hxxps://drive[.]google[.]com/file/d/1Qoetcrar3b2hHsjt1uoej9neMZhV4FHd/view?usp=sharing

Analysis

max time kernel
63s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2025 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Qoetcrar3b2hHsjt1uoej9neMZhV4FHd/view?usp=sharing

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
4292	Papierzak.exe
4292	Papierzak.exe
4292	Papierzak.exe
4292	Papierzak.exe
4292	Papierzak.exe
4292	Papierzak.exe
4292	Papierzak.exe
4292	Papierzak.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
7	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Papierzak.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
2500	msedge.exe
2500	msedge.exe
1180	identity_helper.exe
1180	identity_helper.exe
1136	msedge.exe
1136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5788	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5788	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4292	Papierzak.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 3872	2500	msedge.exe	84
PID 2500 wrote to memory of 3872	2500	msedge.exe	84
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 4364	2500	msedge.exe	85
PID 2500 wrote to memory of 436	2500	msedge.exe	86
PID 2500 wrote to memory of 436	2500	msedge.exe	86
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87
PID 2500 wrote to memory of 1044	2500	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1Qoetcrar3b2hHsjt1uoej9neMZhV4FHd/view?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff38e146f8,0x7fff38e14708,0x7fff38e14718
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10602183508924009063,11579893872546589545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:6056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1824

C:\Users\Admin\Downloads\Papieżak\Papierzak.exe
"C:\Users\Admin\Downloads\Papieżak\Papierzak.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4292

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
4852f07e2adc72578b121cc05863e115

SHA1
1f4dc0d79a97461d2953605cf474d7d2244a933c

SHA256
bbe617506f5e02738f6a5cc5fdb8a3dcb41a0e5ad966e3ab81167d9b46f74cb5

SHA512
9b6081733a1f8fa59c6cb795850c9508d084eafc33de62370ab09145beff846631510459a9a99dda261b4b503a80e46c7580436725c39a736ec2e91aad585e43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e45c9f1cca76ea611a4e394f8f2e952d

SHA1
17cf0c2f9f73ba1c32e4f5ce640b87d992059d4d

SHA256
8b2083e4cf28e97387e56c9594d2ca60d2d9040a9275d603101f8dbf7ab47c2c

SHA512
53176ed3e9497e3838bdbda53701e75dde2f8af4b6c2e76580d29a742382e610f1e6198b9ed94baab4720762fc11805a5a869645a8c63d4404a43192bbeeb9f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26d070a49e117020236979ba77ba23aa

SHA1
5907c896dfae5d4f6cf9d1d1272791fa20a0ffd2

SHA256
e71d1a1bd6242093ff17673923350a7edd93d7c6ad4d0a01c580c2ece212957a

SHA512
f73f43d859b212f080c94697e6e209163949a5bfa082a16145e6089123d917b8034cc38581a0ed21c75f764ed6006462d7b625c24371d274bd060825a6610bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2957d0f8ac1cd97a76f51cb64544e09c

SHA1
9735fcbacb7d51d9f9032d2b27270b4428a0da29

SHA256
d7ec5a99b4351895a9c6afe18b4d3a1c1e9e2151311f7a77a5f4dfcf3e89ef27

SHA512
6d95ab13c295896577588ad2ef81e8c7b73b83586c150f85b51bf424d6bc06cad5e8339182b74487e48b11ed21eb60514533022005bacda62152cbb538fd1ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
141d7ca5869926a8d9829adf5b4f08f3

SHA1
10dfbd31895970dd47b101cf843a7d1f3f38b720

SHA256
3e42f1c567b6c1500c108dcc1842c2dbb6e41a6e278c30916e04da68ac112e08

SHA512
59c0f1c24945e382b9d917234bd30460803ccb781743e30ca4a2ceabf72c8985ef9b2e667103ab0924c966a0a7e0f483131397be895465846617855cc753ddbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3741c719bbdd9c0766787ea2acf0afc0

SHA1
0ecffad949aa9f3e18f343a147788cc6812e84d8

SHA256
1de21f9a1e945c4efc5a3a3c3e066b711cd81bfff0d4e36212aa64725d2b4d31

SHA512
479afd3ba62851e14593080c4426951a2617f356880f0cd47c0e0ff8e6b3b1c195955481d41802b02bbc588f39c47e13a14892a842b9ab5ca46d0c9410e7a295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b05601135392682ce841a03bcd4e30a2

SHA1
54ab3ca9c5fb221dce0bf6ce3f5d72387d814351

SHA256
88bd906448dd53495cb12b1a31b4b2222b092d3b006a0794e48f4c6a8cdc0d88

SHA512
2589b65db342f1be8492cd080b88cff484cb470effb6dc10c110ee501db8e917bd86da4d38290b990d295c56d256a435049f8f63396ecb4ae2794996e8bacca7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrt217D.tmp\WndTransp.mfx

Filesize
65KB

MD5
6f93111ce72225daab2bcdceee48d204

SHA1
1a5156f6e00b47dd4197c933092578aef49a66de

SHA256
e8a1af555a3d39b1cb0c6bf6511158d4fd48a1e4e2dac60a6f54af4b486f60a1

SHA512
44549a2f29c9b4cb217065cc4f670afe84691fcc9d0bb4898cd8caa408256015b1abc1c29b6ce4083207e56f339f0843757ae07d01e2a2bb945b6ddaa4c8d3f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrt217D.tmp\bigbox.mfx

Filesize
84KB

MD5
ad6530e01a4827fba383291847e33036

SHA1
6ec72ed182478c050807c0e3270974bf34304aaa

SHA256
a427377e56a804f82a5bcf07b7d5afae920f8bbda2dc5f52ce6a7f84448a8bb1

SHA512
33cccc49302f3c257a3ed3b9d3bf0b2dbb347ccba3b6196a01ac317f83c2bd47c5cb9bf47fb677374b95590d62f5626aaf246a318999a4b07c5ee60c4c4ac863

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrt217D.tmp\kcwctrl.mfx

Filesize
12KB

MD5
14e1d33e5c9db83a0dc3101f712b2802

SHA1
37eb0cfc5336681275b9c4e0badc7e25018336bb

SHA256
2f0f00f42917792c0c3ae4640009dedee3c96408173211e44cbbdd6a04f4afad

SHA512
0c0524b2a2b4f64592bd96486cac5f080adbe8971c8d84d6d240656420c01bcb53d12044a8fab220ab5ec34d3978a81e1d2cc76306153a176a57e88a035372a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrt217D.tmp\mmf2d3d9.dll

Filesize
1.1MB

MD5
22284d6bb382967ff72363f828050e13

SHA1
5c98e25d24aacafffded9353c9526be0128c6dbd

SHA256
9eaa342059785bd584df956574c637e6d0e6016a099221a56e0397f8c86cd93f

SHA512
2e5a5bf115b1d2a07d0647b6f4925ab84301ca6354e3f3beb8d44f51900ff21b06b97b23128160fd94dfd33116d03094ca47c49143ae98473eaaed441f9705b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrt217D.tmp\mmfs2.dll

Filesize
459KB

MD5
4cf7bb74d8104280b7e986f4df21109d

SHA1
edc21a43136afddbf4786593e84b934d40591b74

SHA256
c0d56cefb509e5600ac6b430adcaf53b81881d3fff4e62b7ede158d66d826622

SHA512
2bbac48354657659795697e67508d777ee595348e1fb3d4b6c65d8618c346b3be0052b1e2e2fe669dcca19c3c00d59d1833acc21d88a97efbde2694935e3c292

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrt217D.tmp\mp3flt.sft

Filesize
24KB

MD5
7beafd3ec0c36a1422387c43c49f68ff

SHA1
240e7d8534ed25dffb902a969826f4300a88dde6

SHA256
cd5bd7cc59eaf42bc0edf418ce6f077f9db369d5e3c414107b82492a877a6176

SHA512
44101803bd757bb7a84577aa1c087472a619da732dcdb3947b683cd7a7df30931e4c9973e06532859f9654c4ad3635db205e41fc7214a0f52537be91e87b2734

Download Submit
C:\Users\Admin\Downloads\Papieżak.zip

Filesize
33.8MB

MD5
bd1b6bf6f05cfea59626058d8b299ed2

SHA1
8c444a7a46fddcea71401074c21259af91933dcb

SHA256
99a9c08103e643886e2c2253b77e09300f402d4a48cea6c329456009ed812ddf

SHA512
5ff70232f3658bc82053beb4e3e62cc1a7006800630d46fbc63886cf6ce1c96ec88e1a3bc3d8e334e5a5cce927f9a720f6077fb079f0beb939625cc801bad357

Download Submit
memory/4292-142-0x0000000002860000-0x0000000002876000-memory.dmp

Filesize
88KB

Download