab4b606031c6942fc63ba648e67

Download Submit
C:\Users\Admin\Desktop\SplitOut.au3

Filesize
313KB

MD5
e5696a26f3c3c1ac4a7a971c3c5961ce

SHA1
bb4a62cabd40cfbcdd1167c10dd4457a6cea3450

SHA256
ff75036fd74b5112b513a03891fe546bbdcbfbd67fbfcbb4d6ef8e5a17560130

SHA512
514fb48ea062499f03ea2975be64028d983acdd7bf1b8f9e2103c2db1a6fdd14937cb7d1bae06fcbdf886eedc91d6ccfea514ba50fd8eb1d152c13b007fe50c3

Download Submit
C:\Users\Admin\Desktop\StartRead.ps1

Filesize
452KB

MD5
db60190eefbc6eb59dde158aa363b72c

SHA1
80adfa12d0758b758a055336fe984361ba60b2cf

SHA256
c5d329b5bc9e379569df757a65d14b882797a29db1920e34c5e8c6d5850da160

SHA512
146b23c91b797da7969eac62474b719eb56bdfc6184463c59f5017141b8dd1b2864e8ad0a59d3b7e42d5fa4204fad445c70f55d0608984bbb52dfba6c3770fab

Download Submit
C:\Users\Admin\Desktop\StepDisable.mhtml

Filesize
336KB

MD5
4dbd5927d73a8548cd53892fe8044314

SHA1
56d0443dbbba41a94ca3f5c1af596fed49223ad0

SHA256
5b7f364608523f561f998d9b90eca64e97e84b7fdecd3ca69a83a72b84b5e808

SHA512
65866c937978145b4450f13953b6fe448603c95c9c2a21ebb953f15889bb92f78b2d07b1c6f71558a0d7f253c273371235e82c2f27ea5e00dbddb0d3f0499483

Download Submit
C:\Users\Admin\Desktop\TestSkip.xlsx

Filesize
14KB

MD5
21a07fa76f11d98de999dcb49c696ab8

SHA1
c4d8e193ab4ccf97296ab660953cf483a01f2b3e

SHA256
cedc0cb7f070a3d009d760a9bc2cc7695c778a5e281d22c59f0614b0cbb7be60

SHA512
b6af3b0168daa827d28fdd15f38aecbe1c86256502f88f8aa7c50f010e807cdfe9827f5ae711c21c7b9fbe36019d1b199edb58e3b673f76b24a3c09f6d756da7

Download Submit
C:\Users\Admin\Desktop\TracePush.xhtml

Filesize
359KB

MD5
85b182f3e2e6268372cce3a914ee0ae0

SHA1
c15ccc2910440609bc0c96af9342274e42037fa5

SHA256
f349fd1d08c88cf762cf2db8b64768d0823e7b569dccbe52bc1480868c6d1a14

SHA512
170073df9b911376c2f64e9fed14d2f3d6878b4a6ce41d79274c206da8a5e5fb658e3aeea46aaa69d559675c2bae4010934bcd65afc15e745de21efc575fee5a

Download Submit
C:\Users\Admin\Desktop\UnprotectResume.dotm

Filesize
383KB

MD5
0c3ca26c688adec43eac4aaaa2211201

SHA1
970382ed5a0ee6b7ec3d35b1e8da74fe2d73d7fb

SHA256
123d659678e338b515d45d57f121a6d5b9172f14547cc045b7eb53c0d906fa8c

SHA512
ec09f9f793b6e14b8726cac8224b0d9dcb8e7923ec433af29853dadc393a4a371386e56f9653df4f25a82b5be19ab6741e1d7a64bafd01369f6e42389d679cc8

Download Submit
C:\Users\Admin\Desktop\WriteClose.docx

Filesize
15KB

MD5
72c06a1ed23ec9475fb70543e4ca3762

SHA1
516808064978d1fa666f2cb2193bf91e19eeef76

SHA256
d65e2b3c2fab413d61257e4f96f9230c46ca662113bc28e78e76339d4a866b67

SHA512
8054c050dd4c926ea27621266b73a0da815ac2f39ddc3464dcc1238104d8fc44119011530cd8ca91f0feef6fd7d56f96df251bee52317bba5b1882316985dcf7

Download Submit
C:\Users\Admin\Downloads\media_images_ptakwspodniach (1).jpg.crdownload

Filesize
46KB

MD5
9987455160273726f5894678429d5abe

SHA1
5291675ba62eb06953ea2543d139eb8d8ba1dd4f

SHA256
1480e09300dde94453bbf45950edbd2bcee237629c59c4930ae3dffa675ca75b

SHA512
75086a0cd7c6768c1a004871ce73e2da80a4b8b55134a881729b81067610e5fc61b5db5d9f4c1840a55f7fa74a782a8d3e33df10cb37c3d50eb6d6a560e1ae1d

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
782cf97cd3dccf80f7edc6faa7503055

SHA1
699b62807a07be1dc0f21143b71fb79372b90519

SHA256
441728534db63fed2d0935696141dda6febd2e585828b4d3deff71c1fa5ef75f

SHA512
3b61dc3f00be7a794517d71053330b27b2c351b71b3f1d4cec13b679252225fc9a9755dce0d954f7c3f60dfa0b26f077742a55746a829f16cf59034037c77543

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1000B

MD5
45a48e061cb93ec1417ebd9f13a442bb

SHA1
cfae7fc99a75e0bb104fb0daa472c8545fe379fd

SHA256
6c39ae902c654216cdd6808cbdcc3fcfda9f03fa5aa3c4ef62066dd32749051d

SHA512
0ddf412f487c6b9b5e0c9d600e9588297f31029299fc80b76245e7f519e9b4b582740b4dacad0dd897186d90c2b7d63c7de93590fc0402d528c0a07558f2b737

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
ff3fb12f07277798f0efcd55ad88afad

SHA1
8a4574e474516ba0bbac55f290cd0891c77867cf

SHA256
9cf3de3e75eb07ed457a6b047bf42152b0b3e46d93a829bad2c828d36c32cfe6

SHA512
53441b6d79a9d56140e50eed4f4d95fbcc2ba08d231562b95ed57d2ae13e15ddfa0c6211fa7fed190ca2d3324ce67ebe67a8814d1d3dd600d5275ec5c033f5f3

Download Submit
C:\Users\Public\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
862a7fea06b27f16c6dbdfaa91a5574c

SHA1
244fad51f176fca43349bf65373fd0866e132205

SHA256
2568e49033e1fdfcdeaa891726e65352c9ee9813c2b59e55f63f718f81d9f0f8

SHA512
dc2da0620e8ed7aa59183785b95512972580a4e9ee1aaa441a5680240c27d727150d0b014e5b521b23802c90b5aadd3c6559f1614087c6c5a7f994ac1fd3b76f

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
79ed587dccd1b619e4d35d682660c5de

SHA1
b48b22f0939c9c73e5c685ded7bc3106567d5004

SHA256
e6833cb665e6290631f3915d92c8df251d9ca7c1ac13e1845bf444aa2bff0089

SHA512
f777a7b453dce28d5df55fe3fcbbe366fe9a027619f311f1b0bac7447daaac3eaf14a703ba86bfed7318f9aef86c5fbe37a8df607a9b2ae6b10f1475fac469d4

Download Submit
C:\Windows\System32\Recovery\ReAgent.xml

Filesize
1KB

MD5
cfa0ea357428ff59c6c551a67d12431e

SHA1
d163f5ab7abe526c4548288f5939e0610a520723

SHA256
e8e833a103309ab6ea26f74b75abb8498377a6d1e5175aea1ff0dac7ec7e545f

SHA512
732ceb62029ae9f37c8ec2be59a442276be18ff943d33c60c4128c36545437bef94edf8dfb49b21eca7f94ed69691b49f78a33260964a8678ae93d172cf18ebd

Download Submit
memory/1940-652-0x0000020BEAD10000-0x0000020BEAD30000-memory.dmp

Filesize
128KB

Download