7261318b3b19590c73fd837ddea24e7234f7ecb39c4971fc4354accc30df95ca

Analysis

max time kernel
104s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2025, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LOFITOOL (2).rar
Size

114.4MB
MD5

83568c2f1f7f076a9d4451953b11dc76
SHA1

a51965cf426d8acd904f82b415f4984018719005
SHA256

7261318b3b19590c73fd837ddea24e7234f7ecb39c4971fc4354accc30df95ca
SHA512

5a9c7e9f92e71c83ecc99cb39623375e5f4ff030c305c981fe7a4ed6a5cb73e9c796964043ca46065147516289d223567898ade3826f9cd886de33ccd50b8403
SSDEEP

3145728:QtyqDz00snGpwnE5j1qZPTrGRF37UllfX48txk4aS5g/1JcKAyeUU:4yqiBnEbS+RFgllfX4aJfRPyW

Score

7^/10

agilenet discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5060	mb.exe
988	mb2.exe
4816	wb.exe
4112	sb.exe

Obfuscated with Agile.Net obfuscator 16 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/4112-129-0x0000028025F40000-0x0000028025F60000-memory.dmp	agile_net
behavioral1/files/0x0007000000023ca8-128.dat	agile_net
behavioral1/files/0x0007000000023cc1-130.dat	agile_net
behavioral1/memory/4112-131-0x0000028025F60000-0x0000028025F80000-memory.dmp	agile_net
behavioral1/files/0x0007000000023cb4-132.dat	agile_net
behavioral1/memory/4112-133-0x00000280262C0000-0x000002802632E000-memory.dmp	agile_net
behavioral1/memory/4112-141-0x0000028025FB0000-0x0000028025FCE000-memory.dmp	agile_net
behavioral1/files/0x0007000000023ca9-140.dat	agile_net
behavioral1/memory/4112-139-0x0000028025F80000-0x0000028025F90000-memory.dmp	agile_net
behavioral1/files/0x0007000000023cbd-138.dat	agile_net
behavioral1/memory/4112-137-0x0000028026210000-0x000002802626A000-memory.dmp	agile_net
behavioral1/files/0x0007000000023ca7-136.dat	agile_net
behavioral1/memory/4112-135-0x000002800D820000-0x000002800D82E000-memory.dmp	agile_net
behavioral1/files/0x0007000000023cab-134.dat	agile_net
behavioral1/files/0x0007000000023ca6-142.dat	agile_net
behavioral1/memory/4112-143-0x0000028026480000-0x00000280265CA000-memory.dmp	agile_net

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/988-116-0x0000000000A40000-0x00000000024CB000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
988	mb2.exe
988	mb2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	mb2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	mb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mb2.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "2"	wb.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	wb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	wb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	wb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	wb.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wb.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	wb.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	wb.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	wb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	wb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	wb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000092efdee19718db019db90aa3a862db01b47e3bc7a862db0114000000	wb.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 5c003100000000009e59f3a810004d554c5449547e310000440009000400efbe295a5279295a53792e000000a33c0200000007000000000000000000000000000000935f2f016d0075006c007400690074006f006f006c00000018000000	wb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 50003100000000009f596a5b100066696c6573003c0009000400efbe295a5279295a53792e000000a53c0200000007000000000000000000000000000000bf112400660069006c0065007300000014000000	wb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	wb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	wb.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	wb.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	wb.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	wb.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	wb.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	wb.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	wb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	wb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	wb.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
988	mb2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3076	7zFM.exe
Token: 35	3076	7zFM.exe
Token: SeSecurityPrivilege	3076	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3076	7zFM.exe
3076	7zFM.exe
3076	7zFM.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
988	mb2.exe
4816	wb.exe
4816	wb.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1468	2900	cmd.exe	98
PID 2900 wrote to memory of 1468	2900	cmd.exe	98
PID 2900 wrote to memory of 4448	2900	cmd.exe	105
PID 2900 wrote to memory of 4448	2900	cmd.exe	105
PID 2900 wrote to memory of 5060	2900	cmd.exe	106
PID 2900 wrote to memory of 5060	2900	cmd.exe	106
PID 2900 wrote to memory of 3360	2900	cmd.exe	110
PID 2900 wrote to memory of 3360	2900	cmd.exe	110
PID 2900 wrote to memory of 988	2900	cmd.exe	111
PID 2900 wrote to memory of 988	2900	cmd.exe	111
PID 2900 wrote to memory of 988	2900	cmd.exe	111
PID 2900 wrote to memory of 4980	2900	cmd.exe	112
PID 2900 wrote to memory of 4980	2900	cmd.exe	112
PID 2900 wrote to memory of 4816	2900	cmd.exe	113
PID 2900 wrote to memory of 4816	2900	cmd.exe	113
PID 2900 wrote to memory of 4816	2900	cmd.exe	113
PID 2900 wrote to memory of 5080	2900	cmd.exe	114
PID 2900 wrote to memory of 5080	2900	cmd.exe	114
PID 2900 wrote to memory of 4112	2900	cmd.exe	115
PID 2900 wrote to memory of 4112	2900	cmd.exe	115
PID 2900 wrote to memory of 2748	2900	cmd.exe	120
PID 2900 wrote to memory of 2748	2900	cmd.exe	120

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\LOFITOOL (2).rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\multitool\main.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:4448
- C:\Users\Admin\Desktop\multitool\files\mb.exe
  mb.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:3360
- C:\Users\Admin\Desktop\multitool\files\mb2.exe
  mb2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:4980
- C:\Users\Admin\Desktop\multitool\files\wb.exe
  wb.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:5080
- C:\Users\Admin\Desktop\multitool\files\sb.exe
  sb.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\multitool\files\Bunifu.Licensing.dll

Filesize
1.3MB

MD5
2b2740e0c34a46de31cf9da8a75d77cf

SHA1
242324f1112e6387cda41686291b6e9a415eeb8c

SHA256
a9be91cae167702885a5ca74273db779e3e391e2e604cc03779ed403c53ebe43

SHA512
605eb300b159e6ed2ee872b6ee378eed7dde6541000221fcd94d52057be91cb3c7dd65c7203f05e0718303b157b6fb941498b5e653501f97f0417d459da6bc40

Download Submit
C:\Users\Admin\Desktop\multitool\files\Bunifu.UI.WinForms.1.5.3.dll

Filesize
342KB

MD5
41c216d27c71a227774e680e95e99f31

SHA1
0a2a93d4ecbf4bbec2faf110066c6b4472b0dbf5

SHA256
012d717b4ac00c3686a772757f49c1908e223624e3974314cdb9fc9291073305

SHA512
e355ba11e41b668e4459f709e87c3e212c8986ea894791d9155791ea9d7315372fb51531eb69204ed2ee38e242de7629e4a2f090c05bf9deeea9ea965ffaf651

Download Submit
C:\Users\Admin\Desktop\multitool\files\Bunifu.UI.WinForms.BunifuButton.dll

Filesize
107KB

MD5
21f999e5ac72a16077511d41590822de

SHA1
d8bb1a8a291f73cdf2b5658b2b65736c87db19dd

SHA256
2a62c78f1f0db2e3258135b50f7885e6734c31c74a8f2f5782f285aa268c2f71

SHA512
e04fe31870f266d772829053a6bb210a9513ff5c8c0f9a3a267ddbe1875125496caa602baf44a4e241ef84d933bd55b79af43d5871ed10c81711adecee78b8e3

Download Submit
C:\Users\Admin\Desktop\multitool\files\Bunifu.UI.WinForms.BunifuCheckBox.dll

Filesize
102KB

MD5
ef11f59a9381df17d7ab94434f79f260

SHA1
ec11e46a636fe3927fd5fa7c30be65b958853ef0

SHA256
390252aeb6fd76a954a03853c3d883e0360dc8b3f2cf8cfed5ba94e4e5a24da4

SHA512
612b1b0f9204c605ff5e9b91816e674cdaea71fa69f81a5a7f475bf1cc8d5e12687deb1b0118b07b3d7e4764adede0576f8fc799f8155a65a70e5dafff50f73d

Download Submit
C:\Users\Admin\Desktop\multitool\files\Bunifu.UI.WinForms.BunifuColorTransition.dll

Filesize
38KB

MD5
539d803013c0b1592d0e17a740d72687

SHA1
b0ce15e0f096d027b1d1482afa9d93bafd160f7a

SHA256
500adece1fba76dfb2fa628de9886a2661ed1a4e58a7717a5fee607206bb1d81

SHA512
77d8ab7a949db41a79371cf2ebd5d67bd4a38dd040de0073c878f50b2a6409fae2dc5db7cbf375fbc1bc571838b0a6d4848bdecc1420d91633b878585c94b9dd

Download Submit
C:\Users\Admin\Desktop\multitool\files\Bunifu.UI.WinForms.BunifuLabel.dll

Filesize
420KB

MD5
73ca0338c9c3b7901d3621b346c76a7a

SHA1
79d26ee6e1bf0beb2ee0593562592de8ff01935b

SHA256
a505193910f7b8fd6123c00bb437bff3d2a4f28c970e24207d395554765e6ad4

SHA512
53e0b84dffbec8e465955bc91f1207ba56a55543ba3c00c66997b3ee3d4cb904e027915a12f7a9dc79ffef4cde633c9b7543436c4ab97785ca2169bc3d4aeede

Download Submit
C:\Users\Admin\Desktop\multitool\files\Bunifu.UI.WinForms.BunifuShadowPanel.dll

Filesize
45KB

MD5
ebaf1a6efa8c7a04d174be7e0df602a7

SHA1
ce08c80e52b6cf3f62ba82408d8f32ae6bcef0d8

SHA256
1858b16074d7f9b73f462e3adcc77309800594fa96f2e0904c810eda4eaf5e86

SHA512
4ffd5dcb59a4a03273c4e88047c7d398f098302b9485d07cf5549ca0d72467102aafa69298e248250df154a8b09f7560e634cca9cb1af2838baf3965aa645b31

Download Submit
C:\Users\Admin\Desktop\multitool\files\Bunifu.UI.WinForms.BunifuTextBox.dll

Filesize
112KB

MD5
fd2042c49df3e74e096b8cee8cc9fe43

SHA1
4ccdb0e13c24fb71f502d50e34f00c39bcacf307

SHA256
4569393e1aad7498c6a7c8a84f79d0cd7a1d0656e912d0ddb607b61163673976

SHA512
c93ad9cb411c311b0feeefdf2089c0c13098c7d2bab56345f4e9a7fc515965a3893c613d494adbbb066801eeb3dc32237a8322f7a5f876284a06b447efdad641

Download Submit
C:\Users\Admin\Desktop\multitool\files\Umbral.builder.pdb

Filesize
113KB

MD5
9923a8c48c0375680cd8f34fb9a6b8d0

SHA1
d1e8cf4fbfa19bf86e3877a641e8e3f2582d95c6

SHA256
58f1ca3f7165b0688db2cbf2ec91c0df5dacb43ee03fcd9ddd2a500d162e6899

SHA512
ac0222ec40f5fc62007314ef5e387a0c60743305b50b43d34c56eaad8fbe9210847206067f7ea0f5eede0be6dd5a0729ce4477fa367557b10b5017c721222c04

Download Submit
C:\Users\Admin\Desktop\multitool\files\mb2.exe

Filesize
16.9MB

MD5
16f75bebf90012a5dfe1fcc7fb96b69f

SHA1
34d14ebfecaee6d933ab4a3f756955104ebf2d14

SHA256
ee3b2bb6604bb428293d25e1e778e50b2adb0f227afbcabd4f5c7f7dbdd6d278

SHA512
8d405ddcef3ba54dc002b0951c9e47156fdcedca26a1c81b911adaf12e58ef7edefe0bdf0fe79bc61de32620bf6032ce59ff2b2fbaf4891cb2c638b95c29bb46

Download Submit
C:\Users\Admin\Desktop\multitool\files\sb.exe

Filesize
114KB

MD5
d91fb6867df7e4303d98b5e90faae73c

SHA1
496f53ad8cd9381f1c1b577a73e978081002c1db

SHA256
bb19b002df31e1196b4e6530cf54c449e9cf1383d3adc5334a0442fa96b36344

SHA512
5dbcfe9bf567c6f1e18027950726af1835ab8b363ba8b040fd379b4cfe94b0894bc969b3c04fa4f1964b441a7b894bd4d37f3aabe3ea31396687a6ca093cfdc9

Download Submit
C:\Users\Admin\Desktop\multitool\files\wb.exe

Filesize
2.3MB

MD5
e142b5538058ce6b3a93418fae3ff592

SHA1
701f7417e23b45d97d670bb559761f8127642b6c

SHA256
e0690e6ba71039e1be5161e7e93ffc7a7882f57a5d38e3f7d4e9a8ffce080f93

SHA512
fcaa3e4ecb25026d430121ad918f5fed5a262d6382f10a331ab0bb0e95dcbaa8093e8d6b7e6f1d57cf961f5a3c0100708d968417e7eff663b9b804f435503d28

Download Submit
C:\Users\Admin\Desktop\multitool\main.bat

Filesize
2KB

MD5
a2ebb472e4147903934cf520095c298c

SHA1
39135f29c485c87d340108de658b076e40d98a4b

SHA256
5701d9cb8f402f3faec2a17467f188d7273546e79bc765ad32b82430efb7a6c9

SHA512
2a6cd3715bc57f49767b1e07eb0c71cbded11a957569f082569903522e433147ea3d7f01ab87468a8dc6b78723f726d2a2c01eda10e45aa6f5212fc8920d9be0

Download Submit
memory/988-116-0x0000000000A40000-0x00000000024CB000-memory.dmp

Filesize
26.5MB

Download
memory/988-113-0x0000000006C50000-0x0000000006C78000-memory.dmp

Filesize
160KB

Download
memory/988-111-0x0000000000A40000-0x00000000024CB000-memory.dmp

Filesize
26.5MB

Download
memory/4112-137-0x0000028026210000-0x000002802626A000-memory.dmp

Filesize
360KB

Download
memory/4112-143-0x0000028026480000-0x00000280265CA000-memory.dmp

Filesize
1.3MB

Download
memory/4112-129-0x0000028025F40000-0x0000028025F60000-memory.dmp

Filesize
128KB

Download
memory/4112-133-0x00000280262C0000-0x000002802632E000-memory.dmp

Filesize
440KB

Download
memory/4112-141-0x0000028025FB0000-0x0000028025FCE000-memory.dmp

Filesize
120KB

Download
memory/4112-127-0x000002800BB20000-0x000002800BB42000-memory.dmp

Filesize
136KB

Download
memory/4112-139-0x0000028025F80000-0x0000028025F90000-memory.dmp

Filesize
64KB

Download
memory/4112-145-0x0000028026270000-0x00000280262A0000-memory.dmp

Filesize
192KB

Download
memory/4112-144-0x00000280265D0000-0x00000280266E6000-memory.dmp

Filesize
1.1MB

Download
memory/4112-131-0x0000028025F60000-0x0000028025F80000-memory.dmp

Filesize
128KB

Download
memory/4112-135-0x000002800D820000-0x000002800D82E000-memory.dmp

Filesize
56KB

Download
memory/4816-121-0x0000000000400000-0x0000000001559000-memory.dmp

Filesize
17.3MB

Download
memory/4816-120-0x0000000000400000-0x0000000001559000-memory.dmp

Filesize
17.3MB

Download
memory/4816-122-0x0000000000400000-0x0000000001559000-memory.dmp

Filesize
17.3MB

Download
memory/4816-123-0x0000000000400000-0x0000000001559000-memory.dmp

Filesize
17.3MB

Download
memory/4816-125-0x0000000000400000-0x0000000001559000-memory.dmp

Filesize
17.3MB

Download
memory/5060-108-0x00000201C2A50000-0x00000201C3A50000-memory.dmp

Filesize
16.0MB

Download