hxxp://youtube[.]com

Resubmissions

30/01/2025, 19:26

250130-x5yyfssmen 10

30/01/2025, 19:24

250130-x4cntssmcj 10

30/01/2025, 19:20

250130-x2afpaslfq 10

30/01/2025, 19:16

250130-xy5sesslcj 10

Analysis

max time kernel
155s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2025, 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://youtube.com

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe

Loads dropped DLL 32 IoCs

pid	Process
1912	[email protected]
1912	[email protected]
5012	MsiExec.exe
5012	MsiExec.exe
5012	MsiExec.exe
5012	MsiExec.exe
5012	MsiExec.exe
5012	MsiExec.exe
5012	MsiExec.exe
5012	MsiExec.exe
5012	MsiExec.exe
5012	MsiExec.exe
1660	MsiExec.exe
5012	MsiExec.exe
1912	[email protected]
5012	MsiExec.exe
3964	[email protected]
3964	[email protected]
3568	MsiExec.exe
3568	MsiExec.exe
3568	MsiExec.exe
3568	MsiExec.exe
3568	MsiExec.exe
3568	MsiExec.exe
3568	MsiExec.exe
3568	MsiExec.exe
3568	MsiExec.exe
3568	MsiExec.exe
1928	MsiExec.exe
3568	MsiExec.exe
3964	[email protected]
3568	MsiExec.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
184	5012	MsiExec.exe
186	3568	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\A:	[email protected]
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	[email protected]
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
175	raw.githubusercontent.com
176	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI1F4B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1FF8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23B8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI969C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98F2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e591c3d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A6B.tmp	msiexec.exe
File opened for modification	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\e591c39.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E7D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EEB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI955F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22DC.tmp	msiexec.exe
File created	C:\Windows\Installer\e591c3d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9834.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9884.tmp	msiexec.exe
File created	C:\Windows\Installer\e591c39.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C452D4E2-DE24-48B6-B5C3-ACB240A01606}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI959E.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1DB1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F0B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2085.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2114.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI225E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI961E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9778.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI999F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9ACA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CC5.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2173.tmp	msiexec.exe
File created	C:\Windows\Tasks\sys.job	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "101"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
4916	msedge.exe
4916	msedge.exe
3496	identity_helper.exe
3496	identity_helper.exe
4384	msedge.exe
4384	msedge.exe
552	msiexec.exe
552	msiexec.exe
552	msiexec.exe
552	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	4528	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4528	AUDIODG.EXE
Token: SeSecurityPrivilege	552	msiexec.exe
Token: SeCreateTokenPrivilege	1912	[email protected]
Token: SeAssignPrimaryTokenPrivilege	1912	[email protected]
Token: SeLockMemoryPrivilege	1912	[email protected]
Token: SeIncreaseQuotaPrivilege	1912	[email protected]
Token: SeMachineAccountPrivilege	1912	[email protected]
Token: SeTcbPrivilege	1912	[email protected]
Token: SeSecurityPrivilege	1912	[email protected]
Token: SeTakeOwnershipPrivilege	1912	[email protected]
Token: SeLoadDriverPrivilege	1912	[email protected]
Token: SeSystemProfilePrivilege	1912	[email protected]
Token: SeSystemtimePrivilege	1912	[email protected]
Token: SeProfSingleProcessPrivilege	1912	[email protected]
Token: SeIncBasePriorityPrivilege	1912	[email protected]
Token: SeCreatePagefilePrivilege	1912	[email protected]
Token: SeCreatePermanentPrivilege	1912	[email protected]
Token: SeBackupPrivilege	1912	[email protected]
Token: SeRestorePrivilege	1912	[email protected]
Token: SeShutdownPrivilege	1912	[email protected]
Token: SeDebugPrivilege	1912	[email protected]
Token: SeAuditPrivilege	1912	[email protected]
Token: SeSystemEnvironmentPrivilege	1912	[email protected]
Token: SeChangeNotifyPrivilege	1912	[email protected]
Token: SeRemoteShutdownPrivilege	1912	[email protected]
Token: SeUndockPrivilege	1912	[email protected]
Token: SeSyncAgentPrivilege	1912	[email protected]
Token: SeEnableDelegationPrivilege	1912	[email protected]
Token: SeManageVolumePrivilege	1912	[email protected]
Token: SeImpersonatePrivilege	1912	[email protected]
Token: SeCreateGlobalPrivilege	1912	[email protected]
Token: SeShutdownPrivilege	2736	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2736	msiexec.exe
Token: SeCreateTokenPrivilege	2736	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2736	msiexec.exe
Token: SeLockMemoryPrivilege	2736	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2736	msiexec.exe
Token: SeMachineAccountPrivilege	2736	msiexec.exe
Token: SeTcbPrivilege	2736	msiexec.exe
Token: SeSecurityPrivilege	2736	msiexec.exe
Token: SeTakeOwnershipPrivilege	2736	msiexec.exe
Token: SeLoadDriverPrivilege	2736	msiexec.exe
Token: SeSystemProfilePrivilege	2736	msiexec.exe
Token: SeSystemtimePrivilege	2736	msiexec.exe
Token: SeProfSingleProcessPrivilege	2736	msiexec.exe
Token: SeIncBasePriorityPrivilege	2736	msiexec.exe
Token: SeCreatePagefilePrivilege	2736	msiexec.exe
Token: SeCreatePermanentPrivilege	2736	msiexec.exe
Token: SeBackupPrivilege	2736	msiexec.exe
Token: SeRestorePrivilege	2736	msiexec.exe
Token: SeShutdownPrivilege	2736	msiexec.exe
Token: SeDebugPrivilege	2736	msiexec.exe
Token: SeAuditPrivilege	2736	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2736	msiexec.exe
Token: SeChangeNotifyPrivilege	2736	msiexec.exe
Token: SeRemoteShutdownPrivilege	2736	msiexec.exe
Token: SeUndockPrivilege	2736	msiexec.exe
Token: SeSyncAgentPrivilege	2736	msiexec.exe
Token: SeEnableDelegationPrivilege	2736	msiexec.exe
Token: SeManageVolumePrivilege	2736	msiexec.exe
Token: SeImpersonatePrivilege	2736	msiexec.exe
Token: SeCreateGlobalPrivilege	2736	msiexec.exe
Token: SeRestorePrivilege	552	msiexec.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
2736	msiexec.exe
2736	msiexec.exe
4916	msedge.exe
1212	msiexec.exe
1212	msiexec.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2832	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1776	4916	msedge.exe	83
PID 4916 wrote to memory of 1776	4916	msedge.exe	83
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2296	4916	msedge.exe	84
PID 4916 wrote to memory of 2596	4916	msedge.exe	85
PID 4916 wrote to memory of 2596	4916	msedge.exe	85
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86
PID 4916 wrote to memory of 324	4916	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://youtube.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ea7b46f8,0x7ff8ea7b4708,0x7ff8ea7b4718
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1896 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,366277344283146888,4836792764741729770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x434 0x480
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4376

C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected]
"C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1912
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected] SETUPEXEDIR=C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2736

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A224AC1CDAF166995A24FCDA9537EF41
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:5012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B19D08869D004CE02EF183A288ADC84A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1660
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F80ACAA4C095EDF970D5151147935B73
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:3568
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E82237404CD94CDD49B7045C57C89068 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1928

C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected]
"C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3964
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected] SETUPEXEDIR=C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:1212

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38c3055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e591c3c.rbs

Filesize
99KB

MD5
fb6fbf1230252f25286abb36a7a88118

SHA1
0b7b3aea272d3642cdd9f65afbc8860bfe5d340b

SHA256
ca372069ad4a080fe1e9fa648db5e7255671199252d084e0909004d35897459d

SHA512
921437278f15d07d3f4457ce177cb51f59342f8a3b013bdb956b6a8323c085058ff58160c31bec6e9aaa0af395ae4d359790f69e0bb81c7cc5bea03db3b85b6c

Download Submit
C:\Config.Msi\e591c40.rbs

Filesize
101KB

MD5
4ede64ac221c3c03d4e0f01a1079d13c

SHA1
646ab9340b1b933ea3c741229c1b6ab2d3535801

SHA256
d857eb44007d6830e28f8fc81ab8b652eaf2ab7bb91ad5402c34df989833b197

SHA512
7a82b84fd21e4d781edffeaad33ccfeafe146755d7a91d790e4d6514e818d5121a97e8ad96f538f295d0c9ce0497306cd52ee0fbbacfb9b9dbcfc8d81c20b3b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc29044ff79dd25458f32c381dc676af

SHA1
f4657c0bee9b865607ec3686b8d4f5d4c2c61cd7

SHA256
efe711204437661603d6e59765aba1654678f2093075c1eb2340dc5e80a1140f

SHA512
3d484f755d88c0485195b247230edb79c07cc0941dedbf2f34738ae4f80ba90595f5094c449b213c0c871ade6aff0a14d4acfe843186e2421ccbad221d34bf54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709e5bc1c62a5aa20abcf92d1a3ae51c

SHA1
71c8b6688cd83f8ba088d3d44d851c19ee9ccff6

SHA256
aa718e97104d2a4c68a9dad4aae806a22060702177f836403094f7ca7f0f8d4e

SHA512
b9fc809fbb95b29336e5102382295d71235b0e3a54828b40380958a7feaf27c6407461765680e1f61d88e2692e912f8ec677a66ff965854bea6afae69d99cf24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
046cee6f4a894c99c48bfc7625369f05

SHA1
b1f97d9e48cae4cdb267dfc98cbfc47ba83abbe5

SHA256
9b2614aa5b9c20f99da917977f9cbcb2e60af865e6f6557c25fe842c3ab8de7b

SHA512
d43a494d34aeffb259ead686ef6fadbd028af3cbf73d80785d3419ce51444b1c07511c6e547ba5d8ade8d49012d666b3191ccc492d4c32609ce2f4efad249e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3fdb18253fd3cfaed219f8b8340138d3

SHA1
cd3fbd7aaf0ae5206b5ef6a111a1af0765a769df

SHA256
60a701315cf2330f3f141a7add1c57835158c66b42433b165aeb61bf30bce341

SHA512
9e8f4bbcfb0fe69ef7af264715f04a19bdaf52210de793ee8350d04bd982a0ccc509b2ccd9bf0c9e03750cbc1fba8087222dd0cab98aa40f76089651fbf004ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
090de9fe9381cfefcf032473f7a24f7e

SHA1
8fbb2fb132cb43f67fc960e805dbf567dd1338e0

SHA256
52ef3737b6d5d8c65bc13da3cb7b1f78841023c8e791bbc070166d0093a433bd

SHA512
c0c8982d97dc24efca591e2cf35a490b6e4679b642bbc28f4130450ddb7412003ae7ce050c4c5cecbcc6fc4265c567a29aba21c8845c02d5168e22702828095f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe485f1a35795337c92702a6e9550146

SHA1
6374cb13c27558f4a9b7e6b8823afd510e0c8fd4

SHA256
b3c6fe154c21f5fb0791a7852d2c5e557e3d050cb5c1df3b105bcc46c766e8f0

SHA512
636ebc9eb13b10e88457452130c7657e11dd4ab3b4b5846939a51a7e1adae382ccaba56b2674f5122f67a669289b432184406ec129c9ef07703ca8334078a6b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ea904dc99a1858926f6b16099f056b8d

SHA1
11578ce15952cdf5f45b3bf8755c764f2540973b

SHA256
56c2851747ebdb7b3d7c5709bfefedb6cf94734015a06c959701a2da9d70a793

SHA512
144004db8c7a915935093224ef935e28b9adf3800304a1eebddf2b2d27a36904e682fc5c51d1cd69b0a6a4945bf7fee5761c54d35ef6f71f7251566eefc3b7ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1eb13dc8cc500ae7db41e8e5854cf6b1

SHA1
b351a729dd0b9ce42466ab37ad358ba020a25cd4

SHA256
406505a669965f497e2ec3e90308a900fd1e68a5ee0d850ce524ca218f81ad2a

SHA512
cdb0eb2c2fa4987d755cde835dd5dae897fe58377fe17e4d7b1f84e11d6faac6ae9af7767fdb8f586c5cba127e46ec76d4fb78b4c4fc4f85d49835df401310e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
36a37bb30db3e86fa5b7e51f00c2c485

SHA1
ecf8f5268bb07d0e596201465bec8196295cbedc

SHA256
99f3cf7d09e1cb139c9d4ff54686d5177abdafb943a05b884ec33438e016e891

SHA512
ea522727bbaa9dddd21adce2087f74406675b59e99015e304a2e01ca8d82a068f88464c09e40b153e24946204e22824667badb30cb1bb878ea22620f0911ad8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f741cc045ae162ea7531206a19ccd594

SHA1
86b8b7e72bfb2fd43b1b6bfce8484f38bf160535

SHA256
7e3ac0908c50249fec0a707fad6aaa27b564df9d72cf632ac5e3f18305c1f67b

SHA512
4a0be7114e2cfb613c6dd9b4881e2a9a0a6ad646fba79a71865dbf3836c976d9a44dfc702de60066acaad678c876b98b85d752b3ce38883c581679d0beb82058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1c2120c62a9692d5575e12c39267213c

SHA1
2b73df90aa83be6d112b7e42ceb1dc65f0a595c9

SHA256
cf8957f8ae86c4abea9319064d385067466fca4eabb5e58428b1a4c184c57e09

SHA512
c3fa7aba1b380e11361f70a2ad388760ac38983a802521986d1fe89433828034307d12711ebf226869e0bcbd0cdc5ee05b82c6b4e86b89c2db1d754578b5ceed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
f1eaf50ad7cb0e2419379da5f246ca58

SHA1
41d0256e5b861ea7c8055991a3ae28f52f0d40fd

SHA256
40a8580ee6c2331d099d888383820ca664be786f644d97fe4f65bdc571a86a3d

SHA512
c545b2087099016c5cd47a1676dbfd72b5ffd2a27d9c0cb8b4a3691928f4c21400444a4319b9a75f6ea9a5c80e239025e02551aaf9d2fd077a6b8ba5880195ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
b906a312405e0c8456d5ba738f617f69

SHA1
e87c8679430f187f415d9587b9c56aa3f351bddb

SHA256
cba2f46023c7b1cef60d39eea6cf28c72116bb453fcbd24139e0f3dd7378482a

SHA512
dda31fe18cc097b9055694cddfeafa6815b21925db2fcddc70864bdd2f9a9258e4c1a1647dc96e3ff715df2c809d0feaae3580fcc7c881e8ebab4ad41aeab017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
38e59760cc58db4a5365f8ef3b4bc28a

SHA1
340225a1792c92c3a425db869b91125582d40194

SHA256
6b95bbd19d392d01f17bee5d7fcd19da8cc058edac7782bc02cce1089ac3fb05

SHA512
63182a22fe8d62232d4ff40edb0b3e204ae03c65a85124b68b11b619cc64ea6603c305845c926598a7c969b6f2b32b5bcb789103879a9582576adaceacb0cb53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
09a2cf2c8a0a114883bd977e32772930

SHA1
c3ade2e4dbd607bb27cdda7c2e43805819f7eba4

SHA256
83075bb6aee2a9bf78f4a54e92ab17b2faa505172b4c2d87d2b274ae022cf8f0

SHA512
5bc761c6ccf77f3cafea0968c8ba997ae255d37a04d2c77b51933851ad8ce813f3a357c719a326069e1befe88598a314e812370cc130f1e5d83644046965cda7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58023d.TMP

Filesize
48B

MD5
20ac5df9511c24ba48307cc8f886949f

SHA1
c7f4399cdbd25d023512bb2c0103bcedcd81c3de

SHA256
a9cd9651565d338b1f1c625d95525c9d6e3650c2ce02853a412c6a36b7997896

SHA512
8ac7123f000195960b518d2a1fa929233e5119976807ce419a40f4fae2e8be6b2680a866c21a787e64425b16b767e847c1c0e3d3674a300e9ce0cbd00ca933ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
09021db50a0a5fc0d914e998be3ab149

SHA1
6c1257a12e04dc10dfdd74d21f30fa2769d568a8

SHA256
182761272008aac31e3bd7d87cb7d76eebf968345a9adb568c4ca3c92f44b28d

SHA512
1e00b5efe70cdcca4d3c7a451e289238237675c44373a0981c7c3479b57040a82f9ee6c221b4caf1fa7587c70f9d187ca0e7179701b688ee3c566459fc2f25d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f21034c59fb3d52086d36d757d031611

SHA1
7fa87f5da98df15ada9dc91dde9cb5e2f54c2d4f

SHA256
eac918819fa9a7c4bec28b7ef845cb135090a0f73b96793e40766812ce4f97ea

SHA512
7ff9a630fd43cef85b5068d959c505787e917bc1fd5f92a6de618c03a7b85fe3e71adfbf0d63c5514fc7e7e65c7dc5737334cbc352fb590170f48ba06bee5e43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
de1bacd455ec414d1985a5e3aaf910a8

SHA1
7067a9cc958c6c05d34a8d663293466fd3a89cd6

SHA256
d8a13c46e8a27728cc97b66c7a54e981aee89b76df5be5efca3cd37e600f7678

SHA512
2509cc52284601b1c03d36e73891eb22a935931e949b600756341df6f9a8de311e642c8dbd268ce83609e9bcc730e6bcf1f0aca556c82ca79817d1df40181946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5fd12bdeea55b22f7144f6809fbbe647

SHA1
b0b9444bfea6565f9cdd0ae4fecafe49013bf842

SHA256
49407e0ac9d7f73521c7074c6a4f3e2c0f07d6856059822422504930e851f393

SHA512
fcba71de5775fd9a9fe9c559909b716396d854142b334237cec1565760ad815a3fd6e7e0c5c748148ade6db2daa6682a4b7c3adfb6e680dd982bd7d173e9bd05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f26e.TMP

Filesize
1KB

MD5
551a35c99b85db7859a908ec624a79d5

SHA1
ec694f955a406456db417d621de7a04ccaa7706d

SHA256
a59910f683dea87cba7957de12648b054db04d79dd8518089bd69574dbe303c9

SHA512
6f1a9f999fb9a383e8abd6916b95fdadaa91f2f7e86a9cd0dc351e50becbb1ce04b7c46c65c88c277faf7efe54aeb50bed059a4b8d0eb7f75f91535dbac35d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c1b4d9a86906551a4dbcfabe146e4c83

SHA1
25420c5e1874b4d3b7a907e612c1d01df681671d

SHA256
c07410c0b4c1690bc187a27055f9aafa7e7afb7c4b4967fe2bde16cd1aea1d2b

SHA512
97f643c282e19e4057ff09c344c59f0758fd2188035f8cabf7a9e8ce9b35487a9195a3ea3638bfc033c59fe9ce75abf960c9555fa541912e2e7e8285252f7ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
390b702c533d73146284557287d6a1e9

SHA1
6422788042890432ffcdb85de2cfd1d8fe856d5e

SHA256
3092728e051ad3dc6f06c57e39079534afb887fa9a6e870948c253f736345d3d

SHA512
83cd220018ce2dc602ed4158a633e9d89306a4cfbded49d8c0bb43965353d9107bf32f6a167a464dea83873d5bc0050901376d8fd0dc2abe7ae8c841f408e6cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
99dfc7c7c68c681381b9af5286c8fff4

SHA1
eb16d647a097f6292325ed99ba4e7d10e1e3e615

SHA256
78d1401a678aabb3994dc9a09ce01250de25dc5e1fe05ad47d0ab9d04b0f4edc

SHA512
f36806e190ba61281875a57bf22d2c4ff2bc2896f2c31336844348fa39abd9b402f016e19b7ca59fdc819caffd00f1c769853d8639f45bc1408bba0e1df4336c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
41cfbb2afb96fd33d059ba18af332948

SHA1
bbd7e433255b24d6562695cc32a03af3c92b4f4a

SHA256
82c0985ea1d879b1d95af42b874780b8aaa6385d83dfdb675df75c60936960ec

SHA512
6c650d6137596b349c79589693cb73b56eb4a9f579941ff63c7934cababb5c1987e5ee84c727434c2b2008d196b851e25fa8b366aa7b2116ae6e06f30d3594d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
d0832a3f61ca9c2efa13c6ba657c882c

SHA1
3567295262893734714a4bbb0415b91ffb545146

SHA256
0cb35c555d1a2341a7a3020f5514faf040f9c3ae586f8047e666b5d53977d8df

SHA512
9dc2cd702ec514574a03f1d9218a9fc830fec93d26445b7c337c5b7e0b6e6d61cc559ff64c8e5d2c9b4c22d26860fb04bfd2dab5cc528eb7b9408c61e83788b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
13c811f149fb898cbfa03e3e3d7568ed

SHA1
7400f9f201947c4526a16c303f68aced1b1fcc5a

SHA256
226de58e19a56bbcd856743d8437aea7982de8fd322aaeb940d2fc09f21f1c48

SHA512
2815ca81b43f7908a7de4760c69c29150e42384bf46676d9c17080bc97b5993dc80ea9b4da1b689811bd64cba9a916cbb82184029ed7731ac71949e3da701037

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
4bf13b572e1ea1ef74989f13b7fba5a4

SHA1
d95d8a64bbcf821d974a567fd46655da25bd458b

SHA256
52da156146c6dce14446a9572a518bd165e2c519d41510d04de9ecf219185ab0

SHA512
e971ae27c186fadb05e280283ae06247224e44a7deeda230e432fb3b60026e44c9aa3971eaa8231a4e27fce5d22e4a0ac9dfe485285acb8fccdc9feaf2a279f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{8E4AFB56-1AFD-4AB0-9B18-2EAACF20A8A7}.session

Filesize
2KB

MD5
89b2410122bfb70e8100273bb49385f1

SHA1
497634c8c1f1b7566d5c1aee9a4029457b26ddea

SHA256
f85ebf32e17c1de087ba23f727c80bd8c70fa289d74a7738243fae1aa15207b4

SHA512
563a3209e7370e0479c60b3c483b71d69c28143326c73c480439c53aff22c6c7b266d564e024c35411067643a5745e953bf71f07647700b567390f38051ef420

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{8E4AFB56-1AFD-4AB0-9B18-2EAACF20A8A7}.session

Filesize
2KB

MD5
214f0167b88835d95e0cc9da742d5dac

SHA1
3021580d4d9b2f817eb5844aa51c378c292feb5b

SHA256
46a2004c95fe584032af06a0f1506122c6b1f29b66b42f15b1504a28870ec1a0

SHA512
a56ec816742df2af1c4ec3d558800568a76a4149aeabafc42466bc7bd8b250b6b1a4c9c5bb09fbbe98a9f5fad53371b07a38674460ccbeb0ed809cf3b65b0c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{8E4AFB56-1AFD-4AB0-9B18-2EAACF20A8A7}.session

Filesize
3KB

MD5
9c157328c134a0749ef8eecd076e437f

SHA1
f89d4d8df5e20694701edd73c5bb86cc3d363009

SHA256
4b5360cdfcbc4791b0218003b1d321948b38246f161569a3e03b5c55474a2537

SHA512
fe4d3cb0543d86a46efd70096335909e136c05e5b6867f937527da8893f150a65db829703578da05ebd2f1ed0fc9d30be28d7a7b2b69caaee1cd4d6f5de4c94e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{8E4AFB56-1AFD-4AB0-9B18-2EAACF20A8A7}.session

Filesize
4KB

MD5
c19df6b380ebc586e1bf70187b28fc03

SHA1
51131f3d24c4c9e45c1f368d13c3f16c1e6de992

SHA256
481612dbb514a015b47d00e9d37ee40e445858f1f800f63366a61c18453db961

SHA512
39dff1df525825430d8f4855318508433c35cf5da25146ec430736fe60aca425621c81071c3f5b65719328bbb36832bd9c542879d34087106439222e3c9c1905

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{CA20D114-872C-4F60-84AD-E8A97FFE632B}.session

Filesize
4KB

MD5
2e9f714dce2657e31a1f13d1157e4ebe

SHA1
5470eecaf7d2360a4c44d01e44aa8a08ae33e257

SHA256
975762a6b8ec5ce2ab08ee67a6cf6ec075d69f453c45f65806a1ae14dd76d491

SHA512
deb31affb9cdd89ad811af56eb0c4799db8c8c66e82649ade363e0aacf0dcdf31e78fb78e0b20618474c66d33b1fb031af423d2228d5e3c5e1e712ac165e57bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\shi9234.tmp

Filesize
3.1MB

MD5
aff55ff1a0d686ad405855bd22a932d6

SHA1
00b5db2b0322b2aad7aebd80d1d13372eeb85832

SHA256
926a128e1ef90c09470460fab0682fa500640b96ad3ad6fd8efaff9ed46e97db

SHA512
19bccc43eff166e1c701713edd6279d6c55b1c1277c2391eec73e6aebd201db762a52fc5a764900ac04441e73c573703ee29944c6c0a8e59d90b46b3279cd11e

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi

Filesize
1010KB

MD5
27bc9540828c59e1ca1997cf04f6c467

SHA1
bfa6d1ce9d4df8beba2bedf59f86a698de0215f3

SHA256
05c18698c3dc3b2709afd3355ad5b91a60b2121a52e5fcc474e4e47fb8e95e2a

SHA512
a3ae822116cddb52d859de7ffc958541bb47c355a835c5129aade9cc0e5fba3ff25387061deb5b55b5694a535f09fe8669485282eb6e7c818cc7092eb3392848

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Windows Logoff Sound.wav

Filesize
724KB

MD5
bab1293f4cf987216af8051acddaf97f

SHA1
00abe5cfb050b4276c3dd2426e883cd9e1cde683

SHA256
bc26b1b97eeb45995bbd5f854db19f994cce1bb9ac9fb625eb207302dccdf344

SHA512
3b44371756f069be4f70113a09761a855d80e96c23c8cd76d0c19a43e93d1a159af079ba5189b88b5ee2c093099a02b00ea4dc20a498c9c0c2df7dc95e5ddd49

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\fatalerror.exe

Filesize
24KB

MD5
e579c5b3c386262e3dd4150eb2b13898

SHA1
5ab7b37956511ea618bf8552abc88f8e652827d3

SHA256
e9573a3041e5a45ed8133576d199eb8d12f8922bbe47d194fef9ac166a96b9e2

SHA512
9cf947bad87a701f0e0ad970681767e64b7588089cd9064c72bf24ba6ca0a922988f95b141b29a68ae0e0097f03a66d9b25b9d52197ff71f6e369cde0438e0bb

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\decoder.dll

Filesize
126KB

MD5
3531cf7755b16d38d5e9e3c43280e7d2

SHA1
19981b17ae35b6e9a0007551e69d3e50aa1afffe

SHA256
76133e832c15aa5cbc49fb3ba09e0b8dd467c307688be2c9e85e79d3bf62c089

SHA512
7b053ba2cf92ef2431b98b2a06bd56340dad94de36d11e326a80cd61b9acb378ac644ac407cf970f4ef8333b8d3fb4ff40b18bb41ec5aee49d79a6a2adcf28fd

Download Submit
C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod.zip

Filesize
1.6MB

MD5
713f3673049a096ea23787a9bcb63329

SHA1
b6dad889f46dc19ae8a444b93b0a14248404c11d

SHA256
a62c54fefde2762426208c6e6c7f01ef2066fc837f94f5f36d11a36b3ecddd5f

SHA512
810bdf865a25bde85096e95c697ba7c1b79130b5e589c84ab93b21055b7341b5446d4e15905f7aa4cc242127d9ed1cf6f078b43fe452ad2e40695e5ab2bf8a18

Download Submit
C:\Windows\Installer\MSI1CC5.tmp

Filesize
88KB

MD5
4083cb0f45a747d8e8ab0d3e060616f2

SHA1
dcec8efa7a15fa432af2ea0445c4b346fef2a4d6

SHA256
252b7423b01ff81aea6fe7b40de91abf49f515e9c0c7b95aa982756889f8ac1a

SHA512
26f8949cad02334f9942fda8509579303b81b11bc052a962c5c31a7c6c54a1c96957f30ee241c2206d496d2c519d750d7f6a12b52afdb282fa706f9fee385133

Download Submit
C:\Windows\Installer\MSI1DB1.tmp

Filesize
180KB

MD5
d552dd4108b5665d306b4a8bd6083dde

SHA1
dae55ccba7adb6690b27fa9623eeeed7a57f8da1

SHA256
a0367875b68b1699d2647a748278ebce64d5be633598580977aa126a81cf57c5

SHA512
e5545a97014b5952e15bb321135f65c0e24414f8dd606fe454fd2d048d3f769b9318df7cfb2a6bf932eb2bf6d79811b93cb2008115deb0f0fa9db07f32a70969

Download Submit
C:\Windows\Installer\MSI20B5.tmp

Filesize
96KB

MD5
3cab78d0dc84883be2335788d387601e

SHA1
14745df9595f190008c7e5c190660361f998d824

SHA256
604e79fe970c5ed044517a9a35e4690ea6f7d959d21173ebef45cdd3d3a22bdd

SHA512
df6b49f2b5cddebd7e23e81b0f89e4883fc12d95735a9b3f84d2f402f4996c54b5fdea8adb9eaa98e8c973b089656d18d6b322bd71cb42d7807f7fa8a7348820

Download Submit
C:\Windows\Installer\MSI2114.tmp

Filesize
128KB

MD5
7e6b88f7bb59ec4573711255f60656b5

SHA1
5e7a159825a2d2cb263a161e247e9db93454d4f6

SHA256
59ff5bc12b155cc2e666bd8bc34195c3750eb742542374fc5e53fb22d11e862f

SHA512
294a379c99403f928d476e04668717cdabc7dc3e33bcf6bcad5c3d93d4268971811ff7303aa5b4b2ed2b59d59c8eba350a9a30888d4b5b3064708521ac21439c

Download Submit
C:\Windows\Installer\MSI2173.tmp

Filesize
312KB

MD5
aa82345a8f360804ea1d8d935f0377aa

SHA1
c09cf3b1666d9192fa524c801bb2e3542c0840e2

SHA256
9c155d4214cebda186647c035ada552963dcac8f88a6b38a23ea34f9ecd1d437

SHA512
c051a381d87ba933ea7929c899fb01af2207cb2462dcb2b55c28cff65596b27bdb05a48207624eeea40fddb85003133ad7af09ca93cfb2426c155daea5a9a6db

Download Submit