f0c32919b62f1fe1c48c0786732f94181758fb2dbf7286b2d3edcbb57b5ca017

Analysis

max time kernel
150s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240508-de
resource tags

arch:x64arch:x86image:win10v2004-20240508-delocale:de-deos:windows10-2004-x64systemwindows
submitted
07/06/2024, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[Original] Magical Sounds 1.mp3
Size

2.3MB
MD5

ccce10714c5240329f00c16f59cd81e0
SHA1

accf7d641f365902f0315a2106be233c15a522f6
SHA256

f0c32919b62f1fe1c48c0786732f94181758fb2dbf7286b2d3edcbb57b5ca017
SHA512

af6bcd1858474db25e2e18f233ac8fbeac3b1577c2f701af07458355c967712b26c9cee559e62b7e185904f87d1464ef831175984bef36beb682563779bc35af
SSDEEP

49152:dAr/VG+3v/3zCCMc0+rf35faa/5hbAfWO4SbPXrFT7FxNUKipj:dY9R3v/3zC9Cfv/5RNVSbrRBnG

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133622621608356616"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2780	chrome.exe
2780	chrome.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4348	unregmp2.exe
Token: SeCreatePagefilePrivilege	4348	unregmp2.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe
Token: SeDebugPrivilege	4868	taskmgr.exe
Token: SeSystemProfilePrivilege	4868	taskmgr.exe
Token: SeCreateGlobalPrivilege	4868	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2696	3588	wmplayer.exe	82
PID 3588 wrote to memory of 2696	3588	wmplayer.exe	82
PID 3588 wrote to memory of 2696	3588	wmplayer.exe	82
PID 3588 wrote to memory of 2772	3588	wmplayer.exe	83
PID 3588 wrote to memory of 2772	3588	wmplayer.exe	83
PID 3588 wrote to memory of 2772	3588	wmplayer.exe	83
PID 2772 wrote to memory of 4348	2772	unregmp2.exe	84
PID 2772 wrote to memory of 4348	2772	unregmp2.exe	84
PID 2780 wrote to memory of 5104	2780	chrome.exe	99
PID 2780 wrote to memory of 5104	2780	chrome.exe	99
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 2744	2780	chrome.exe	100
PID 2780 wrote to memory of 3264	2780	chrome.exe	101
PID 2780 wrote to memory of 3264	2780	chrome.exe	101
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102
PID 2780 wrote to memory of 3704	2780	chrome.exe	102

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\[Original] Magical Sounds 1.mp3"
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\[Original] Magical Sounds 1.mp3"
  2⤵
  PID:2696
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb249cab58,0x7ffb249cab68,0x7ffb249cab78
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:2
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2292 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3116 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:1
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4332 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4292 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4636 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
  2⤵
  PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4768 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
  2⤵
  PID:4184

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1624

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
7c4a4853a5e28e442fb0bfdd38ad75bb

SHA1
ea94bb7129c979c57640b9e65d09413533e855ab

SHA256
2c48786b15ff46b5572e25e6a36499921bb2ff88d3f0c9c9da20655696d78514

SHA512
cd296dc26379ba338d7f25bd09029d0118ec53fbc26bf6b3f156f883ea3899f834924bf5f29f43e05a1f43adba54f707ac02f87ad13fbeabcf151f1a8de38711

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
5a75f9440ece5553418c26edc69ba5a6

SHA1
d0c34ad96f353acf7e59112ee72488512cdf3231

SHA256
4474f383ab587c6aef8fb81969c8635e92106107b35ca8610ebdf98b5d73c87a

SHA512
a64841f58ffce1c7efeaa68561424f6dd8ba4e1f2a3460590f82692b28c348fdfb9bb683cd295a69d107e02183e35358f8cbdc3faa4ec5cba3b13ea84a012556

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
34e9ff443222c0ce7da16f000fa68c09

SHA1
f160f47dccf9e8b0a24dd238e59421bdb5325d64

SHA256
af19f975425655ee6e2d2df26a6c2adec3e5b2cfc1560da3e8d548063a930dd9

SHA512
f51c41eb923ec423fd2eda01ae6d6ea316925cd77e12a4e479fa444148d348e5061b5f0a4601530d794820ff2825c4f888478b07f3e921f8c4f7c1a67c43a5cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
0a7028735e507a21ac142f5d0abc0e64

SHA1
77258de34acc8daa3b5a79d399e8f290e300d688

SHA256
9ecd18f82d2dbd839576134abff4a888a92036c8606f5419eedd0f65604d92a4

SHA512
40e05374133ba5885c8846ae1bcb770a186898f1232a6fc275f99e90aea2b9326910d194795a0e6c32d721fb7fa78b4b5d45c96b0a7b79c954ec8408ff342fb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
263KB

MD5
c961fb11ab0631aa5c539559512de38a

SHA1
9f8e4a262bbcbd93452715677e621862a1bb6637

SHA256
fc76ba2cbb1611ce549e4a024402cc643e6f5a6842f4a4aa034f9eda5e6ef35b

SHA512
3f741a40776d4d8db1ea87ffa9a2cc136b8d0c3950202382253ab2e4b15587cb1949ab68210eff3f460c3cd6a329ddcccbc2e82a33acd99f396d66818129728c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
3c0ba57539d7233aab31a10b4e91a289

SHA1
43904fa5431352106f370d841dbf8c482f338b1a

SHA256
2f366eb1850fc4950b5c7bc9ffb3d8c9892cce5bfaed6cd3a1aeef0d280f29b9

SHA512
bf21ba1905a072067265b88e14a3839b60332f61c2bacd39ee47d698e5bbe3f5c0f64f71017e0dc60322ef27aa30f212800b5e8e2b9906eeaf5fc4fdb01c8961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
ea15163587d7d04e17a2fc01a2b68847

SHA1
42c3627cd66a52e2d6356cb243da2c135e2758fe

SHA256
ea8e6265a41fe96693bba6a0f1cfc8b2becc9c87dbbb7e6b11b9b0f138b594db

SHA512
4e972a7c7916eb3b450af3045a16f760fddb3430eaaa425338b311b0d53ef413aca4caeeaecec42c5151bf723172ad82a4792bfe778e7fb5d1b238951efde525

Download Submit
memory/4868-164-0x00000169D1070000-0x00000169D1071000-memory.dmp

Filesize
4KB

Download
memory/4868-165-0x00000169D1070000-0x00000169D1071000-memory.dmp

Filesize
4KB

Download
memory/4868-163-0x00000169D1070000-0x00000169D1071000-memory.dmp

Filesize
4KB

Download
memory/4868-175-0x00000169D1070000-0x00000169D1071000-memory.dmp

Filesize
4KB

Download
memory/4868-174-0x00000169D1070000-0x00000169D1071000-memory.dmp

Filesize
4KB

Download
memory/4868-173-0x00000169D1070000-0x00000169D1071000-memory.dmp

Filesize
4KB

Download
memory/4868-172-0x00000169D1070000-0x00000169D1071000-memory.dmp

Filesize
4KB

Download
memory/4868-171-0x00000169D1070000-0x00000169D1071000-memory.dmp

Filesize
4KB

Download
memory/4868-170-0x00000169D1070000-0x00000169D1071000-memory.dmp

Filesize
4KB

Download
memory/4868-169-0x00000169D1070000-0x00000169D1071000-memory.dmp

Filesize
4KB

Download