modiloader | 95d7eae73cb003e6ce7187fb688959d9c060edf0d60f3e59a710dfd4c899d97e

Analysis

max time kernel
186s
max time network
187s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
18-12-2024 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hid.bat
Size

40B
MD5

6a94c7d5bb1ec5f3587299358ab73826
SHA1

86de690ed264cac2ac9e3bea74ef4b12d071d01b
SHA256

90852e8db4b9a3a0a01bcf23589c1cf2f6b904387065a0382bcf441eadcd0600
SHA512

1d0ca8c4feadb7ee5b117c140b7c118ed3531a3c6ef044d5ac142c103adedd3a8ec3e6f4d83afde41f734c6b1249236820e598a5b035a3151a8efd4c3c62e813

Score

10^/10

modiloader aspackv2 defense_evasion discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 7 IoCs

resource	yara_rule
behavioral1/memory/4396-1212-0x0000000000400000-0x0000000000545000-memory.dmp	modiloader_stage2
behavioral1/files/0x00290000000463dd-1224.dat	modiloader_stage2
behavioral1/files/0x000a0000000453f6-1228.dat	modiloader_stage2
behavioral1/memory/4396-1237-0x0000000000400000-0x0000000000545000-memory.dmp	modiloader_stage2
behavioral1/memory/4396-1239-0x0000000000400000-0x0000000000545000-memory.dmp	modiloader_stage2
behavioral1/memory/1400-1242-0x0000000000400000-0x0000000000466000-memory.dmp	modiloader_stage2
behavioral1/memory/1400-1243-0x0000000000400000-0x0000000000466000-memory.dmp	modiloader_stage2

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00280000000463d4-1200.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
4396	WinLocker Builder v1.4.exe
1400	23213.exe

Impair Defenses: Safe Mode Boot 1 TTPs 7 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	23213.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	23213.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	23213.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	23213.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	23213.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	23213.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend	23213.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\23213.exe = "C:\\Users\\Admin\\Desktop\\23213.exe"	23213.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker Builder v1.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23213.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 50 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 7c00310000000000f1505b71100057494e4c4f437e310000640009000400efbe92593d9992593d992e000000d063040000002b00000000000000000000000000000080969800570069006e004c006f0063006b00650072002d004200750069006c006400650072002d002d006d0061007300740065007200000018000000	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000090000000	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "4"	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	WinLocker Builder v1.4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	WinLocker Builder v1.4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	WinLocker Builder v1.4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	WinLocker Builder v1.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	WinLocker Builder v1.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "5"	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy	WinLocker Builder v1.4.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	WinLocker Builder v1.4.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\WinLocker-Builder--master.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
3416	msedge.exe
3416	msedge.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe
1400	23213.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3548	7zFM.exe
4396	WinLocker Builder v1.4.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	firefox.exe
Token: SeDebugPrivilege	4508	firefox.exe
Token: SeDebugPrivilege	4508	firefox.exe
Token: SeRestorePrivilege	3548	7zFM.exe
Token: 35	3548	7zFM.exe
Token: SeSecurityPrivilege	3548	7zFM.exe
Token: SeDebugPrivilege	4508	firefox.exe
Token: SeDebugPrivilege	4508	firefox.exe
Token: SeDebugPrivilege	4508	firefox.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
3548	7zFM.exe
3548	7zFM.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4508	firefox.exe
4396	WinLocker Builder v1.4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 3416	2320	cmd.exe	82
PID 2320 wrote to memory of 3416	2320	cmd.exe	82
PID 3416 wrote to memory of 2988	3416	msedge.exe	84
PID 3416 wrote to memory of 2988	3416	msedge.exe	84
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 1352	3416	msedge.exe	86
PID 3416 wrote to memory of 464	3416	msedge.exe	87
PID 3416 wrote to memory of 464	3416	msedge.exe	87
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88
PID 3416 wrote to memory of 3184	3416	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Hid.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://oxy.st/d/Vroh
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7fffc4a246f8,0x7fffc4a24708,0x7fffc4a24718
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12424646126056583806,1150108598943036744,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12424646126056583806,1150108598943036744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12424646126056583806,1150108598943036744,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12424646126056583806,1150108598943036744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12424646126056583806,1150108598943036744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12424646126056583806,1150108598943036744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12424646126056583806,1150108598943036744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12424646126056583806,1150108598943036744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:4664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4228
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6028385b-6c02-4f07-bdcc-8c276f75ff0c} 4508 "\\.\pipe\gecko-crash-server-pipe.4508" gpu
    3⤵
    PID:2116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d55bc94-59b5-43aa-8ffe-f24f237b67fc} 4508 "\\.\pipe\gecko-crash-server-pipe.4508" socket
    3⤵
    PID:4448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2972 -childID 1 -isForBrowser -prefsHandle 2880 -prefMapHandle 2900 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08d42f21-e5a7-48c4-a6f8-3eafe7ce7a4f} 4508 "\\.\pipe\gecko-crash-server-pipe.4508" tab
    3⤵
    PID:748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3408 -childID 2 -isForBrowser -prefsHandle 3420 -prefMapHandle 3416 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e840a688-db5d-4800-9b93-0f00f2c5b6ed} 4508 "\\.\pipe\gecko-crash-server-pipe.4508" tab
    3⤵
    PID:4388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4676 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4652 -prefMapHandle 4660 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81c1da13-85e0-49ae-9e79-5c92fdd79902} 4508 "\\.\pipe\gecko-crash-server-pipe.4508" utility
    3⤵
    - Checks processor information in registry
    PID:2100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5376 -childID 3 -isForBrowser -prefsHandle 5368 -prefMapHandle 5364 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5c6655d-0423-43be-888e-62cfb976a065} 4508 "\\.\pipe\gecko-crash-server-pipe.4508" tab
    3⤵
    PID:4680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5464 -childID 4 -isForBrowser -prefsHandle 5504 -prefMapHandle 5508 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ecbd5c2-ba90-4169-bbb2-ddeebc4c2154} 4508 "\\.\pipe\gecko-crash-server-pipe.4508" tab
    3⤵
    PID:772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5756 -childID 5 -isForBrowser -prefsHandle 5676 -prefMapHandle 5680 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a0e1f6a-12b7-4c4b-9fcc-4d77c585da2d} 4508 "\\.\pipe\gecko-crash-server-pipe.4508" tab
    3⤵
    PID:2124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4416 -childID 6 -isForBrowser -prefsHandle 3684 -prefMapHandle 6072 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d1ebec8-96b9-423b-8c21-4b56c773b80f} 4508 "\\.\pipe\gecko-crash-server-pipe.4508" tab
    3⤵
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5696 -childID 7 -isForBrowser -prefsHandle 5676 -prefMapHandle 6296 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65ab1cbb-5494-427b-b7e5-7f4007d067ef} 4508 "\\.\pipe\gecko-crash-server-pipe.4508" tab
    3⤵
    PID:4820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5616 -childID 8 -isForBrowser -prefsHandle 5628 -prefMapHandle 5644 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60185359-288f-45ce-9842-4a9eec566315} 4508 "\\.\pipe\gecko-crash-server-pipe.4508" tab
    3⤵
    PID:3052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2968

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\WinLocker-Builder--master.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3548

C:\Users\Admin\Desktop\WinLocker-Builder--master\WinLocker Builder v1.4.exe
"C:\Users\Admin\Desktop\WinLocker-Builder--master\WinLocker Builder v1.4.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4396

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:1544

C:\Users\Admin\Desktop\23213.exe
"C:\Users\Admin\Desktop\23213.exe"
1⤵
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1400

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b03d78ec6b6f6bfc8ce2f6e81cd88647

SHA1
014cb7dc4aa1bc5d2cb4ec25ec58470baf5b6741

SHA256
983928a84fcf0791614cc3d17d92d62ffbed0bf0f141d7544d0cc762977a3905

SHA512
4699916bdfa5776d72ad2643fad072a7a19783900608290bd1246a19624d61b58a1d80eceb74215b7198aaf04c526fa8703d38f3c5fdcc1add19b87508685ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
95ba0df0c4c417ae5a52c277e5f43b64

SHA1
7c3bf3447551678f742cc311cd4cf7b2a99ab3be

SHA256
fdaa82c65558793b81117a66acd5645d4072f6b71f164ed2717a17cab6e727ea

SHA512
fcb35a1949664f218ae40c25fd6eaefc4ba6417034a522f0800c50ee78e530c33080faa73ff9ea82f35749d404d6b9c94fc7e8e224689503e699a5ec2b0d5abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
f91eb92cd7497b377e9c024b0db95e6c

SHA1
e2bbb900f224df9deb56e00c2493715e8748933a

SHA256
0e2c4d80c0754dd585c21e84577abafd8a6401656d36f0644eaa172a057e1302

SHA512
a8237e021d87e3b316243e35a8f9db0cfea37f4b379dd4fad6d62cebf9bf5ffdc69de4c4f0501670b6d1b34777ec94f098a8d5b70b0dee7a1136dd730e2bf94a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
fb57f9a9312bc913cb61a034ad587f19

SHA1
ffcd833d9b56af7c27626ceb2b3a6f82c19a437b

SHA256
1784d38d588e65c8f47360de6f6bac352be14e4bcc63dd2a14a4b67ceb300a2c

SHA512
ee64488b371343180cfa5b51e78cc31cdc2ba7d307bbaaa871a2dd248a8625e982a5e282fdc0ab031c5e2bd885d8ced5aefa11e90f386d3705693f108e2fe388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3ddc09f04896c5029ee4a03d99b685b0

SHA1
519fc955f1db846cde0e803668f446b310d66c77

SHA256
7cd128e47f4693d38b3cc4921bc2aa149d53c99d8fff91d8f3d39bf8d83822dc

SHA512
63c637a2abbede5184d2880867671c40942fbc2d9b025429734bc610c1bf98df4b722098a3b2e4dd10734516087bd0893bf48504590da37f9bc22b1f7fcfd652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
14d250a36ab04ea85d14ce10e9469340

SHA1
32802db36e8181bc921bdc1cf397975150aaa073

SHA256
85bf1faf44b445f1d690af5cd7b96343a2ab23eb6809df3ca4ede4fb969bb318

SHA512
39ea8d637e31b97bf8bab05d0330ca592647752746a3d8e48d88919a34a35ac1f2639839ae42efcb45bc542ea6c4f7d2498de837df4f9b16e5ded78686a093bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0493f44576fd7d9b6216b7387a26543e

SHA1
47d35c7f2990ec4668ecf1c01e0e5f623153a3f3

SHA256
0679b6900e2118e17164159f449fdc1f6bf20c0cc0b056cc9aedfae42a830ca8

SHA512
a519962ffb281d471bcf63c0bf75bed19d4eeac591cf6bf8565af14dde1d57fe8cabfc05bec52b2087ce8c6f637dbefb438ce22054895dc116b31bffa18e9cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
de79f145eba63371d5fe862a6937c3dc

SHA1
0ab4f374c5bdfbe9f3a47b32a8cd2a27d1426507

SHA256
e59f5df8fd37b8ce32faf45cc999a1fe6ffe384e88df2c1bf33f13bf09f11f4d

SHA512
37653040e747c020007d4eb9a80627965ed2a0b343e6780529d2c939d0237c9aa910e87b873090bb17e0b8a81020f13f1620f98671dfc78a7c522d8ace322040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d6bfa4c5dcfcbb0cbd344eb2c884ac66

SHA1
5f5ff955bec64e0a3789cc9cc0e60a74ede9b482

SHA256
cc6214a4ad7ad669f1a180f9485656d172dc2b2ea5df934f3fd3e7a547106e14

SHA512
e13571a7fb3cc6276d305776c98a77aa011c59d4e7456b855436935edbf8dde8bbbf179c8b7d0646143c85de1d3b11ae73512b40fd756b2e40b027ead6506e2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\AlternateServices.bin

Filesize
7KB

MD5
e421978b6b64c846cd071ef8e631681c

SHA1
6802379a5a038c0b6c008ac9ee61479e3405b105

SHA256
95e9e7e21a4fc07b61a7283f1e35e8e6895d72a65fb3b1657fd90d929cb818e0

SHA512
c0c430f96d224d6757832fa50a2968ff54dbf23b1e1db76ea7e67f48fd9156bc528d70ca3f059e29916b2f0e0b8b8d560c0401a979610ae7874e43531817c6fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\AlternateServices.bin

Filesize
12KB

MD5
1f9f50a39d5a32dfdc7c88136d1fbd25

SHA1
94d158ead60e27df546fc01bac86b5e1106c0d6b

SHA256
19c2b5c74000206d0fed7f3a0978a0d76e1ed62823ec29398ccb295175d304be

SHA512
ce3c2f15bf2c710730d64a6f137f925f8cd892d74ca2066fcf4041ee5609f89848a6072a63659a3b92ca7300614a17c7eb16bc38ef85a4d0f4e34aa93384868d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\db\data.safe.tmp

Filesize
3KB

MD5
238d06b789594f57286c6ae8cc2253ac

SHA1
236fb252e08ff73caedeeb99c139066a7bcff23c

SHA256
6d2ecc4691ee0d87727b6dfcf5ae7c1809198c3a44ed7ef38f167e930821b242

SHA512
514e919b6b80337c7a9460dc25e0f7a55731d76c379e9f5cb09e58c0a34212f0742c5625c6f497a8e29a6cae9eeb22dff9860bf236bfb0a9f2dd1bd83aa367f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
a8f23112c655b878d3f0bb59ba2af878

SHA1
1fa4c7aa5a1f6bc2f7e99b37bf1cac0140f2f145

SHA256
94002a6652e7d496721ced552a6552f61f60398b6404ae2f4dbdfd2a2eaa8702

SHA512
71703338654ec4069d221eca0a62359222765e2ed72b33542931192c22b9f37722f51067693f5883e10858b5b7b18c5676a4446fe2e23f8d38ebbdb8e874b72d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
1b4f49a92dfcb4cb67579afb16527281

SHA1
f9d505523a870dc6fc278393651fc97a04dcade3

SHA256
d1b91779026fb8dfd0145e2e619210e802b6a25f3f5cf20251f0d88354d466ae

SHA512
e5ea85471c5fb45298d0bd6d73b3047f1e0a3136e4de9f294f2308fd6a5397144bb4a518c01c68b4b6eeb0ee27efb4dc512b405fa5e70e84e44d51d1b3cecab2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
e75d8a866ca5f77fc371c4443d77ddbf

SHA1
0101d5df758c241b66690fc1cc69ec256481291d

SHA256
24f86f46273cf530da4052884e50c201e8093e655eea583b272dec91855a2f03

SHA512
7b62c04403c6424a37729c15e4916b51429667eef925041f409c70e345527a8b802d9fadf840a5c0ec48761d89aa2d0a4c3f1820345afd87734db3769dada5f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\pending_pings\6c8fa088-b715-4af8-ad59-d9cacbd40e18

Filesize
25KB

MD5
86dc7df68e50bcc9cb414ae05d4248b0

SHA1
57e3a67083ff442123968defbdeabe1570339bd7

SHA256
32495e23820ae1cdc1b29935842942cbd158f8b56dbe95b969bf305674f3328d

SHA512
00750a71123f3da4fd4f7e3985a01a5a153131afc92e25ebcc15aac453bba4bea312af020f29553313f95ceb2db3407948d44c7016d9794fc0671566983172a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\pending_pings\ce370813-4388-42b3-a4c7-ce71767d9732

Filesize
982B

MD5
48e64aea5116628cd8b2d32e06af379a

SHA1
46f285c99e35bd945c25c0742b169f845056e02b

SHA256
6ef5b7618993e9d272ef62cdc4d007a010b3fec3ed76c85e3ad42670ddb70af0

SHA512
eceecd2e8511f26c521b5cb7f64d88b372be1f9813b4ac4386bada05c03b0451a1969cbdc1ca794c9474dad2c0cf3f7cb40223a9bc734e6943d69b402d3e1e69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\pending_pings\d58876fa-1427-4df9-81e4-189beaceeb15

Filesize
671B

MD5
83e6e8d71805d3896982b2c72e71ef13

SHA1
0ab30fb744865b8d92fb74ad959bcf3b667551c2

SHA256
61937fd93f66e3e0d95abf871fce9491f08bf3a74e5bdccec49b13befe5222f9

SHA512
660d5960cf85cf7657a1450eaa76c6cf030ca057c780a0f63d0338cf25ac330abe3d0f875afa54c92018f7fdb07b303a19eb6d19bddc93b2331924cdc592fe48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\prefs-1.js

Filesize
10KB

MD5
43ab68a144e61e56a21676df6f5918af

SHA1
e9241236733a791428e5804279cfdf4ca0700f81

SHA256
a20a1428b3a812bbd126780f101d922ae2be8af0ef2169fdea91b8debae019cb

SHA512
224df0dd5691a69200ebbbd429ddd9c469c28cbee31df4803d088f4dabaa4ebc7f17cae8f972fc49d6d21f089a1a6d88b580a7804db6137ed1133c302d2a42c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\prefs-1.js

Filesize
10KB

MD5
2541ffac72435bf83554eb8c0bd19327

SHA1
c44c471f3100853dc79d18da206db9c4d5ecd4a6

SHA256
21f074ca5afcbcd3c025bca8aa062447821e13e7b8a4ae332c11ea7cfc3882bf

SHA512
1e058562f1f159aaec4a8cb27f1b51c8d4b36863d91512e86edcae789f1a958232dec6d2ecc790ea7294a47a1da6b4681c5c7cac4e0a4aa79bb4e994b1d8e7d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\prefs.js

Filesize
10KB

MD5
c1f992026d0daa7c75f046a6bf7c8255

SHA1
ca538689d949c519b4d27ada545ae50db1491438

SHA256
7a7ef384be55abf9731a16fea24075d85ea11e3ba0746e98d22d4c6474cf5caa

SHA512
70c16ad1acf5881f0d8a7927258559024881257fee23d849a2eeee289e30f997dda5e8c635cdaf2467fd45f3d1a4e5b3513c7068e3b552eef92013548f55a410

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\prefs.js

Filesize
10KB

MD5
8c2eb46436f8642c7e7664c1b2879a8c

SHA1
066626ca1294228825f9b4a7cefebe5ddf32f909

SHA256
acdbb88d73d441d10b40773e7eba7ed8a304fc3f43f969b520a91fec272e4834

SHA512
18281e5c78baa3105020e736f0a0ae614182f3f0b4fbc3a827eab077d179ab253fa2c2c8c80bcd80a3a25a50ff4571f4655d15842b14c0f0a766929923a74ac1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
73748cbbc82c7c37c61f02153dac3edd

SHA1
e83fb0f5b0217cd84c88d11158a21c76831f9da6

SHA256
9787f8c8fdc5d8f9936024e7495a7c9e38c1d66fd6a6c01581d6ae18d6133cf3

SHA512
40aa1559442247bdd6744c1ff12ecb4ddb0c1d5df459d7a501f2959b0633dac22e8d14b0d03830cd4b9b3a42497e271e1789d7cee9ebafd47214db852772ae8a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
74f5bd63eeb795595e2e7267e44646db

SHA1
4d44c92f3d70e541ab5c228ed9897f39e2a1af71

SHA256
9bd7551e398af323c544f5a9dca095f775d72eb61ff97d39f91727297b9b0100

SHA512
236a236caa3bcc4f6697462bfc8e7e2f91436cb718203493dbe353401cf3d472eb43b1ae738db9b8f17cd528f038774da485a33779d4599f4e9675ef133c18ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
965037c79f64cb8ad2b46fd5c7636862

SHA1
b111bebe0dc1cb219f6e12ecece34d20c300c8bb

SHA256
9a00cf93bedeb05541e71201973d933534d70af9fed0d3f15244d358410f7efc

SHA512
d32a1d107c03141d76f04822cfa334a687de82c87784ad77c8552fcbe5c50fecd4d0fb4ba055e47af0a762dd34ea570977171a7018dedcfe97fafc9262fabcf0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
8c32123252fafe52dccf895dfff3a4ce

SHA1
69c74aa54175a6c1fa202708ab9849da67e4368b

SHA256
52f123e8fe16a8e315f799e3cf32eee1dad69e9017f7e39e09476eb89665addd

SHA512
279e7c7442e7abca16cae0e852b546d464c685ed4e9c93098ece2e70309a322f24a2d63a60bec3b511cb2edcbbeaa1f6a1164963bd64afeb6a521d25a4619ccb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
fc271624919bfa062828bbeb8d625ab7

SHA1
6a581a15182c69061889954227f4722deef5487e

SHA256
eadc93fadd173659eeec8e420cba0148e589d187bcfdcdbb5e36f7403ce0154b

SHA512
50d25095585a0cb25c41e29fbf14d951b079230eb92aeb212f0548b3ec7c37616378ea8a284720584d3bcad1f73cadcbcdd7199bee39b85686a034973b73d54d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionstore-backups\recovery.baklz4

Filesize
21KB

MD5
49b297c6b7238dccd28ed214fef09b1e

SHA1
df3d518a7b208681062362caccbd24e09c1fa39e

SHA256
c6032fbe469eda5802278398505096564e0220967028a6c58603be8092a862f4

SHA512
28d4b2e278a2cdda37daf9380bd669c202e1ba0455a3e14e7814c78f9a3b1808d06682af10277b9fe794e3ca8a9d8f31c5ab49a5f0a3cbabb174947a023c207d

Download Submit
C:\Users\Admin\Desktop\23213.exe

Filesize
382KB

MD5
97eb6f7ec0586fe37b82dbe2f522da35

SHA1
7b9995845a89aec0a6eabe7e9eeb446abe8e5d58

SHA256
f738afbd4c316267d35e2f4d7b818139a55d8ef6b636c3bf736f1672cb4c8ea1

SHA512
888850fe4ea693a5168d6c0f2ab638862dc1a09a1e25f1de8cbfb373753cad982f2461826f5fa54144ba04ff6ed2c19c5850d70a3a2edc3bbb2024cf42710c49

Download Submit
C:\Users\Admin\Desktop\RCXB80D.tmp

Filesize
387KB

MD5
b7a9bac5e1d13510aabb8873da52af23

SHA1
1d11860c87b1ed4855cfd1372b9d534cfc79c839

SHA256
b5de3b8a184dc755d8f009025e37d5de230215b8438baec52ae3418e7d8ef669

SHA512
a175ed00d491d418e99a858923af3c7ab5c33328c4cde9d7297fba81d1c07b1cbc546aa37eae885d6ed02ac9e9d4655c3f69c089287486364e1b832acb40d5f6

Download Submit
C:\Users\Admin\Desktop\WinLocker-Builder--master\WinLocker Builder v1.4.exe

Filesize
699KB

MD5
81dd862410af80c9d2717af912778332

SHA1
8f1df476f58441db5973ccfdc211c8680808ffe1

SHA256
60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f

SHA512
8dd014b91fb1e2122d2e4da444db78dd551513c500d447bb1e94ceb7f2f8d45223a8a706e2156102f8c8850d2bb02ae6b8ea0c9282abd7baaa2c84130112af15

Download Submit
C:\Users\Admin\Downloads\WinLocker-Builder--master.3qSRngpf.zip.part

Filesize
654KB

MD5
60233c7f3e1c98d84361a4752596fef1

SHA1
6905293d90dd91358b16335e4fc73749e70b240f

SHA256
d22c5d94f184d1a4e1783a7aaaf81333041f85b4172fc7ad549436ec6b4c2017

SHA512
de39f0803892235f9ed9757e3aa9d71b76b005144eda725cd737f9a59071ec64a3a4572c6e2fb908cc1bd087d481a1c1e7e87ccceec82bdb91922faa665d3962

Download Submit
memory/1400-1242-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1400-1243-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4396-1201-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/4396-1212-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/4396-1237-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/4396-1239-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download