763362aa38753bf8a6c147ee8faa37f7b37ded2ffb0743424fff599016fa4889

Analysis

max time kernel
1166s
max time network
1169s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
03/06/2024, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
time (ft. Ryaxrise).mp3
Size 4.2MB
Sample240603-scrw8aac4x
SHA256 763362aa38753bf8a6c147ee8faa37f7b37ded2ffb0743424fff599016fa4889
MD5 b19681e9caa18d6f55b95cc7f0cd0824
SHA1 5218158fd1e682bfa3ceadbf9b5150b1fc52b6da
SHA512 656b7f41a9b68f27c0c6fa8d06dd4272c69004d9f771b1c31133d98c957fecd6455e9ee86167505f11f85d55d8c882ca2f7cc32de0ed6087f7fde604d9daecc6
SSDEEP 98304:E0YnKurX+1ITecvUR6YCKHheiakcJxO4BgFqFK2n:EpvrX+FcvHTKHsiYJxOG
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
952	msedge.exe
952	msedge.exe
4128	identity_helper.exe
4128	identity_helper.exe
1508	msedge.exe
1508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3044	unregmp2.exe
Token: SeCreatePagefilePrivilege	3044	unregmp2.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 436	2068	wmplayer.exe	79
PID 2068 wrote to memory of 436	2068	wmplayer.exe	79
PID 2068 wrote to memory of 436	2068	wmplayer.exe	79
PID 2068 wrote to memory of 536	2068	wmplayer.exe	80
PID 2068 wrote to memory of 536	2068	wmplayer.exe	80
PID 2068 wrote to memory of 536	2068	wmplayer.exe	80
PID 536 wrote to memory of 3044	536	unregmp2.exe	81
PID 536 wrote to memory of 3044	536	unregmp2.exe	81
PID 952 wrote to memory of 2140	952	msedge.exe	87
PID 952 wrote to memory of 2140	952	msedge.exe	87
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 560	952	msedge.exe	88
PID 952 wrote to memory of 3852	952	msedge.exe	89
PID 952 wrote to memory of 3852	952	msedge.exe	89
PID 952 wrote to memory of 1480	952	msedge.exe	90
PID 952 wrote to memory of 1480	952	msedge.exe	90
PID 952 wrote to memory of 1480	952	msedge.exe	90
PID 952 wrote to memory of 1480	952	msedge.exe	90
PID 952 wrote to memory of 1480	952	msedge.exe	90
PID 952 wrote to memory of 1480	952	msedge.exe	90
PID 952 wrote to memory of 1480	952	msedge.exe	90
PID 952 wrote to memory of 1480	952	msedge.exe	90
PID 952 wrote to memory of 1480	952	msedge.exe	90
PID 952 wrote to memory of 1480	952	msedge.exe	90
PID 952 wrote to memory of 1480	952	msedge.exe	90
PID 952 wrote to memory of 1480	952	msedge.exe	90

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\time (ft. Ryaxrise).mp3"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\time (ft. Ryaxrise).mp3"
  2⤵
  PID:436
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff32a93cb8,0x7fff32a93cc8,0x7fff32a93cd8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1644 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1712,6744302649666763431,14515212051783525381,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d222c8e3b19cda2657629a486faf32962e016fc66561ce0d17010afdb283c9de
MD5 8f2eb94e31cadfb6eb07e6bbe61ef7ae
SHA1 3f42b0d5a90408689e7f7941f8db72a67d5a2eab
SHA512 9f7f84149885b851e0bf7173c540e466a2b2eb9907d8b608f60360933328cc75d9d1b63640ea4ecc1e64ecc5dd7ee74d82903f96a8b4418ca56296641a8c0703
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0bc24451c65457abc1e4e340be2f8faceae6b6ec7768a21d44bcd14636543bae
MD5 d56e8f308a28ac4183257a7950ab5c89
SHA1 044969c58cef041a073c2d132fa66ccc1ee553fe
SHA512 fd5798559f4025ec3408f5550b8671d394b1ec83b85fdac8c005b0cc3e183272bdd07db15a156a572c9c5e5798badf235dc10aae62a052efa8dd9dfdbdca8189
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1008B
SHA256 3cf94167b94968aa83f5ba2dc0dd4e1f9c655ee0e407576c5f16afe3faca2d4a
MD5 744b71fa04d6263bfb31d637d2baf757
SHA1 692c1d571cced2bc08875db66190408be4142fc1
SHA512 dda381a82b808635a98fce40f522d9f9841c3e7f90b0efe9b0c7bd57fef9f83d2887fdb153190f005f8020cee2e6fd4b9366847da45934f1401848132fea13cc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 398B
SHA256 e53de4269917e54971c4c914bd5911a6371eba46cccc8c6cdbbb890348148c9b
MD5 cb0c7383674974b85f5941c7df6b328e
SHA1 758872abcaf2e1d4619ec371fc8b66484b15b253
SHA512 0c08c41079575357a2a7d66fafd7792d4398e84080c80afcd48e10f3d47822e1ed9f943ed33bbb5acf327bba5c5ad9c4a3151fb85774948e47f41a8aa48d0195
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8b047d1a39d7a2518e09fd266bcd1361fcd76b37b54a67ff413f36021677623e
MD5 dd1df6970a4ebaea5033fb439d05e072
SHA1 774d8e7d1827be144370bc8acf19c7935fb357a4
SHA512 023d3b98882a96536237c7e3b8e2f49e3edaa1aaba7d96f35073ab5f0ac63f975642fc13f2226390907a99938de2f4cc785dac3068caeedab221b98e38e834dc
SSDEEP 96:n0k3ygPZkIExcGwSv0MoiVmdHIeJQ0WQyV+VuziX3wI3:n0k3hPZkptv0MAIcQLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 90d42c9e2518a19fd4f2d0e5f3b292c74e6a48d3c1c400519852530d7ab3b57a
MD5 ba5e092289ab220b573c2c681c1c7b28
SHA1 9ef9be06be007beb8ef0f20fe970e620e53080b5
SHA512 fe988aa19d7162c0dfcd7ef2cdb47a7d2b97c72a7449334926aed3f392de6f04f9df674af2613764ee6b4d107198609aa3f6c27fb33e06cbe8b6d611d168ec20
SSDEEP 96:n0k3dgPZk4ExcGwSv0MoiVmdfluI1jIhWJQ0WQyV+VpAiX3wI3:n0k3+PZkZtv0MouIhI2QLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c3fa44bb0178bb23a301db7a324ebf1683189847cd8053670dc500918af6e813
MD5 3bd4261db7e7a8851674dfb110e13ee5
SHA1 f523101208d1d982ea330376e9bf73abc9170158
SHA512 774ad05202960cee56480f29cf4eef6582806e7ffb7655b9e953b300ca239bf5038962d36258c04647b689a9c947441ef4c83bc6e3c3b59aa75a0694df99cb63
SSDEEP 96:n0k3ZgPZk4ExcjwSVl80MoiVmdFlwqjNIrWJQ0WQyV+VpAiX3wI3:n0k36PZkZMH80MiwqpIQQLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a04a384fb5b89f672589ee8a676d60d19e8b401e30a2c30b90ce2f4122d5edcb
MD5 64013d4ce0a694da5e840c64e49c5fb4
SHA1 b8dea37e25767940c3650962bc7455068dd7d6d4
SHA512 7f5ce4f2b32c884ebc44672f33ecfb809337046562d748ddcdd0c6a32c909f292850449f30962a7fd87d03587e2983086eba0460995fbab3103fad299ed78498
SSDEEP 96:n0k3dgPZk4ExcjwSv0MoiVmdFlwqjNIrWJQ0WQyV+VpAiX3wI3:n0k3+PZkZMv0MiwqpIQQLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 2696669f8e8ec9b87b487b18cf4d8a2acebd5f94322064ba29e410daa60fbb09
MD5 e09f2c548b5cd0403732291be4c51176
SHA1 6c7b201ea1a27c05fcbbc548cae6164ebf37672c
SHA512 894df59d9b4401714a69cd391cc253e99c217397615280e7360ac5c6f37856407caec988887ddc789a41c92933cf3f9494c6634245b76b78dff5e4719859f9f2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 73fa30a2d8a7c0e5d98ad4d1eb035b5569d2695f392217ffcbc00b3bdfc58395
MD5 3955ddad944b18b5ae6f80f853e4ac4f
SHA1 6a4771cd2e121f8e4455e8853aa100af111685a5
SHA512 84d8da1e524880ac91020535674260d7a3d6b3c522b00b238455707afb071b48e6dcfd45f9140f13bef8baa849d3d897c2fa3789ae86a3a347becbfc76122b65
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 4bae1b5df8c849fc53c25c0aff7a0afb90ed3082b5453dbd561eebca406f172c
MD5 d5ee00a2b822b67196e2815cb51525cb
SHA1 dfc35ae1405f8987288484fd762665bc8c7bf9c0
SHA512 268f2f7cc2d91ca610e5dcb9f93ad7f8af0a167ed978e2f110a16450ddf2620298b89f4b4f7e8384a75632d78792ceb0bfad3807e2e70c6f6dcd260c320bc447
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 454093ec3b7a0e1fd3544e91a0f6baa4ba8848e67b821694450d68067db442f2
MD5 32fe0606659e99a7e274d757c2f89649
SHA1 bb2bc357edd4964696d8fa81e9b8d140ebe380ef
SHA512 e65806e15a6bfd213348785e911ea5ff013b01f4e1331c91aea086ea5925f81e3d94796952152f261bcdb3fb440c915c52fe5b7dca53c51367edc4712622f05a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 5a387e7014ea677dcaec44625ffab874c4f77e287800fc7aadf0c76cbfbbe2c7
MD5 18bf2cfc4aed50e3e1ffbd4da9194a33
SHA1 43bc2006dba1946243d241fb79e112e88a9d9a75
SHA512 d84b7cf3389764a2a50ddc1cb1b70ea4784f566b263340cbc13e0341c9bfeaead2ea794617ae5b60036a276f937419ffd5942806d3c3370194cf128f3e2b5c47
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe584ac0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584ac0.TMP
Size 705B
SHA256 be3685b1a873aae2f7d6c4072b94118df9a81950a11b27783815f39d5cb358c3
MD5 4abcb6f92827d3881c92e1c02ba6981c
SHA1 3acb342d0293158c7c057d7a1317f56f21e10d00
SHA512 c075f165ffd81b9b1d610f0a5bbb052493da29e29b15db9fe8ff01da891c8a836f24303fdfa5891a321fb87d7f3c89a75bc78b07b2776853c1bc3887aa125c1e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e6ac56537c1e03a1b4bcd088e7538b3d45406bcfcf03663a66bdd1b662f52e83
MD5 104bb1117b7bf3246363139c6c33132f
SHA1 0974ccec1b623ad827616b2fdceebf6688d4a7c6
SHA512 580902d941537bf76d4a711409774d936bc3a8b4669374b6bd8b5888a9668dd2d01b405499de565c9d8350d361f0c1b7b96b7384cd9ae6ece618c7bf3de62afa
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGvMlAx8e2RUgcRRmQ7YvmljE0:M9iIxuERzA83h09RZxASGknxkmQ7Yk9X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 595bef99059011093fe5fb25f551433aac479b2ad71a1505c0efc548509e682a
MD5 158b641cd85a3d4c56038ac3320ba21e
SHA1 ba6a61affd8cf81768a748b2041586bb1967cf94
SHA512 b662771b91fb4256f98b64e1e832265a424b18e19451b0784b45a0d5891b724be3c9a4035cc47b489f8ba064c99ef9704b585430f4401ccbd6e678f05443c089
SSDEEP 384:G9iIxuERzA83h09RZxASGkIxed8JA7Yk9rbnQSMO:1IxuERzA83h09RZxbGk0edeA7Yk9rbn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 cac3a8354c7766b4ce0900bf4d8097bf372ec405a6af4bba63a6d92132932a30
MD5 066f6e5acfff197d12b550ef7d452d41
SHA1 aaa8cfa5a56519594490d069f31a42a15ca515a2
SHA512 21c3985bdc883b7c0fcdfb660a577eb03870943d9e812a24726158b6c06cc36b00425fdeafddcb099fddd1488173280563f7241c9589e69d04d1eb1b5daa786b
SSDEEP 3:xnallkltlsl7pl+e/lls4XtXMlOI1Xlldl0lcNklltlwzl4hR/mll:s+1E3+e9X9kOI10cAe
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 126c1af995194819244b00b4174d165a8d60e2ec8e09a57b221dcd424c52c1ba
MD5 dffb4ef0bb7eb7f5a28a2818c97c9141
SHA1 3b699717cd5c34e33921dedb07a1ee31e6a8acdd
SHA512 a7d69f446355a36969d59ba9189a61df0c0c4d95f22b292f789ff2e5c9c9ad7510ae38cb7dd2a82750626633d136128598f5c0f0f49a1066f682390f3e5cb0a5
MD5 SHA1 SHA512

Submit Download