7a06bf10a4e8cc07674e6ed620fbc8dda4b91565d7c62ff8a255688bb9b4d4c4

Resubmissions

20-09-2024 21:46

240920-1myrhszenm 10

20-09-2024 21:43

240920-1k7xeazdpl 6

Analysis

max time kernel
110s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

imyfone-lockwiper_setup.exe
Size

2.9MB
MD5

f8b32e204dbf81a53f7af8049816e25f
SHA1

1d29574d0d26523b3eb394342e3ac3bc3ebb0abb
SHA256

7a06bf10a4e8cc07674e6ed620fbc8dda4b91565d7c62ff8a255688bb9b4d4c4
SHA512

f3190da71c180f896111efcc77d489b1ce454a2ed99477ca940a08bb48cd983b2dea0b23fe5690f9e799f6fa6bddb7bc7054e7c87783544a942380c0202f17bb
SSDEEP

49152:DhwMIHvI63WMBDe6Pu1MJ9TaPohZqJ3rZXYPlypM5HsSSHm7U7I:DeHw63Wmhu1u9TOohQJ3dhMJ

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
229	ip-api.com

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	imyfone-lockwiper_setup.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{18566a54-67b9-8442-87a6-84b1b4a2da6e}\SET817B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{18566a54-67b9-8442-87a6-84b1b4a2da6e}\SET818B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}\SET84E8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{18566a54-67b9-8442-87a6-84b1b4a2da6e}\SET817B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}\USBAAPL64.CAT	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}\SET84E7.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbaapl.inf_amd64_b11f4eb7484c8d3b\usbaapl.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}\SET84E6.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}\SET84E7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}\usbaapl64.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}\usbaapl64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}\usbaaplrc.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbaapl.inf_amd64_b11f4eb7484c8d3b\USBAAPL.CAT	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbaapl.inf_amd64_b11f4eb7484c8d3b\usbaapl.PNF	DPInst64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}\SET84F8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_c0e4d8c2aef471b7\USBAAPL64.CAT	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_c0e4d8c2aef471b7\usbaapl64.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}\SET84E6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{18566a54-67b9-8442-87a6-84b1b4a2da6e}\USBAAPL.CAT	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{18566a54-67b9-8442-87a6-84b1b4a2da6e}\SET818B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{18566a54-67b9-8442-87a6-84b1b4a2da6e}\usbaapl.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{18566a54-67b9-8442-87a6-84b1b4a2da6e}	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DPInst64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_c0e4d8c2aef471b7\usbaapl64.PNF	DPInst64.exe
File created	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}\SET84E8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1203070b-ab96-794d-a3b9-0ac25d759d57}\SET84F8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_c0e4d8c2aef471b7\usbaapl64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_c0e4d8c2aef471b7\usbaaplrc.dll	DrvInst.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\FeedbackRes\skin\gif\submitting\is-B998U.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\MessageCenter\language\is-R95NM.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\images\is-A58FA.tmp	imyfone-download.tmp
File opened for modification	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\2\b46ae678226f77a94fc94328f18e3872bdd6cf88\e9ca5a6f2e1c998b2c98d5ad03bfe9c280f288e2	LockWiper.exe
File opened for modification	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\1\514cdb66751229d146596937bbe4ecbbad90c028\0dc926a1810f7aee4e8f38793ed788701f93bf9d	LockWiper.exe
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\gif\Gift\is-A9H0B.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\gif\Gift\is-8MB17.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\Member\trial_limit\is-CKLPS.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\PurchaseDialog\is-5S0QP.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\1\514cdb66751229d146596937bbe4ecbbad90c028\Manifest.plist	LockWiper.exe
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\is-M5SPR.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\mutilanguage\is-S1C0L.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\mutilanguage\is-5CDG8.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\1\514cdb66751229d146596937bbe4ecbbad90c028\4d6bb652961e1b6cefcf502caa08caea179e2b64	LockWiper.exe
File opened for modification	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\1\514cdb66751229d146596937bbe4ecbbad90c028\52c03edfc4da9eba398684afb69ba503a2709667	LockWiper.exe
File opened for modification	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\1\514cdb66751229d146596937bbe4ecbbad90c028\ecc5af7be0258d73c549afd70805fc56f8c4bebb	LockWiper.exe
File opened for modification	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\ucrtbase.DLL	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Language\FixiTunesQM\is-R0G6P.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\CBaseEquityView\IncludedIcon\is-9JKM5.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\images\is-37MRU.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\mutilanguage\is-4SAM8.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\1\514cdb66751229d146596937bbe4ecbbad90c028\943624fd13e27b800cc6d9ce1100c22356ee365c	LockWiper.exe
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\PurchaseDialog\is-J0522.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\language\Japanese\UrlInfo.ini	imyfone-lockwiper_setup.exe
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\is-JRCBB.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\is-CFKPU.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\AddPurchaseWidget\is-752DJ.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\Application\is-53D8B.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\images\is-COISC.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\is-VF7SD.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\MFCore\is-1E4PJ.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\2\b46ae678226f77a94fc94328f18e3872bdd6cf88\e9ca5a6f2e1c998b2c98d5ad03bfe9c280f288e2	LockWiper.exe
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\FeedbackRes\skin\gif\submitting\is-JGP4O.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Language\qm\LiveUpdate\is-H8UF9.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Review\language\is-63J54.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\AddPurchaseWidget\LeftEquityImage\is-L5GA2.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\Member\is-A73K5.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\Member\trial_limit\is-43BR4.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\2\b46ae678226f77a94fc94328f18e3872bdd6cf88\0fb54654b97099d34461570fab859a2b0570ed1f	LockWiper.exe
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\apple_driver\is-IK4JM.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Member\language\is-HCCGE.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\Application\is-MRB6V.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\gif\Activity\is-7AMUT.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\gif\Gift\is-8R8LB.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\Two-Factor\is-L8D5P.tmp	imyfone-download.tmp
File opened for modification	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\FixOS\libplist.dll	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\is-6AF9E.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\apple_driver\is-TP0EH.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Uninstaller\is-QN78D.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\is-96C16.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\FixOS\is-Q1IB1.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\images\is-7AJTJ.tmp	imyfone-download.tmp
File opened for modification	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\1\514cdb66751229d146596937bbe4ecbbad90c028\a458732fbad86b9f854f2ae3e2cfe595e5c39beb	LockWiper.exe
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\2\b46ae678226f77a94fc94328f18e3872bdd6cf88\b5b73da26a6d2e9b8d702a31478ce35802e8985d	LockWiper.exe
File opened for modification	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Qt5Network.dll	imyfone-download.tmp
File opened for modification	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Qt5Svg.dll	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Language\main\is-NSP69.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\Application\is-KJHUQ.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\PurchaseDialog\is-N9VMQ.tmp	imyfone-download.tmp
File opened for modification	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\1\514cdb66751229d146596937bbe4ecbbad90c028\7e9faeaa271021ac54a4f90cbaf047601854a20c	LockWiper.exe
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\2\b46ae678226f77a94fc94328f18e3872bdd6cf88\Manifest.plist	LockWiper.exe
File opened for modification	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\apple_driver\usbaaplrc.dll	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\is-TAI02.tmp	imyfone-download.tmp
File created	C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\EquityBuyView\icon\is-2TVSD.tmp	imyfone-download.tmp

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\DPINST.LOG	DPInst64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DPInst64.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe

Executes dropped EXE 6 IoCs

pid	Process
2220	imyfone-download.exe
2408	imyfone-download.tmp
5476	LockWiper.exe
4436	DPInst64.exe
5932	appAutoUpdate.exe
1812	devcon_x64.exe

Loads dropped DLL 64 IoCs

pid	Process
2408	imyfone-download.tmp
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5932	appAutoUpdate.exe
5932	appAutoUpdate.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imyfone-lockwiper_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imyfone-download.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imyfone-download.tmp

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DPInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	LockWiper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DPInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	LockWiper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DPInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DPInst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DPInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	DPInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DPInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DPInst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DPInst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DPInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	LockWiper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DPInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DPInst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	LockWiper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	LockWiper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	LockWiper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	LockWiper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DPInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DPInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DPInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	LockWiper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133713422718197485"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{9C9CDE9A-A8C5-4F8D-9597-3E6A1F02BDED}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1920	vlc.exe
5476	LockWiper.exe
5932	appAutoUpdate.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2732	imyfone-lockwiper_setup.exe
2732	imyfone-lockwiper_setup.exe
2732	imyfone-lockwiper_setup.exe
2732	imyfone-lockwiper_setup.exe
2408	imyfone-download.tmp
2408	imyfone-download.tmp
2408	imyfone-download.tmp
2408	imyfone-download.tmp
3004	chrome.exe
3004	chrome.exe
2732	imyfone-lockwiper_setup.exe
2732	imyfone-lockwiper_setup.exe
2732	imyfone-lockwiper_setup.exe
2732	imyfone-lockwiper_setup.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5932	appAutoUpdate.exe
5932	appAutoUpdate.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1920	vlc.exe
5476	LockWiper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeAuditPrivilege	5832	svchost.exe
Token: SeSecurityPrivilege	5832	svchost.exe
Token: SeLoadDriverPrivilege	1812	devcon_x64.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2732	imyfone-lockwiper_setup.exe
2408	imyfone-download.tmp
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
1920	vlc.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe

Suspicious use of SetWindowsHookEx 55 IoCs

pid	Process
1920	vlc.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
4436	DPInst64.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5932	appAutoUpdate.exe
5476	LockWiper.exe
5932	appAutoUpdate.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5932	appAutoUpdate.exe
5932	appAutoUpdate.exe
5932	appAutoUpdate.exe
1812	devcon_x64.exe
5932	appAutoUpdate.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe
5476	LockWiper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2220	2732	imyfone-lockwiper_setup.exe	98
PID 2732 wrote to memory of 2220	2732	imyfone-lockwiper_setup.exe	98
PID 2732 wrote to memory of 2220	2732	imyfone-lockwiper_setup.exe	98
PID 2220 wrote to memory of 2408	2220	imyfone-download.exe	99
PID 2220 wrote to memory of 2408	2220	imyfone-download.exe	99
PID 2220 wrote to memory of 2408	2220	imyfone-download.exe	99
PID 3004 wrote to memory of 4484	3004	chrome.exe	105
PID 3004 wrote to memory of 4484	3004	chrome.exe	105
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 756	3004	chrome.exe	106
PID 3004 wrote to memory of 2848	3004	chrome.exe	107
PID 3004 wrote to memory of 2848	3004	chrome.exe	107
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108
PID 3004 wrote to memory of 1084	3004	chrome.exe	108

C:\Users\Admin\AppData\Local\Temp\imyfone-lockwiper_setup.exe
"C:\Users\Admin\AppData\Local\Temp\imyfone-lockwiper_setup.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\imyfone-download.exe
  /verysilent /imyfone_down /wait_run /path="C:\Program Files (x86)\" /progress="C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\temp.progress"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\is-03L0U.tmp\imyfone-download.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-03L0U.tmp\imyfone-download.tmp" /SL5="$802BC,153178567,123904,C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\imyfone-download.exe" /verysilent /imyfone_down /wait_run /path="C:\Program Files (x86)\" /progress="C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\temp.progress"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apipdm.imyfone.club/producturl?key=installed&lang=english&pid=91&custom=com_english
  2⤵
  PID:536
- C:\Program Files (x86)\iMyFone\iMyFone LockWiper\LockWiper.exe
  "C:\Program Files (x86)\iMyFone\iMyFone LockWiper\LockWiper.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5476
- - C:\Program Files (x86)\iMyFone\iMyFone LockWiper\apple_driver\DPInst64.exe
    "C:\Program Files (x86)\iMyFone\iMyFone LockWiper\apple_driver\DPInst64.exe" /F /D /SW /PATH "C:\Program Files (x86)\iMyFone\iMyFone LockWiper\apple_driver"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious use of SetWindowsHookEx
    PID:4436
- - C:\Program Files (x86)\iMyFone\iMyFone LockWiper\appAutoUpdate.exe
    "C:\Program Files (x86)\iMyFone\iMyFone LockWiper\appAutoUpdate.exe" --autoInstall=true --updateURL=https://apipdm.imyfone.club/v2/verinfo?bit=2& --silent=true
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5932
- - C:\Program Files (x86)\iMyFone\iMyFone LockWiper\apple_driver\devcon_x64.exe
    "C:\Program Files (x86)\iMyFone\iMyFone LockWiper\apple_driver\devcon_x64.exe" rescan
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.imyfone.com/unlock-iphone/unlock-iphone-passcode-without-losing-data/?utm_medium=message_center&utm_source=mc_lockwiperios&utm_campaign=lockwiperios&utm_term=24090604
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.imyfone.com/unlock-iphone/unlock-iphone-passcode-without-losing-data/?utm_medium=message_center&utm_source=mc_lockwiperios&utm_campaign=lockwiperios&utm_term=24090604
    3⤵
    PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3808,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=1440 /prefetch:8
1⤵
PID:8

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\HideSend.asf"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff96707cc40,0x7ff96707cc4c,0x7ff96707cc58
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1856,i,12505888472453644720,8718746295280011689,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2076,i,12505888472453644720,8718746295280011689,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,12505888472453644720,8718746295280011689,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,12505888472453644720,8718746295280011689,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,12505888472453644720,8718746295280011689,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4568,i,12505888472453644720,8718746295280011689,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4688,i,12505888472453644720,8718746295280011689,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4920,i,12505888472453644720,8718746295280011689,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5040,i,12505888472453644720,8718746295280011689,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:1908

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --field-trial-handle=4944,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
1⤵
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=4240,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
1⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5432,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
1⤵
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5440,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
1⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=5832,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
1⤵
PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4796,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
1⤵
PID:624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5832
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{382d3f07-cbd5-7f44-8ff0-8a5d32b853ff}\usbaapl.inf" "9" "4363f9d6b" "0000000000000150" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\imyfone\imyfone lockwiper\apple_driver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5896
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{534c1290-0da7-e74a-9dd8-c34cb22ff8c9}\usbaapl64.inf" "9" "4d473d5eb" "0000000000000158" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\imyfone\imyfone lockwiper\apple_driver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=6188,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
1⤵
PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=6416,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
1⤵
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ff9604fd198,0x7ff9604fd1a4,0x7ff9604fd1b0
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2328,i,3742787909644834256,5109068895992646431,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1976,i,3742787909644834256,5109068895992646431,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2256,i,3742787909644834256,5109068895992646431,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4496,i,3742787909644834256,5109068895992646431,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4496,i,3742787909644834256,5109068895992646431,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:6044

C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
1⤵
PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Feedback.exe

Filesize
587KB

MD5
919e87b8f1a769c238c3ca50443e1bad

SHA1
f5f4eaac840319f958c208c1e118b9168aef46b7

SHA256
6772082c051624c299d10e14f7bf20b3686c14b4d1990bcffa5e393048414b85

SHA512
152e96aa98df339bf01b5fc731409d2afab80d30d8e586b896d484e65e3bbf5107798832109cd4d01ddee773e60fc6d1fd910ed08453f707e57844d29f81e20c

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\FixIphone.dll

Filesize
309KB

MD5
a4b95579f6c54a62d505d0e0c12536e1

SHA1
5b0bc6d0f8e071bbe186bd332f113bae20ca31c8

SHA256
2b887b96e9312ce51a33b8c623ba8592472e3354cd9c652e229b3c022507adf9

SHA512
8310fcff4ba090419680775cca944577a35b8f86f2681ed56501834761bb18b37dc782bc579581e79becd7c034e060f95956b563836b8d6bb011351a274d6c16

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\FixOS.dll

Filesize
506KB

MD5
daa5648011e0df357e49402aae3a9e86

SHA1
59a90a009a689060c1277ceeb8feadd7cc8ccbf1

SHA256
3fc9cec04fe1404db8f91d08b950efa64a7d345da5d78d14c10906cee12ce934

SHA512
b7540d131a433d01f536911cb914f573344cfde6a0489b113b942de8bce5c1f3f799dfb38173aa9acb5c53d9fc0ad48ad7e31dfa8e2454e234115e0de1a7be72

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\FixiTunes.dll

Filesize
1.0MB

MD5
4bb14f548d7b10e5a64a4531490a4b6d

SHA1
e7b2a6961fa8c5af8a4efd8129cc08d7b0e2e11d

SHA256
6d2d381996bbc18f187235f88378b5752a71442a1d23776f85044a025a58a4d1

SHA512
a6a6c8a1def1684b91a7545814ed6982c48f0a2efb05f09f3702dba56fd1aaa18195288465569476d18dfbe81887c55be196cbf7ee3bbd24d8d6a248a8cf4e7e

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\LockWiper.exe

Filesize
5.2MB

MD5
518efb6fa85566014b3780d2adb9743b

SHA1
a862a7f27ac344a9f28ed472ac32bf769c6ba3c5

SHA256
d6616257ab1888f2e3129338d88207d2caabc6fbe5807ab442a24ab864ab75be

SHA512
4435032848925d06b9b95673730013d6f6feae45e59382bb9387bd32de348f12d39e25f521ba46b9bec09a3061cea3b67bf428ce2c87ba19cf8ced7ec2435dc2

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\MFControl.dll

Filesize
811KB

MD5
afe1823e05f097f2de48997c00262110

SHA1
b759a78794c5f0ea0a1445db47c1105b5d737baa

SHA256
1e9642bc99576df5e460aef250f7ca94c10f23b9ee88815d42fedebad70b3b7c

SHA512
ae31fb8856df6ad300282e15bd848df0f56db307ccabbeacd5f7e4658d8efeb528a714a62fef377d55de09cab9592022b6f65634595ffb2bf2bc98d7331806ab

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\MFFoundation.dll

Filesize
2.1MB

MD5
529e3d15c8a40952ba4ab712e535b764

SHA1
a879607d4ce4e5c6a7181216d6b8a7a85fb8cc64

SHA256
e09b54412d6642e74a7a0c0bae6cfd71342fbecf54e79e53e7986c6e25e451c5

SHA512
322148d61c7e3a2de4a6bae815239b6d8ddfed3eea8abd324f802cd94aca84a6cc4e55ce13c40a4c6fa7b39a7d1ef1b20e6f3ad0b3104fc86a98928d422582f5

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\MFMember.dll

Filesize
2.0MB

MD5
9188d022eb959c218517d828f53204ea

SHA1
874db1dd917897a55e38f37a7d85b8cffcc048a0

SHA256
fcc3d88227d431a657e8073d0295b63d680dfa71d6c392f9e5faa1e71400d2e2

SHA512
7cf26e1ce1d3f9c0a51f20db42dfc3a14082107dfa92ae305b95357b5271ddc365207c1b663d6fc5eaabddbbe194a8483bff963d7b003e1ab19c7a8b62b5cbbe

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\MFReview.dll

Filesize
538KB

MD5
c3995026e8bd40f084c983d9feb05634

SHA1
d5a4b637ff6a381fb48cae0b3852a575b14b90ed

SHA256
1c9efbecfd748db9f2444af40fe384b1c389ec5f3734faf3c40090458ff3df5f

SHA512
65be8db0a258ad67739d32832e6a194f4ec2af66201f622dddbb81df5197dedc39c086920dade2de88721d22dac56940262376ba94462540041eb2308478b9ff

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Qt5Core.dll

Filesize
5.3MB

MD5
378084932e3dc137c4623ce3d0537e62

SHA1
a6a284b32e452f4c1d3ae72488845a89ad66664f

SHA256
52802d514746907474c67139e54939ff0c4866085523cca3c9bc896e677fed7a

SHA512
e4f7e99d48cd55d025aaaa2465e7fa0e6d18dfafb4947bff2acf3a581da883ed22167aa70f0d5abe4319376384f8a0c28a662155db9d3f5e2f385a9a599905a0

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Qt5Gui.dll

Filesize
5.7MB

MD5
02021252028e70098b27a4853c28466a

SHA1
a07554baa14e00e6fecec2b1dbb4cbeed4ed51bb

SHA256
7b91c826c001e9969100c5cdcf9292c2d71b774d11e5e951c896361d4f759f8a

SHA512
ea581735b7cb76cfca164c6be2927b82d003a2cac4779c195440d7bd1199f64fc624c29d261198c7abe9e9028e0277cf0f2ae1bac999600c1bd11a96ded722a3

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Qt5Network.dll

Filesize
1.0MB

MD5
b0dc47b696a53b96961bd19fcb021c81

SHA1
5fe224b073dd47429a6eb20c74db478184e6c84c

SHA256
62b013d7c59fbc29032f14d7376b0458e85b48fd5e0ea0b9c94b2360d8ff911f

SHA512
aacc418f8ffdc095bde8cde5fa19817fb366d1971c24f42554dd4da3341edd08fb354eea12ebac64da4a28257a923c8737d4520f8e3f0b23339ee49bf16887ea

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Qt5Widgets.dll

Filesize
5.3MB

MD5
bfc1a3e3c77ec5f83af110aab34ff49f

SHA1
6b84a0f2707a4dcb9d4fd9d3480eba214f6d8feb

SHA256
764901ce8027ad647b25a8b34d1aa4475ca4dac7911e294c3be7d0ba598f38b1

SHA512
36f2959ec968047eb7488e42dbb0207411239ece6a8cf93036dfdb64a360c3714a53fdb968187f8993d3c1532c2a74b996dd46a3c6c4a5e05edfaf2cc0a28143

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Qt5Xml.dll

Filesize
191KB

MD5
b3fadd1fc2d4fe740d173d5dd4f49fa1

SHA1
cabff090bf5022da0f421122184c77d949e427ac

SHA256
d396e939ec0f7714cb353833bea70493f418c80c1a8bf9e0d9768ef1abb54399

SHA512
7883384f3494d9dc9b88b0b80a8887b4774f4f60a9b26235f4baa3f002515919af4636b6464d06d2b38fd63a3da501997ed7b55d9143bde8f5ba5db8c532870f

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\RegisterRes\skin\Application\is-E0GKC.tmp

Filesize
1KB

MD5
23290fcdf5a282379e144811a57061c4

SHA1
8c0398c66770a554867d1084f1db15fee9909423

SHA256
161ec8d08165819fcef909588c0a46d1458d9e74a03bd43b588d711fab4ff210

SHA512
8ab21e2e8ef68d2e9c864adb820bb0e4f7892e2f963cb800ef3aacd26a40f2f597a589c35f78850b993ab42af8b2ae1dcbc6abb5ecf2b6695e71ec83a7a99147

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\RegisterRes\skin\Application\is-J37S7.tmp

Filesize
1KB

MD5
13e32ba5a597fe34bf1b9b6ffd1a1721

SHA1
510545840e5d5ab769de857c8545c50a29b9dcee

SHA256
101ec8141fbaad7ea1fb83fdf3763d4ca864d728c9d3e6e041457dee70f5c371

SHA512
c1f926db7461b473b33a2f60f0f56e1d3a38f97c4e1861c9d6da6df6e0aff354b7dcf1feb786e5ca29ab43b257677c2597c2b208721efc20adada733a5b480a7

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\RepairEnv.dll

Filesize
208KB

MD5
30f472087df0f2f749ee83bb9a329585

SHA1
902a9d4125f48e39c1af8d10a47547593c14b3d5

SHA256
1d9f4a3a599d6636aaa9afe4a12a9e0f961cb4d0b82fbea4e4e04d8bd84269ce

SHA512
4a3eb221beb3b635c3bb88252292fae8162ac616f23cfa05f86ec88604b0d8c912e771875d925e68f75cd51893f1a9ca679a7988656c5c4dc766868b498f01bc

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\Setup.ico

Filesize
9KB

MD5
00d39d6f4e6625ebf207eb1019c0c2b8

SHA1
580a396b5e07c436e80c3e15ca27eb7ff0bb1189

SHA256
5c6c587a8c75c152e7581cf85d4f8c2c95c0bdf28b1069e7837484c77a436ff1

SHA512
407339f636554ae7466908211ae91e4d570be1c4f872c9017adb53301a4959a3b1bf4e5bfb5c5e6b1878f567e5751d95d3954d23d49847aaa5e1656902a79dce

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\code.txt

Filesize
17KB

MD5
f577bcce5d69c35a92b9d4c69e9e90a7

SHA1
55724dede9e79195bcb22fb9bf2b526b6d2da8d6

SHA256
878b1a03e9818261f8309f62c6a2484e1b3900eb7a1e959fb9f51d6f496a4fec

SHA512
f19a067901d6aff309568ffbf6ba6b4a6e212b7aa8b16b75176ee1be1536b703d6424106625fb9d957b62d44071b5b846d303e4f08c12e761382c2b5d9b338df

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\1\514cdb66751229d146596937bbe4ecbbad90c028\550a09c4f8c4d89df203ab615ffc979d3c56f613

Filesize
181B

MD5
2de6a04cdba79ed13580c47dfd70cc5f

SHA1
bcefe0558555914d731c16b1778c49e77fe06b99

SHA256
97704a8960b4facceef54397a08fb5d0a456247c3627359215aa2a27df22656c

SHA512
605dc81b28c530fc8ebcf3c5a28486af8bbd3303ee5df53b5424e492e5dbe01baa0468fa4da1398451a62dff4d45067a2bf765f7def9ca0890883484de38a13b

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\1\514cdb66751229d146596937bbe4ecbbad90c028\5c00d54c39e7cdfe6419d9583dd973a9223f545a

Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\1\514cdb66751229d146596937bbe4ecbbad90c028\c857040ce4ce8654af495a2f04da92a0a5111fac

Filesize
12KB

MD5
5b57d8e657ab7bf235384444df0823dc

SHA1
abfe83404433c545b8024b6a783d10154dcdee58

SHA256
71188953f865f356b6ba07566e7b705dd2f020bf70745d556de9f2dfd35f167c

SHA512
d4d8ca27d7666f0b09457949bf10e5707dca0faf84fe557492277f05103ddf7d9dadfc4e48b588b74421952216fba6d11a919a4f36ebdb8c41124df4cc627dec

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\data\backup\2\b46ae678226f77a94fc94328f18e3872bdd6cf88\45b1a377feee16fa8e2fbf128469e2b9e5403e6f

Filesize
263B

MD5
bf84313b2c72824e6b6bfc387b6cfe53

SHA1
1740a29efab5a611a554b7b7464ac7466e7fa61d

SHA256
7728c4a1ade18218c4301c1fe971f2df8deded0fcd045ce7525116e2908c6350

SHA512
597aff1bc81320466fee66655d03e0342e73d77970cce8322baacc6ac8c364eb6080c320684f4f05f36384eb3956e0c718988ee28a97bc4ba258ea1e161ade2b

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\domain

Filesize
11B

MD5
0e9e580a0aa5a5fc04882e8b0c3fef24

SHA1
3f19352b024e5df2150f598482d353fb992dd4fa

SHA256
f0d88e619b6744ac84c01f83317d6ceacc0ab8c3cbbfa9f7d62a8624a5b96660

SHA512
52a7ead39773bae4d0c57f2d3243b1c3f83d2e5404a855aae437d3dbd447d54f0de27915d42092d0bf9c4453ec06389394626920690f5379bfcaac36293f0cda

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\libMFCore.dll

Filesize
460KB

MD5
022dd90d4842e7e187dc8f701c79985b

SHA1
8f02b28a939ff86a63d99246407b7c1356a3b85c

SHA256
3dc99e34e34aa356aa947eea057e143b696ff3f42cf22f4bcbe75203e3269fa8

SHA512
75794b46f3f94c9782d355e5828ef00337d832e685705b83dd56e5fbe80b4d13ae20bc9cd4fabe4b9c016bc66ea42be14f81206331939086c3744fdf8bb0919a

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\libcurl.dll

Filesize
480KB

MD5
67fb73bfbb16fcac342b778b8fd65312

SHA1
069994e0b0f7b31a72c9ece90c3bb4413a19ec62

SHA256
e8e085b5db9aebaaa77e9b8c152de53967ebab4956dc5bf6af1e4b3fc54b5612

SHA512
a8cb44f43fe6d4c871a533a56f1cd70f4c5bb18d9f022f183c769b3463503f80aff8768af7e1bdc2ec0a3bb6b10701c9873d7cff8d3400f74733f70ccd8be7aa

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\msvcp100.dll

Filesize
593KB

MD5
caed4a65caf1ef80aa81e9b135326658

SHA1
a3daf85194d0b149a91e13ba83a5e4a8968427ac

SHA256
a55f33a3a03273a8ba957506946a6b7e51576eb76e588e8de8c14fa46a886860

SHA512
2ce82b3df6c29d84fb9b12c92aa8dafdeab36d21a9d3c4acaf87b70b8acc53cc81537ef39b75ee674ee44b00a2853d7434216fa55bdd7ba17a6d8fbc76d4a8a3

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\msvcp120.dll

Filesize
644KB

MD5
46060c35f697281bc5e7337aee3722b1

SHA1
d0164c041707f297a73abb9ea854111953e99cf1

SHA256
2abf0aab5a3c5ae9424b64e9d19d9d6d4aebc67814d7e92e4927b9798fef2848

SHA512
2cf2ed4d45c79a6e6cebfa3d332710a97f5cf0251dc194eec8c54ea0cb85762fd19822610021ccd6a6904e80afae1590a83af1fa45152f28ca56d862a3473f0a

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\msvcr100.dll

Filesize
808KB

MD5
aed6d63cfa5a3ef7021af9c457fee994

SHA1
f6ad746ef520b03df6cf0f5a2512d0df964c4688

SHA256
b4bfa27f677295b00a1df9a7e14db4b75cac2dd41b898d4e9a378eccce3699f0

SHA512
5573b17eb19d13cc96df5d66ef60cc8ff98e1ac9d8582a870ed2befa28ee271fb41741a92aa703234150fceadf4a436d10b8a6518c1816d0c804eb1261650d2d

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\msvcr120.dll

Filesize
940KB

MD5
9c861c079dd81762b6c54e37597b7712

SHA1
62cb65a1d79e2c5ada0c7bfc04c18693567c90d0

SHA256
ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c

SHA512
3aa770d6fba8590fdcf5d263cb2b3d2fae859e29d31ad482fbfbd700bcd602a013ac2568475999ef9fb06ae666d203d97f42181ec7344cba023a8534fb13acb7

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\EquityShowView\button\is-L0BEV.tmp

Filesize
18KB

MD5
e2bcb6c8b94370b03fd92eab1c7423ca

SHA1
224aedffed6d36e902d7db3a8cfc85b6e512de6a

SHA256
eb64e1ec1fc8d8aec9a892bdb93b6522c9f3ce10bd8c2045282256f083983e79

SHA512
a88772c9800fbd408ad45849feb0cb94ac528f58af47ffe70a06042be3dac7a8d1890d0f005f40cee2b4e3da144f5269a943ddfd82d24bece7d5360c813e24d2

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\MFCore\is-1JM1V.tmp

Filesize
939B

MD5
19b7d9b8add3aeb363e8f791c9f579ad

SHA1
44ef61c5be7b2a7d1f55ae9ff16ccf587732a4a9

SHA256
893929d0ed5a21b030e17a9480dc0284fb855af6349ab7d9a59e44e2db992a06

SHA512
03a03d64096c8b43d50b1c8ceb43980679442f4c5ba2a0e4ae02887026f6f25ec02acb18f8c811645dfa19178352f4dc05053cca1a65e60b473cd2ac1c78f545

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\MFCore\is-6Q2TP.tmp

Filesize
2KB

MD5
1cf76fb23ab1348760a1beed374b38af

SHA1
505cf19886426dbef4cc13d8ef68fccf319db162

SHA256
bec67f6eb864c8a1430be3a470969924b07aeea7d4b75677aa98157be1b10209

SHA512
e6cb12d623ff7926872530ceecbc83cdf19492fdf0cdd5f4d7f56e03a4bb7a42f57b5230ebf0b21c442c183daeec0e0202bb4cab731f57f394a8f1c24186c491

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\MFCore\is-7QJLN.tmp

Filesize
1KB

MD5
9e3afcdf352206204c79398e00e326cc

SHA1
a7d0a821cc85d9df470e9ff42b3f24052d105a5a

SHA256
3365aaf1ed950a3965da198bf400fbaeabf6d3655e994000225896a9eb827d93

SHA512
f16e8cd05cff7e99dcf2e66e55674108cb1a95dd721290e1b318357201dbb87ea7cf6f3f8c8338edf335413c715ff7ae8434e698f8af5e4de5b9edcc8789a84e

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\MFCore\is-ACO7U.tmp

Filesize
933B

MD5
1cdf2a0526603369869410fe69bf452b

SHA1
4b01d0d66f2eb5a7daf1ce0813994278a25d8d8b

SHA256
1df070f2ac1770cbdbaee4a866740594361710eb49cb78f1cf28ac6b35b8b064

SHA512
0a3080892b1e01fee07633f28ff2f82d488e0a00cfac042f7d43d5ccfbba8a11886cca518c656c8eac2c6b1deb2ce08e448ea691d3e285aa65ebaa46aaf5b889

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\MFCore\is-GPTB7.tmp

Filesize
1KB

MD5
162d03f8fff87d0eb73d31d847f3a7b7

SHA1
0db62329c8b0b24481f6f61fca9b39fb76918d6a

SHA256
689ce8fe8cc4bf50cca62081c9687e273f19314a2641f77d4daa89198e1a9019

SHA512
ed656dc7f2bf2fd003fc3d2c21c4a684f83808a4763e75780f9bafcdebe6f767b94d6a44d34cd7393f984bf80435087747e90672ae0654e1d9d1695610583359

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\MFCore\is-POR17.tmp

Filesize
1KB

MD5
605bc66bf18e0d8b50a15a18a3bf5f75

SHA1
3a38c50d189e29cfc761842c33245372a20c9e44

SHA256
4eb9afe3a1681ce344a83f61c3868a1e79b9d1a40f6cbbaa143de03119ee6666

SHA512
bd6373532c7b6d3920fb0107db6edfb6b99d0019392bace717def43c74461c06a5581c2284eb1878173156f40e46086845bf90d19d08e0f4f7850877ca024426

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\MFCore\is-QUANV.tmp

Filesize
860B

MD5
cf4b45edb7a2c6ef974354716d3ea7e9

SHA1
b547d8540535a5121636730c8d231e0b9a05be9f

SHA256
1b376ebed437d40150a7bf4a2913a050e09f9a5e576ab019f2df46b078c5f65e

SHA512
4c13d83f06efd292e4fc73de1b7bc0fd0138212c1c490886c570331a8ffe78d06eef12033da5a3596d018b910e612a6a0a58b112ef1c94459204cadec0388afd

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\skin\PictureNormal\MFCore\is-T12BG.tmp

Filesize
1KB

MD5
b0fa5e062b6987d675fb81c51c9d3e5e

SHA1
8d0ff4b9d729bb3f659329355df1df9111282fc4

SHA256
9e82b7d987b636edc1681481e79cd557e3f5451433bcfd81b409b1d53b233a01

SHA512
10469624fcce0d11db084c546699eef1727ad953dbc7a87faf402ea2567f7d7ecfc99051b99379960d93e1582cc12d9bf2032b20b71f82648e181478941ecc35

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\ssleay32.dll

Filesize
345KB

MD5
bd44bb3b8876f21a0e57c567f00bfd33

SHA1
869fc50d0b3932e4e52b194e7efbcdaac13711b6

SHA256
79cd08a196cad489209327566abe7e34931b91c42fef4581cac0c5c201f58e1f

SHA512
f7d8489e94acd079efa0c6303930d7b9c3a8a7237974afbb0663f4aa8901303f863600caa602128e08267b3f7426e53f5a69a2add8cb445c51214d43d8857fb1

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\vcruntime140.dll

Filesize
106KB

MD5
49c96cecda5c6c660a107d378fdfc3d4

SHA1
00149b7a66723e3f0310f139489fe172f818ca8e

SHA256
69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

SHA512
e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\zlib1.dll

Filesize
100KB

MD5
bc81a91937c1abff5fe63112dbce9b44

SHA1
4dedcbf051de60e4bcb32d49775f67f00f457703

SHA256
768f2f27015e7244a20952fa423b7aa1adc32ca3e04167886bd1cb5ed9a7b3f8

SHA512
507726627de8c40915a3daaee33d0af9595f28458e71a8bb64bc23f7faccbe717dedcf613d60eeb6e20a2947fd410c6e179cdc90f4779a1e9254bcd66e66b53b

Download Submit
C:\Program Files (x86)\iMyFone\iMyFone LockWiper\zlibwapi.dll

Filesize
98KB

MD5
d44116ad2e1f686d52c0e8c81097a313

SHA1
d42ff73e66641c210a6a4d24c39c5aeded081891

SHA256
c42a62610fe52dfca5742ce3f55535267e37eb9533ce7c9e930cd5c4f537cd06

SHA512
c14c2c2bdf76d62f92d94712fbecbc662a0f1f97201abd0edc66cc82579497a45f08d472a81c09835618b2ed6d4d8410ee3057a6ce785816a9a505b18d2686c2

Download Submit
C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\language\English\pr_1.png

Filesize
41KB

MD5
f7cfbbcbe185ef17d4268b37b0b3d9d3

SHA1
fcf776ee58487d8a63d239313064a7aa8c343d36

SHA256
7d4a696750ec3de141bd5c2afa1986cdf5f2323114ac22b79be23f8e58a42c88

SHA512
0b44da8cd8481022e5349fc1f1797ef2092d29ce9a0f73f0f84b519758fc2512c75a166cb5d9436507271a1479ca6a0580a09c0bfeefeb99521b8d7b99e31ee4

Download Submit
C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\language\English\pr_2.png

Filesize
42KB

MD5
b9cc25aadb9a2c6ca64464a18ca5aeb1

SHA1
a7f05cea21219b5a365f2a842b34910082d0b919

SHA256
9e68e6576f8baf1fc8c7d8b84198d652e8327ee07ad2b2bbb09703d12ba9d04a

SHA512
914a6564e827eb9f76aee3eba56dac19b9ac29addf4ace708c8d830f481d08469db3fa795e40828e4053319e086b4904174db1fe114aff78f45fdd047901d6ec

Download Submit
C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\language\English\pr_3.png

Filesize
40KB

MD5
5b31079e5eb5a1d0b9a405d3e447b3e0

SHA1
ebb567d11de87baba4c582615eaad9f89045eee2

SHA256
775209b895933670c3f2b8f5d96ae1765478db159d8617a26fe145778a7f6837

SHA512
39f7e1ebd49c485a5c5e856d70024206e26c4e52cf93f45efba4a4ce2c98cf09b3db1fffe90894d17a1fa9aa01b7670715bb363645abb2356da9b7f565208a5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
cc3b13f7222efa09e5856bf5c3c80564

SHA1
779050e3fe92cee47a747fb18dfefe3769c02a90

SHA256
c00fd2b060524da3688afe260855b8facb2bc7a4126b433de4c9a8b26abcc625

SHA512
d655c5f2077db95757dca80992e94881e03981c106fc0b3cf00cfc3c2fb9f802be101ac2cebf22ec8baeb7d5044504b5f817651259ac03ca7bbbe8903f5c4dc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
7db730798c5bb44d639b756283f38ac0

SHA1
408dd84fa1cdeba30bdac9df9293e8eb6b98d829

SHA256
f728d807106fac4fa86d6dd91f7153c46b83841fdc3d818220251902495cefc2

SHA512
05646bd123ad42e8271bb2734f7a75f31794865dfea085f3895fd15f63c881a1435e1e7609e52a22d8cbd06f8c44ce3d1aeac459a887e856035fc0e5737dc46f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
ac2c5e4a51e54ceb0d8a2b2cb4bd9f55

SHA1
ab4531042e52807555de8c9eb25866cb6849484d

SHA256
411e91e429cf9ea09afdc5eaa7d920ebc4c94ea737970beaccff05ab26986701

SHA512
4002c8901079917dcbb119b2af930da5cf0a8748535c4d273361d79e971da3f2e2dea0b5935c731b5e56c7cb3536a2efae38aac0a45b166ef7080d1ade207b12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
7f4ba4e4d254d98a45b95666978df7b9

SHA1
f92c6c71a366c8d045e4fbf8b0e6fbd0b5d04590

SHA256
aa6d800c96a02fc5be92bfc8853042e704a3a78bdab41b6a84071dcb63df6288

SHA512
846c0ca3e050cd5a7ffd7e2ad122373f0311ffb2d9446e0c120bdfc67260cceeb60218ef077d23f61f9530557f1eb08a3ae6fc4da77a40a53ee31f69adaae7d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f66aea20fd9a826c21df7f1f9405353e

SHA1
8bb129ba44027819320ef29a0a4c438e815287ef

SHA256
103a33f79183747d5417ca1d33a917931e56a89deedb365f3f0ab1e0976d0e67

SHA512
837ad75e5a98942ddd875151c981e31fff707948b478ad9f1531895f93addadabee10b0c688e7dd374f446eb1222819457a4ca005d538cb3d9b4eaba2e5a7997

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a38ec359c31cc15c5a94903fd9c5e877

SHA1
eccbe05f40df564a8dc7fd9778d0c52ac0516567

SHA256
52c6e0e59f13cf1180ca9cafeed64a15f5c30a8b9f2962a3662c18a45206a1ab

SHA512
adf60e95cf868e924d2336a57c0593103d7445ed0eff8634617181ade1fbc02264a41884ee8900c4df7aa03c1950d12b46e40335b5478803b6bafe50610ca039

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
3b477420ec34096e00f0ee527054539b

SHA1
03101493c38457e7282bf6d3c6c0577e647eb272

SHA256
ae018992f265b4333f517d3d48043e323588e8bde3b1ec83f83a7ea9ef2b2210

SHA512
23e06209364f29d4f82336e0c1e3cb28d7daed3422a0713c49f95092a40301caa641bc432ae71e708dfedc6c94cb5408197ef7935511fee6a86391510822018a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
211KB

MD5
1bab142eb805b4e6f0eb9e82b3e7a836

SHA1
5e3de5df1fc814978480d411d8c696467450da57

SHA256
88d26d2c187f61465dcaee53aac88d4ba755b7ea5a18e52e3a902118db8c9533

SHA512
6e4dbc287e5ff2bbd64f26dbbe6a0245ec5cc4d1e094721ec9091d78758638044fe50cb0791678feeb7a9b8f210bed6af68c52fc09e90cead2e0d3b7b75f7053

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
211KB

MD5
57e3ba92011501c6589d8f020921276f

SHA1
e2ea7da0ae33dbd341dfa4f92a2bde06fadceef8

SHA256
808c3621a5b047aae4bb703c2db21c9c331e93a4e98aefbc171340305a2d207c

SHA512
853e572fd5d5a9d6972181a1505dc41fd12324499bafc844d88fe96c2585ab204c2e286d2abe01563b03910682829a81ec482e40f3971150b6fea98752a8697e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\LockWiper\MessageCenter\data\version.ini.lock

Filesize
24B

MD5
f9784d9659e71effee427ca6692e37c9

SHA1
8573c5dbeb4a7ad9e1fe0373ed4085d303d28969

SHA256
7f7ee8c9b62a20a4414ddb9da8a0b723076cb6123ce9150ce730adf589ad4995

SHA512
9d6b5112edad0a965b8b72ad14fa34cfcd7bfe62ac5e0500f87e56e3de41655cce9d4bc39f4679bd8175a52304f38d953f107a366c8dc1a04dbc8c5220ef7fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d2ff1b3-f5ec-43f0-9444-66efc225428a.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
8cb2911ebac64826ad9789cea1c899cb

SHA1
248e2b4a3e0dd4c1d7dbc3a6c562cba69ddda192

SHA256
493ebaf412e208a2b432d34d8599287d67fec1645ea8c6a2a7ad7f69a8e24ac2

SHA512
06c90328706c59acc08b52bca71d9b869b51883a20727ff48223aee029126d0ad29c0554480d468f21eb8c909b0bd3dabfe78a8f67df62c26f463651e7af8651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
84fc95de544e7083015d08337de9c336

SHA1
2ec6114351f8c1c7aa251b1663af342efff6bf18

SHA256
76a6290c4953d585632fe3e7fa9d2e6697bcfac30a6294b01b8816c7f46742f4

SHA512
ccc405101769dac00331bf7e594afb32568a2c377f1913b9f3670ed829a6a3997b22fa2beaec2c7aa533a3954833a9652bd5f7931d68d54659a9ea9f9f4d00c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
52KB

MD5
447b5659b972691efdb36d51c4bee03c

SHA1
f47fb73912f69e520555898f6f110f834fcb84d8

SHA256
5319c82b18538407aed5ea07312aa57f52b36449235a28cabc948027eae48fe0

SHA512
4f726ebb21beb825e483a55dea796ff9823246b286f404962b579e64ad85e518ff21e1bd927e2a56616a4bcdbd4a8b4f1d71ddb3c8964215f17b25e5d6c70367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
586234b78110b9a155902ebe02f44628

SHA1
1658f8102d4414c09100de5508399e596c4e15c3

SHA256
104b5859877b585182ac8fbedb5c989723e21b8de6bc8b642c60c4ff783aee9d

SHA512
f70de32be20d1d75dcef0be29b99dabbeb99579ea818108de1898218ac42469f5e0aea91b88b0c16093e6fdf142c54bb9a29f839a5c60a92ff520f430d91c124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f86bda75-6922-45d2-a47a-c20666cf1346.tmp

Filesize
48KB

MD5
e412130061ac693df80abc7970c6663d

SHA1
8bc2921dd6f59a23743139d91214f98bcab0a223

SHA256
0ca764b73f391c0838150ffdda8c88dc6cb90aa605b08be10bf07aa9446e21c6

SHA512
7afcef74e114aa590a714d1dc538fada55d749f1dd8e3680a2f910ffbe2639c11cc804c71e33341f2048bc019beab253d038f76bb46c358c7a0b431684524cfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-03L0U.tmp\imyfone-download.tmp

Filesize
1.1MB

MD5
0460aadb668dcb54030ffb169fcbc70c

SHA1
4d79d9314e0b67530ef19673b94405db8dc6222d

SHA256
b07b332988ca80a3541f4f13144d6d9428839e8c48910cc730a5011925eef4b9

SHA512
6c16b1c68b9442c8fbec4fbb32c8a706a4be93a6f930c863c8e97de6eb85acda79fdf97c99788fa537cd38aea32ba8b4abc95dea96583661c125740e173b204a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SE8KJ.tmp\ServiceManagerDll.dll

Filesize
121KB

MD5
0d8ec485457b16bc42c8eb8de412ffd4

SHA1
903988dfe2ec27a8960d7e98eacb46ec9a9dcb44

SHA256
b66817826406bddb339b4acb377c6dd2a4a524158995383b1e285570e2ff2e12

SHA512
c784b04b60469cea3aedaff88c4a5c1a338fb53682c4fd9f46e2fa6a6c3a0df3e4b22cf7814e2d95a982adc57ecfdbe684b4173c4720f055fddc1d977fc89e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\{382d3f07-cbd5-7f44-8ff0-8a5d32b853ff}\USBAAPL.CAT

Filesize
14KB

MD5
97f4158a43852869de6ba9f1c754bbc8

SHA1
0565f0874d623268529b86967b93a7ae8d57dab5

SHA256
1daa9a80eaf692e1c1490afafcc435e37cafa94e9a9dfe453a82b1b472f3b1ba

SHA512
ba75a483ac75deab29c4174f1991dbcf4a76857dac23c99065e07585a5958e49f1ade0133fabdb3c8a28ba35e8df06fb529f81c756ae549b35543ad39817a44e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{382d3f07-cbd5-7f44-8ff0-8a5d32b853ff}\usbaapl.inf

Filesize
5KB

MD5
ca3a369e3993295e11d5fb6b7663f3b9

SHA1
7771a0176a543725d7bbf70a546c096a4ee2dd40

SHA256
4494c8af156d9dc7deea76491d73716e16b42e3e8b5b4555b0fd247b6cacab8b

SHA512
650b0f23b6470ad84a001821bd5ba6fc906db0e6fd616d734a87b9777ac1f5f6d6d0dc52f5aef223bf362109b77cd89c5b4e93562c1168fbd049756d714b64cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\{534c1290-0da7-e74a-9dd8-c34cb22ff8c9}\USBAAPL64.CAT

Filesize
14KB

MD5
26eee7af8aa1ef8c1bd7c9327c602844

SHA1
990a56215aac7000eac9371f489a0fc57d560078

SHA256
946b0a8150213d6a4dd3aef6248ebb923f8167c84c7ff1b10137e5030ec8bf30

SHA512
1cce53edb09f449720005ee9ca013fabb0be498991adf38ce738330a02b336790cb835e235e097c57a7cf983b4bf18664bc113b074cd94f9118901565d83e24d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{534c1290-0da7-e74a-9dd8-c34cb22ff8c9}\usbaapl64.inf

Filesize
5KB

MD5
2da3a91b71919d035d8fd17b6b90bbc2

SHA1
c2c6a29f3abc80fd992777a92df30699124d37c5

SHA256
edea577e694efceec5b26d745fff8125e9fc8a78cacd7365e77ef35031ebc49b

SHA512
71b98c884c338902110c83f6c858b906bd8d63e09e5f92d3e019f586d82961fdc71a459e6456a3e9a56b9b109838b4556aee91e0befb68c2ae505c93a41fe56b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{534c1290-0da7-e74a-9dd8-c34cb22ff8c9}\usbaapl64.sys

Filesize
53KB

MD5
f957092c63cd71d85903ca0d8370f473

SHA1
9d76d3df84ca8b3b384577cb87b7aba0ee33f08d

SHA256
4dec2fc20329f248135da24cb6694fd972dcce8b1bbea8d872fde41939e96aaf

SHA512
a43ca7f24281f67c63c54037fa9c02220cd0fa34a10b1658bae7e544236b939f26a1972513f392a5555dd97077bba91bbe920d41b19737f9960ef427599622bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\{534c1290-0da7-e74a-9dd8-c34cb22ff8c9}\usbaaplrc.dll

Filesize
5.8MB

MD5
1428a8b3dbf4f73b257c4a461df9b996

SHA1
0fe85ab508bd44dfb2fa9830f98de4714dfce4fa

SHA256
5ed0d8f2066dd19d5aec42c5498fdd1db9cefab4d024a1015c707dfd0cfd5b20

SHA512
916a61feb9a36872a7c1adece8933599e55b46f7d113966ec4ad2af0e2568f1a339629ec48eca10bd1e071c88171fe88292dab27ce509ceea42afbd049599cc7

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
74B

MD5
91af26171f9360e5cc12132038920326

SHA1
0ee117421808b89a2dde311eeb45268bf50c3500

SHA256
37165d24ecf153168e56780fe1780083aacdec5f8f35628a494bfcc55f35eed9

SHA512
6ff6e117083ec1396f1acb3d207f149f8d961e714627fe8b2b7254070d4eebbed09942bca3fedb2621a61d2b6de6d080bf9b0d8f0f74aedb2e21701d2ee797e2

Download Submit
memory/1920-815-0x00007FF656520000-0x00007FF656618000-memory.dmp

Filesize
992KB

Download
memory/1920-817-0x00007FF966DE0000-0x00007FF967096000-memory.dmp

Filesize
2.7MB

Download
memory/1920-816-0x00007FF9688A0000-0x00007FF9688D4000-memory.dmp

Filesize
208KB

Download
memory/1920-818-0x00007FF9653C0000-0x00007FF966470000-memory.dmp

Filesize
16.7MB

Download
memory/2220-763-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2220-3999-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2220-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2220-59-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2408-1663-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2408-765-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2408-820-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2408-3998-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2408-3988-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2408-63-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/5476-4050-0x00000000698F0000-0x0000000069E3A000-memory.dmp

Filesize
5.3MB

Download
memory/5476-4049-0x00000000698F0000-0x0000000069E3A000-memory.dmp

Filesize
5.3MB

Download
memory/5932-4424-0x00000000698F0000-0x0000000069E3A000-memory.dmp

Filesize
5.3MB

Download
memory/5932-4425-0x00000000698F0000-0x0000000069E3A000-memory.dmp

Filesize
5.3MB

Download