hxxps://github[.]com/Psychon44/winlocker-builder-by-amp-v6[.]1/raw/refs/heads/main/Winlocker%20builder%20by%20Amp%20v6[.]1[.]exe

Resubmissions

20/06/2026, 09:39

260620-lmn5raft8w8

20/06/2026, 03:17

260620-ds7v2ses7x8

Analysis

user interaction
yes
max time kernel
561s
max time network
556s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Psychon44/winlocker-builder-by-amp-v6.1/raw/refs/heads/main/Winlocker%20builder%20by%20Amp%20v6.1.exe
Sample260620-ds7v2ses7x

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
27	632	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Winlocker builder by Amp v6.1.exe

Executes dropped EXE 35 IoCs

pid	Process
4936	Winlocker builder by Amp v6.1.exe
1264	Winlocker builder by Amp v6.1.exe
1208	WinLocker.exe
4660	WinLocker.exe
4564	WinLocker.exe
1256	WinLocker.exe
836	WinLocker.exe
1816	Winlocker builder by Amp v6.1.exe
60	upx.exe
1196	WinLocker.exe
3520	upx.exe
4104	WinLocker.exe
1468	SelectUnprotect.exe.exe
4060	SelectUnprotect.exe.exe
2488	WinLocker.exe
3060	upx.exe
4524	SelectUnprotect.exe.exe.exe
3232	SelectUnprotect.exe.exe.exe
4436	SelectUnprotect.exe.exe.exe
1788	SelectUnprotect.exe.exe.exe
3612	SelectUnprotect.exe.exe.exe
4768	SelectUnprotect.exe.exe.exe
3640	SelectUnprotect.exe.exe.exe
4700	SelectUnprotect.exe.exe.exe
4944	WinLocker.exe
3348	WinLocker.exe
540	SelectUnprotect.exe.exe
1668	SelectUnprotect.exe.exe
1968	SelectUnprotect.exe.exe
1380	WinLocker.exe
1208	WinLocker.exe
3176	WinLocker.exe
736	WinLocker.exe
1952	WinLocker.exe
640	WinLocker.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
27	raw.githubusercontent.com
239	raw.githubusercontent.com
240	raw.githubusercontent.com
241	raw.githubusercontent.com
242	raw.githubusercontent.com
282	raw.githubusercontent.com
25	raw.githubusercontent.com
26	raw.githubusercontent.com

UPX packed file 40 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000006d5-550.dat	upx
behavioral1/memory/60-556-0x0000000000400000-0x00000000005F5000-memory.dmp	upx
behavioral1/memory/60-563-0x0000000000400000-0x00000000005F5000-memory.dmp	upx
behavioral1/files/0x0005000000000723-566.dat	upx
behavioral1/memory/1196-567-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/1196-568-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/3520-624-0x0000000000400000-0x00000000005F5000-memory.dmp	upx
behavioral1/memory/4104-627-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/files/0x000400000000073b-630.dat	upx
behavioral1/memory/1468-631-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/1468-632-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/4060-634-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/4060-635-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/2488-637-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/3060-693-0x0000000000400000-0x00000000005F5000-memory.dmp	upx
behavioral1/files/0x000500000000073d-697.dat	upx
behavioral1/memory/4524-699-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/4524-702-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/3232-703-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/4436-705-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/1788-707-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/3612-709-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/3612-710-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/4768-716-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/4768-717-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/3640-719-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/4700-721-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/4700-722-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/4944-724-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/4944-725-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/3348-727-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/540-729-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/1668-731-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/1968-733-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/1380-735-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/1208-737-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/3176-739-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/736-741-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/1952-743-0x0000000000400000-0x00000000006D8000-memory.dmp	upx
behavioral1/memory/640-745-0x0000000000400000-0x00000000006D8000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Winlocker builder by Amp v6.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Winlocker builder by Amp v6.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Winlocker builder by Amp v6.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectUnprotect.exe.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLocker.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
632	msedge.exe

Checks processor information in registry 2 TTPs 44 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134263990533345022"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Winlocker builder by Amp v6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Winlocker builder by Amp v6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Winlocker builder by Amp v6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Winlocker builder by Amp v6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	Winlocker builder by Amp v6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Winlocker builder by Amp v6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Winlocker builder by Amp v6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Winlocker builder by Amp v6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Winlocker builder by Amp v6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Winlocker builder by Amp v6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Winlocker builder by Amp v6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Winlocker builder by Amp v6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe11000000c4c770c51ae3dc01cf9349556300dd01de4d6a566300dd0114000000	Winlocker builder by Amp v6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Winlocker builder by Amp v6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Winlocker builder by Amp v6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Winlocker builder by Amp v6.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Winlocker builder by Amp v6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Winlocker builder by Amp v6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Winlocker builder by Amp v6.1.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Ransomware.Petya.zip:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1264	Winlocker builder by Amp v6.1.exe
4936	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4936	Winlocker builder by Amp v6.1.exe
1264	Winlocker builder by Amp v6.1.exe
1264	Winlocker builder by Amp v6.1.exe
1208	WinLocker.exe
1208	WinLocker.exe
4660	WinLocker.exe
4660	WinLocker.exe
4936	Winlocker builder by Amp v6.1.exe
4564	WinLocker.exe
4564	WinLocker.exe
1256	WinLocker.exe
1256	WinLocker.exe
836	WinLocker.exe
836	WinLocker.exe
1816	Winlocker builder by Amp v6.1.exe
1816	Winlocker builder by Amp v6.1.exe
1196	WinLocker.exe
1196	WinLocker.exe
1816	Winlocker builder by Amp v6.1.exe
4104	WinLocker.exe
4104	WinLocker.exe
1468	SelectUnprotect.exe.exe
1468	SelectUnprotect.exe.exe
4060	SelectUnprotect.exe.exe
4060	SelectUnprotect.exe.exe
2488	WinLocker.exe
2488	WinLocker.exe
1816	Winlocker builder by Amp v6.1.exe
4524	SelectUnprotect.exe.exe.exe
3232	SelectUnprotect.exe.exe.exe
4524	SelectUnprotect.exe.exe.exe
3232	SelectUnprotect.exe.exe.exe
4436	SelectUnprotect.exe.exe.exe
4436	SelectUnprotect.exe.exe.exe
1788	SelectUnprotect.exe.exe.exe
1788	SelectUnprotect.exe.exe.exe
3612	SelectUnprotect.exe.exe.exe
3612	SelectUnprotect.exe.exe.exe
4768	SelectUnprotect.exe.exe.exe
4768	SelectUnprotect.exe.exe.exe
3640	SelectUnprotect.exe.exe.exe
3640	SelectUnprotect.exe.exe.exe
4700	SelectUnprotect.exe.exe.exe
4700	SelectUnprotect.exe.exe.exe
4944	WinLocker.exe
4944	WinLocker.exe
3348	WinLocker.exe
3348	WinLocker.exe
540	SelectUnprotect.exe.exe
540	SelectUnprotect.exe.exe
1668	SelectUnprotect.exe.exe
1668	SelectUnprotect.exe.exe
1968	SelectUnprotect.exe.exe
1968	SelectUnprotect.exe.exe
1380	WinLocker.exe
1380	WinLocker.exe
1208	WinLocker.exe
1208	WinLocker.exe
3176	WinLocker.exe
3176	WinLocker.exe
736	WinLocker.exe
736	WinLocker.exe
1952	WinLocker.exe
1952	WinLocker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 3736	4308	msedge.exe	85
PID 4308 wrote to memory of 1832	4308	msedge.exe	86
PID 4308 wrote to memory of 632	4308	msedge.exe	87
PID 4308 wrote to memory of 1832	4308	msedge.exe	86
PID 4308 wrote to memory of 1832	4308	msedge.exe	86
PID 4308 wrote to memory of 1144	4308	msedge.exe	88
PID 4308 wrote to memory of 1144	4308	msedge.exe	88
PID 4308 wrote to memory of 4156	4308	msedge.exe	90
PID 4308 wrote to memory of 4156	4308	msedge.exe	90
PID 4308 wrote to memory of 4156	4308	msedge.exe	90
PID 4308 wrote to memory of 968	4308	msedge.exe	91
PID 4308 wrote to memory of 968	4308	msedge.exe	91
PID 4308 wrote to memory of 968	4308	msedge.exe	91
PID 4308 wrote to memory of 5048	4308	msedge.exe	92
PID 4308 wrote to memory of 5048	4308	msedge.exe	92
PID 4308 wrote to memory of 5048	4308	msedge.exe	92
PID 4308 wrote to memory of 1272	4308	msedge.exe	93
PID 4308 wrote to memory of 1272	4308	msedge.exe	93
PID 4308 wrote to memory of 1272	4308	msedge.exe	93
PID 4308 wrote to memory of 3108	4308	msedge.exe	96
PID 4308 wrote to memory of 5052	4308	msedge.exe	97
PID 4308 wrote to memory of 3108	4308	msedge.exe	96
PID 4308 wrote to memory of 5052	4308	msedge.exe	97
PID 4308 wrote to memory of 5028	4308	msedge.exe	98
PID 4308 wrote to memory of 5028	4308	msedge.exe	98
PID 4308 wrote to memory of 3720	4308	msedge.exe	99
PID 4308 wrote to memory of 3720	4308	msedge.exe	99
PID 4308 wrote to memory of 3720	4308	msedge.exe	99
PID 4308 wrote to memory of 4392	4308	msedge.exe	100
PID 4308 wrote to memory of 1952	4308	msedge.exe	101
PID 4308 wrote to memory of 1952	4308	msedge.exe	101
PID 4308 wrote to memory of 1800	4308	msedge.exe	104
PID 4308 wrote to memory of 4936	4308	msedge.exe	106
PID 4308 wrote to memory of 1264	4308	msedge.exe	108
PID 4308 wrote to memory of 3380	4308	msedge.exe	120
PID 4308 wrote to memory of 4080	4308	msedge.exe	121
PID 4308 wrote to memory of 4912	4308	msedge.exe	122
PID 4308 wrote to memory of 4824	4308	msedge.exe	124
PID 4308 wrote to memory of 4824	4308	msedge.exe	124
PID 1816 wrote to memory of 60	1816	Winlocker builder by Amp v6.1.exe	138
PID 1816 wrote to memory of 3520	1816	Winlocker builder by Amp v6.1.exe	143
PID 1816 wrote to memory of 3060	1816	Winlocker builder by Amp v6.1.exe	151
PID 4680 wrote to memory of 4128	4680	firefox.exe	174
PID 4680 wrote to memory of 4128	4680	firefox.exe	174
PID 4128 wrote to memory of 2412	4128	firefox.exe	175
PID 4128 wrote to memory of 2412	4128	firefox.exe	175
PID 4128 wrote to memory of 2412	4128	firefox.exe	175
PID 4128 wrote to memory of 4108	4128	firefox.exe	176
PID 4128 wrote to memory of 4108	4128	firefox.exe	176
PID 4128 wrote to memory of 4108	4128	firefox.exe	176
PID 4128 wrote to memory of 4108	4128	firefox.exe	176
PID 4128 wrote to memory of 4332	4128	firefox.exe	177
PID 4128 wrote to memory of 4332	4128	firefox.exe	177
PID 4128 wrote to memory of 4332	4128	firefox.exe	177
PID 4128 wrote to memory of 4332	4128	firefox.exe	177
PID 4128 wrote to memory of 4928	4128	firefox.exe	178
PID 4128 wrote to memory of 4928	4128	firefox.exe	178
PID 4128 wrote to memory of 4928	4128	firefox.exe	178
PID 4128 wrote to memory of 4328	4128	firefox.exe	180
PID 4128 wrote to memory of 4328	4128	firefox.exe	180
PID 4128 wrote to memory of 4328	4128	firefox.exe	180
PID 4128 wrote to memory of 4328	4128	firefox.exe	180
PID 4128 wrote to memory of 4324	4128	firefox.exe	181
PID 4128 wrote to memory of 4324	4128	firefox.exe	181

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Psychon44/winlocker-builder-by-amp-v6.1/raw/refs/heads/main/Winlocker%20builder%20by%20Amp%20v6.1.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ffb8b18c188,0x7ffb8b18c194,0x7ffb8b18c1a0
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,15705112675321131048,8093050411077911415,262144 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,2414356635510107685,6750541880781253487,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,12996314664840814108,14523176000927467676,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,4677944427986452551,665645093072999685,2097152 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,1613614239530165075,15585004092766567930,2097152 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,14261377334349589228,14862104378622543099,2097152 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,14122554886978258204,13650154086086021330,2097152 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,16994545542029974849,9717623667453897107,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,15794718460533819465,2796035409956556840,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,11666565348089142166,15438800798338614708,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5788,i,8499937769897925597,242956926908519457,2097152 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,3668065998997339561,15285093132822650142,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,12608036708986336515,14318455037630319485,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,8055598208935306360,7677549485851369693,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,8055598208935306360,7677549485851369693,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:1800
- C:\Users\Admin\Downloads\Winlocker builder by Amp v6.1.exe
  "C:\Users\Admin\Downloads\Winlocker builder by Amp v6.1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4936
- C:\Users\Admin\Downloads\Winlocker builder by Amp v6.1.exe
  "C:\Users\Admin\Downloads\Winlocker builder by Amp v6.1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,4823446761843217997,87581757046683678,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,8230151161624498131,6424532862152591257,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,17775175309602685283,15098562481047429764,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3008,i,363075514471328277,14131728297255265157,524288 --field-trial-handle=2272,i,18420497096821201060,15627194947665846459,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4124

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3816

C:\Users\Admin\Downloads\WinLocker.exe
"C:\Users\Admin\Downloads\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1208

C:\Users\Admin\Downloads\WinLocker.exe
"C:\Users\Admin\Downloads\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4660

C:\Users\Admin\Downloads\WinLocker.exe
"C:\Users\Admin\Downloads\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4564

C:\Users\Admin\Downloads\WinLocker.exe
"C:\Users\Admin\Downloads\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1256

C:\Users\Admin\Downloads\WinLocker.exe
"C:\Users\Admin\Downloads\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:836

C:\Users\Admin\Downloads\Winlocker builder by Amp v6.1.exe
"C:\Users\Admin\Downloads\Winlocker builder by Amp v6.1.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\Desktop\upx.exe
  "C:\Users\Admin\Desktop\upx.exe" WinLocker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:60
- C:\Users\Admin\Desktop\upx.exe
  "C:\Users\Admin\Desktop\upx.exe" SelectUnprotect.exe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3520
- C:\Users\Admin\Desktop\upx.exe
  "C:\Users\Admin\Desktop\upx.exe" SelectUnprotect.exe.exe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3060

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:2216

C:\Users\Admin\Desktop\WinLocker.exe
"C:\Users\Admin\Desktop\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1196

C:\Users\Admin\Desktop\WinLocker.exe
"C:\Users\Admin\Desktop\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4104

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4060

C:\Users\Admin\Desktop\WinLocker.exe
"C:\Users\Admin\Desktop\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2488

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4524

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3232

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4436

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1788

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3612

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4768

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3640

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4700

C:\Users\Admin\Desktop\WinLocker.exe
"C:\Users\Admin\Desktop\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4944

C:\Users\Admin\Desktop\WinLocker.exe
"C:\Users\Admin\Desktop\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3348

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:540

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1668

C:\Users\Admin\Desktop\SelectUnprotect.exe.exe
"C:\Users\Admin\Desktop\SelectUnprotect.exe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1968

C:\Users\Admin\Desktop\WinLocker.exe
"C:\Users\Admin\Desktop\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1380

C:\Users\Admin\Desktop\WinLocker.exe
"C:\Users\Admin\Desktop\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1208

C:\Users\Admin\Desktop\WinLocker.exe
"C:\Users\Admin\Desktop\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3176

C:\Users\Admin\Desktop\WinLocker.exe
"C:\Users\Admin\Desktop\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:736

C:\Users\Admin\Desktop\WinLocker.exe
"C:\Users\Admin\Desktop\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1952

C:\Users\Admin\Desktop\WinLocker.exe
"C:\Users\Admin\Desktop\WinLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:640

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {b36ebbaa-a0bf-44dd-9186-3a3a0ccd9236} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {0f0c4198-3485-491e-928e-1e2202fd39f4} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3704 -prefsLen 27276 -prefMapHandle 3708 -prefMapSize 270279 -jsInitHandle 3712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3720 -initialChannelId {c8a60130-6aaf-4d33-94a0-0c36c28ca81d} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3872 -prefsLen 27276 -prefMapHandle 3876 -prefMapSize 270279 -ipcHandle 4012 -initialChannelId {cb01ff4f-ba04-44ff-a644-5564780edfce} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3124 -prefsLen 34775 -prefMapHandle 3128 -prefMapSize 270279 -jsInitHandle 3052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3056 -initialChannelId {0d36ae56-5941-4c1c-bc23-6313122825f9} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4864 -prefsLen 34824 -prefMapHandle 4868 -prefMapSize 270279 -ipcHandle 4876 -initialChannelId {43fded2d-b989-4026-b620-44994107e4d4} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32952 -prefMapHandle 5196 -prefMapSize 270279 -jsInitHandle 5200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {cd7e26a1-4f06-47a5-8c66-72faf76c7c43} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5376 -prefsLen 32952 -prefMapHandle 5380 -prefMapSize 270279 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {8e121a71-41e9-489d-bc35-096236405a37} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {7a9e0970-e666-4fd0-ac0b-a414a3e268d3} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6252 -prefsLen 33071 -prefMapHandle 6256 -prefMapSize 270279 -jsInitHandle 6260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6220 -initialChannelId {89a68082-c10b-4d28-86b3-20c08a4fa2b7} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5788 -prefsLen 33071 -prefMapHandle 5416 -prefMapSize 270279 -jsInitHandle 5104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5428 -initialChannelId {f4bd0f74-2b13-47d3-af8f-10e6e4d57ac0} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5780 -prefsLen 33071 -prefMapHandle 5608 -prefMapSize 270279 -jsInitHandle 5836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5744 -initialChannelId {d823c613-3011-418c-901d-a79edb8f617b} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6676 -prefsLen 33071 -prefMapHandle 6680 -prefMapSize 270279 -jsInitHandle 6000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6516 -initialChannelId {6de0d156-21b9-4ea3-9b01-2b6b0f6ffaea} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:3432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5772 -prefsLen 36798 -prefMapHandle 5820 -prefMapSize 270279 -jsInitHandle 5484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5428 -initialChannelId {700f66e0-3649-4d8d-9e2d-84a9c75c863c} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:3740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 36798 -prefMapHandle 6404 -prefMapSize 270279 -jsInitHandle 6500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6780 -initialChannelId {5893cd97-abbf-4a4d-86a5-4bd4db53cb32} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5408 -prefsLen 36798 -prefMapHandle 5492 -prefMapSize 270279 -jsInitHandle 6492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6604 -initialChannelId {4fcd8a5b-3b12-4eef-a4d1-de977a2a1d56} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:3232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7772 -prefsLen 39917 -prefMapHandle 7780 -prefMapSize 270279 -ipcHandle 7788 -initialChannelId {a3e9415a-4a96-4060-a09c-c8fdb060b188} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 utility
    3⤵
    - Checks processor information in registry
    PID:1784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7824 -prefsLen 36798 -prefMapHandle 7828 -prefMapSize 270279 -jsInitHandle 7832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7496 -initialChannelId {814469e1-2f14-4a74-86c7-3096735b36a8} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5804 -prefsLen 36798 -prefMapHandle 6508 -prefMapSize 270279 -jsInitHandle 7988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4672 -initialChannelId {e7bf0aa3-3a59-4fd5-b242-6afc3e26830e} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:2620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6968 -prefsLen 36798 -prefMapHandle 4668 -prefMapSize 270279 -jsInitHandle 6576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1496 -initialChannelId {0afcca3a-96b3-4177-89bf-e0296b9333f6} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6812 -prefsLen 36798 -prefMapHandle 6656 -prefMapSize 270279 -jsInitHandle 6588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7524 -initialChannelId {91474495-3fb2-42d5-a350-29d547a77bd6} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 404750677d1279cfd28d89ec8b3ef5a178d368053c4b2ee544a6c9a2cad096ec
MD5 8f2d4c422f866f3f71704e584ee1b522
SHA1 0f0c38a2d357fd7d534eff07cad9783910738dc2
SHA512 8065244c785ebce8b9878af77cf1e23c898b29bd37b541b7fab02949538e04b3edbaaeb94b8107119c0b2564af9332c462567d26a8b957c5aa1c4163599993f3
TLSH
T1FAD02331BD15FCD2D13B21B2551447245E5C459362B3C18AF524585DCCFD880E7D2F97
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 2.3MB
SHA256 e0690e6ba71039e1be5161e7e93ffc7a7882f57a5d38e3f7d4e9a8ffce080f93
MD5 e142b5538058ce6b3a93418fae3ff592
SHA1 701f7417e23b45d97d670bb559761f8127642b6c
SHA512 fcaa3e4ecb25026d430121ad918f5fed5a262d6382f10a331ab0bb0e95dcbaa8093e8d6b7e6f1d57cf961f5a3c0100708d968417e7eff663b9b804f435503d28
SSDEEP 49152:4Ey1J0CuV2ijBif0/mNp4Ln6we30HqC3o6rjRLgPuCPNvlKcdBHidlujv:4EEJVm2Qsc5Ln6we30H7VRLcumZlKSUU
TLSH
T135B5226BA7942777E030D173DED7C31ABB318965D5368B5B1EC20E5FB02604A6A07F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 929b66fd832d5620dc9ab5013bfb9c86735f72ee5d3def784955414b4de8a2f6
MD5 90a9f69a250d6e88091a317f9e72762d
SHA1 4c177baf95c6037a93f451141f460b63d0343ff6
SHA512 e13d751362b26289bfc6d904eadff931277a624afc84ef083c4a38b42834a3f6a5bab8a7fa8be3669837a8f43d36d92efb824e408624d85526d788656f8e2a5e
TLSH
T17F71533933108058E3220872DFD916EB763685E7FCAB3E8111F2BC74A521F728666B4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589100.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589100.TMP
Size 3KB
SHA256 a7d116ef9441ab6e4b6ac950766d4193651cf770b6184f1a7127273f6270f2ad
MD5 a8162675f16b9a0942ce75eed4d17515
SHA1 764b439aa1da15fc8c1fb3046e7a8b2f5b243114
SHA512 4b1dcb8729402029aa3aeca375c2613229f171e5234840c64729bdcaacdb54d493e51eb118c7796ffa1bc6c60809fa14477338a6551909d169b500b2516ce77e
TLSH
T17D71533933108058E3220872DFD916EB763685E7FCAB3E8110F2BC74A521F728666B4C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 1ed488f8976c7800c308f253d6bd2961fd39d1ffe748e127c7a5d24fae9ca59c
MD5 5dcc3f62375b2fc8f21c04e76203c7c6
SHA1 bb2402116a063d5471f87aa8b1a18205341f9ce5
SHA512 ef96a2317b87134a5e74861a48755c88f4723617ba2d952d9783e51801496378fcb623486641180ab359aca4b457303be00f2d432f9e61f243c6c553f664760c
SSDEEP 3:MsEllllkEthXllkl2zE/lio:/M/xT02z3o
TLSH
T1094404047FC00407C50053304451C3541370D71007377F47345104335CCD7D7CC00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 154865b8221dda0d6acb2f5f036741f19d3266d8bd61a221bf680fa746959956
MD5 eb8709148ee0a43e43613253ac3d6c4a
SHA1 294b99fd4fe9720104c113d3d0a5b11832db3460
SHA512 cb7c364f407937a3c93bec9f8941c46da8e0750fa3cd3dfa6061a185d77155a96a96fb435e99f68299cc6ef802ffcbbb22aa1d88fd839a9d12e0bf5615a75f56
TLSH
T13721BBF387E1856EDA114AF0AA24BE2BCE2C0500836C3C6A85E4BF1793E3461E001A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1f9bc027af46545b4ebacc11be37baaf4c5731b6ca4a9c334c27fa1232cfb59e
MD5 1579562c8e5ee3acfcb0c4201ec472d9
SHA1 bac63ed40d37626e2eaf3462264522c3a3c6ca45
SHA512 00c3737302abbc6422ac55be05147babfc366b7940dabfcde6ab66c4dae2ab15ea0e6b1b7b2bd44ca28af4f4e4932e41fda048737e4376947791d36947bd96ef
SSDEEP 192:sxZJ7RSyM/jK1Ml8M9Q/f1sQ4iVWIdpJHW6+WNGYvxI1jHhIgrJ:sxZJ741Q/f1sQ4WJHbGJt9
TLSH
T17B42C752AA345977CCCBD20DFA55BF53D6F91563A2900E84A9FCCA0C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9934a22d50e258eee9a2eeb28f046af432036db8cb5d3d19f803730e26b329c0
MD5 6ed5f1b9a0657f8fe1778eeed3e276f4
SHA1 b2658c215c75901c7c3259858d5e96d5deeec697
SHA512 0f318ad70388de3e89e3ce9d2df527317e476f200d05e6e705d39bbeecae32fa0cf4265246182df0fb92bb7b52b7d5f8c4d1858bae39ebf39ac95ffb92dc878f
SSDEEP 192:sxZJ7RSyM/jK1Ml8W9Q/f1sOWpV9eiVWIdpLHW6+WNGYvTIMjx7IgbAJ:sxZJ74dQ/f1sOWv9eWLHbG8ZY
TLSH
T1E852D652AA34597BCCCBD60DFA55BF53D6F91473A2901E4499FCCA0C01E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4057b5a4d036614ad66c14d687c5f4179e46bf0c0cc823f0b99d15c94d303090
MD5 8faa9af62ab34253a0cc86c4b7174229
SHA1 05a238cff92452c7113c6b967dbdaf106038808e
SHA512 09442338451b6ca2cc01816edf4ab4b40be6ac36d67fccd161d497797e5f75273dcc2a19945caf11e8af82cdb4321ccef46d5025d4ef6704cc7928d0f32b2482
SSDEEP 768:gGseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppMrohk:gGseJ3xWvhfynu1jaVcL88pX+
TLSH
T116D20B2B280CCB7E4F844E5DEC266F966EE801CB67984D5487FA884C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d47821d9-b2b8-4c59-9744-de606afeb95b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d47821d9-b2b8-4c59-9744-de606afeb95b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e6fc84f19b259f508d0a4ac8636af8e90377cfe393d62934ed3e51082a1de0aa
MD5 78cd593a51d4b7c8088db007742a091b
SHA1 37111b2e59fb764ee2910b395ca526a63ab64868
SHA512 7bb8dfc9d0fd2d59db293491e0f20b3235c8a6a2e00bee854d613abee6144c4cbe841a3f7e2bb4fd24f7a01b451911a8f96b95dbbf79b1877bc845a15e2a8df9
SSDEEP 192:u+0eSNWMsnMcPPQLz3XX9VoUsNfYuQ+IfeTM7FcNQmiU1mG/y4MTbt+FdLjv3mhm:ptNn/s3n9SUsNfFXI2A7+LT/9Dd/cmp7
TLSH
T1E3624B726C39AC6B5AA3A485F44B36075FF8816B96C03F94E5DD6F0D01DA3AC1307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b2d29279be08748e76370b6319ac158c0b534ad1168cce4c99f420446d4187e7
MD5 2724f396d8e623e9ed971dd69eb1f00b
SHA1 3c461f0cc8fa1277ac91acb37e04e63458ed071b
SHA512 31759e1d3ad11131a8a58b7c1b6bf509908ffddfb2b58749803e6f27a06ec0789549b2f05a6a1ae90bbd2c6e170852c85c6b4b0ef6d7e2ac102e0258f65dc1db
SSDEEP 384:uiFptNn/s3n9S4osNB8TUNTUlIlcXI2A7+LT/9Dd/+mp7:FFpj+9E8wgQA2/hl+mp7
TLSH
T1D3824A735C68D93BAEB29A85F54A36074FF4416BD6C0AEA4E6DDAE0C00CB2EC1307D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 aba6618d488389f0afc61586511c4ff3f91d085e556862b321d090e6bdf6ce34
MD5 d2ce6f6f4665400dd01e3933c6ca0de0
SHA1 88998aa0ee45bfe07b83098b52a58cc995acc4e3
SHA512 5ab20efd4ec583dd0411fc52a504a31daf7c9ae4522254142363dc082c8dc99ecf2c474ba50e7efbe15037dc3b9af8a5df9baef7e4115339af5fe46269edb93e
SSDEEP 384:uiFetNn/s3n9S46sNh8TUNTUlIlcXI2A7+pO/9Dd/WZ5vFA8BnA/o9OK+Y4MkSp7:FFej+92IwgQAj/hlWz68rMK+Y4MkSp7
TLSH
T110B23AB2D8A59DFB54A6D9C4F646F2122EF41077C5849A0CE3F9BA39308F5FC1306855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bc7f91b9c693da2212c366a54307052e443f1db1b9cc331efb65517c6eb243cb
MD5 b98e5d516b901dd3d3f29aff3ee3f32e
SHA1 c82b85768bce34b63102ac2de0d0afc61d3e9257
SHA512 f5c5f2f25c23a908bac102f2759965c309a6a3f1b31fa5f76ebb3b93d6e501cd79269e760a6ba50d9b1ab69d3440fc25713de8eb3243801a8cc4f5dcd3a56bfc
SSDEEP 192:lONe6vMtPQmiUy4LThTbt+FdLjv3mR847AajU/u:lONe6UtRnTMd/+nU/u
TLSH
T15A02F935AC786C67AAB3BD46F48A27171FE4517FA9905B54EAE82F1C00D764C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 9b09c2f6153963659e34ba16ef1b9352f4ada8c2452ec065c07fa7b28ac69287
MD5 c5126ecdf1bf061deff056fb9e751990
SHA1 670bd3507b8a24c8aec014de78052535591b767d
SHA512 6bdf16ddecb27669cd4a9922498de56216af82a19d11ccb5fbaf3d69fbacee2c33c0ecdbd250f55131777f28436b0a3caf293c4e3691049b87946694d15070f8
SSDEEP 192:0ONC6vMSPQmiUyrLnhTbt+FdLjv3mh780IWqiU/u:0ONC6USRKnMd/xmU/u
TLSH
T1D8121B71AC689C2B6EA3B485F08B36171FA4813BEBC46B50E6DD6F1C01DB66C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 855cc0bda9088f572e2a01ef082a8241a49ee3f1cff56c2b2e943de342a06e8d
MD5 f5d5aa750a77cf06941973750102ac78
SHA1 f934ae117955e0a57c614edadf340c113b764b40
SHA512 27ca497ffab0377d45c4ec30c61684600861bd29a84cd40a95df3f7584e355afc62d6ca4054d15190bf31da355bc7b5b30b1fac86e7420d884fa6858097e33a6
SSDEEP 192:uC0eSNWMsnMcPPQLz3XX9VoUsNfY5Q+IfeTM7FcNQmiU1mG/y4MTbt+FdLjv3mhm:RtNn/s3n9SUsNfcXI2A7+LT/9Dd/cmp7
TLSH
T1FD625B726C39AC275AA3A485F54B36075FF8816B96C02F94E5DDAF0D01CA7AC1307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae986d77-0e9f-4fae-b140-00ca3ae12295.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ae986d77-0e9f-4fae-b140-00ca3ae12295.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bc2abae1885ff9f2380620ac54b748f63b784d3d6680fe8a6b6748b8166ef6ae
MD5 6af5ef2bbfc10e36c18503af00c5cd3b
SHA1 f1a984ba640461de8bdbe02f5dadbf1e9cddf30f
SHA512 1b0890da45190a90fb54a315d997c72a32c92998623434bf74780b5cddbc42032700c0451fdb503bc0fd69f49d3ce0a1213e7b07ee783cc25d97953b396a4973
TLSH
T102411C58A6FD1058B3B76F569BF6A96E487BBC332F0B945D10110E4F0627A00CC61737
MD5 SHA1 SHA512 TLSH

Submit Download

thumbcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Size 28KB
SHA256 f1f7c8b0ff823e9d58cbc32cd7f37127af3976893c8f8b1b8eccfbf9aeaab0f7
MD5 955f60b8e73e9809365fc7256e52360d
SHA1 cadb71a7405df913ad35d5d3f675f29d88624c97
SHA512 a79353a4684a9a3befcaa24d51c99077e328860f612f88d62236fa4bed850c864abbfe39fac36546effac4571e423312aa03b482799772f5de8885452263ac5d
SSDEEP 96:k2ta8YETGqFudCbm7mHAfPRUePthPt8at:k28dENudCKqHAfPFz6a
TLSH
T133D2D3567D35E655C40A1A3C2E6BEBDD6D2AFDC0CD2901237AF2FBAF4AB58478A00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 0a6c69af218636979823dfe0265df0cc2e494a09a029575b2150dd5ad204e2c6
MD5 7b7b0896ff503d08ee712b0d72f98df9
SHA1 b102f100971fcf586ecc623e419dbd46ade23a69
SHA512 faf677f05dcb61c4c4fca82dc9fa0a7e2e3170f90693590a52c687353947e3373f70dee1770c4ab4fe0bd71dc9a609d8ea4a03fc03f0bb5122a4f3cc79282700
SSDEEP 384:HPC9iO024Yvo6J+Sl1xDnZBPsac4j0lpDII+/ao:v9ZYvo0+Sl7zZlsac4ID8Ln
TLSH
T108529DBD9F013CBA1967E0A5D5FE9244CD04E6BBDEE2906A05143C14CA447B9F4F68CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

291ACB60F5B1A5509713778A39B497209EA7B45E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\291ACB60F5B1A5509713778A39B497209EA7B45E
Size 24KB
SHA256 cde97eeca4266b14019cfe712a1e381cb8fce54b7831da051bc9193e98dee28e
MD5 90b93c47b67dc45a1b705f0abcddbdc5
SHA1 008dc4f0bbe54b02e082732db5f0304ae1fee1ca
SHA512 9813ddc745821d63958be4785f10d051009d6bc2de32d749dd38ce1ec22391b869fb3f86eb55fa30d11ba2ff1b6ce0c97df8325a01145b5f478fb2b2e16d4962
SSDEEP 384:VYUsVNxZa5pJIvVoTufVkOQ+qudjsq33E5ZNGjcSywcw6+v8nyFz/6iZ5Zk:VdMN6+WudBdjsqlJcw3v8FIrk
TLSH
T1EBB2D03F1E537E3507A1A9E4CA8F164E6C98F4A3F9ABE0EE6C9C12C258D0775015D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3866779B76900D24AA88CD4C90D6194313942EA4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\3866779B76900D24AA88CD4C90D6194313942EA4
Size 80KB
SHA256 ace7db656444b20137101136415999be87d58a9c9a275d88f12db437f7dda2fb
MD5 d2f47fff008af0897a3d47d1ccbcb7e2
SHA1 5469aa8a12e614a4c82cbd43eb0fe4cfef58e339
SHA512 2be8c90c520a02d5284f9722d82ce17b25f1d046ba1eb3b7dfb0fd7fb8d8dd4bd63ef6030d3bb3965198ce6df1fb9188142c1c3387405066a32c818d88dbd33c
SSDEEP 1536:AAbeESHgdjfLzvZ9THOijwoxgpvzAYA3L8TRXsxHpkZUzbG2iwhceIPw27:AArecHzvZJHOijwzpbbBRXsxpzbh7NIH
TLSH
T1D783023F8B910F2DACA4EEC6D687AF50BE944127FE17E1BCE6841CF0D18594948D859C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

386AEA9D907B496A5C07D91C53453B50DD24F70E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\386AEA9D907B496A5C07D91C53453B50DD24F70E
Size 148KB
SHA256 ec0f04a2599236bd841cbbc68a253beaa479548fb893d1060ab2c225c7b2a7ee
MD5 22d6bb549de4c0805d14ded8e665f409
SHA1 796fba5cf95d22b4cf3c895f629592d3887f8753
SHA512 c2d64f411507812eb5db622834f7d5f8bb5340dd84d4020be2803f5f74983b8067c248cb26a38c5df0eb8ba990a589ed664756901ec10fe12fe52dcc9c4d6f40
SSDEEP 3072:1glSp8ZkjN3sAQBsGSiKgdCrHk+MIN3AAQBs2SiKgdArHk+8fG:1uW35QOiKVHhMEQciKvHh8fG
TLSH
T1C6E34BDFB2D1B73D98D3A5F2005B620A6A7E6A054C98241F7C46F7F95D3098B903AF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3EDDA4487B7BB0FA688CCAD556998906EC4B89A1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\3EDDA4487B7BB0FA688CCAD556998906EC4B89A1
Size 16KB
SHA256 b9616ad25d408888495bce1d9ac06bbe99e2f2b95691b4056b7b42f74d1a144b
MD5 09ba5054d5fdc590bda72f662ff9799b
SHA1 f5c34475f0dfb77c3644e34374b893c34ea10e57
SHA512 d450a40a02c98919a1c346f95fc9bf8df6f7b6b3eaee3fbc5dca63d570950a7036ee83e96c0bd2bd208736b4c6ae333fbbad7cd5f6d610cdc80d3b1190586866
SSDEEP 384:A6rhtm/7GaWnlzVudzZ2V4X5r19V4X5rsHKKaPOGnAK:BlY/NWnnudzZ+4X5r174X5rsHNaZl
TLSH
T193729E3B9E602113CB9194C1C91B4A083D6479E3E1DCF4DDA894764143E8758AEBF4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43340F070AE4B36E7A1DB9422E098267F3B853B8

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\43340F070AE4B36E7A1DB9422E098267F3B853B8
Size 69KB
SHA256 05042a5fe44dfd0eae9bc4987a0082252f347914c7b3d00ac4d101fff6a1215c
MD5 99624641f886925ba3a7499f5998111e
SHA1 3dd2959bbbf877ed564f49738f50267527c62fdc
SHA512 4909cdf64a7f4fe7f80cf71f236bb02b17af6070f3b9eb8a401739f8d90dcbeae18678c4970584c7839106f4d6f310dd7c6d96150b47ebc8f38c9d91785d6d6f
SSDEEP 768:7GMjT3BGxDobuHHEiTdw86FfoFAl3+EUZqAr56RPasgTUagTEcdqPmbC3HyCKtro:5v3Ix0uEoLwbZ0qC74tUY5eEjeufs
TLSH
T1B1635C7175723903C22108758297132BBE9FB187ABC78765AF84F6A17DF1A341CB2E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4B7E37226E384C9C6A5B221CF3BEF5079E838BDE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\4B7E37226E384C9C6A5B221CF3BEF5079E838BDE
Size 14KB
SHA256 eb18495354d082a3f8c51afd629908c5f4a5348f12286652611c048131b0f18c
MD5 d0d8dd8f0e949de4be21750a9b35328f
SHA1 f98da1272c7305f686d8ff48382db265ad0533cf
SHA512 af9f6d33799a78b250e94e0f88ef919aa8e927f7d9d7328055fa4cd5937d402d30d8c805b544056052209ae16d8c76f111864633aca375732cf2e4e1a058e6f1
SSDEEP 384:AyMBmpFiG/06veO5yJ2fyyzkNV4X5r19V4X5rsHKKaPOGnAR:AzBIeO5/Kgkr4X5r174X5rsHNaZC
TLSH
T1D5529E3B6F01361787A144C29B5B16883E206EF7D5ECF0ED68057A41C18876DEE9BCDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4BE7A5640F6E3DF466941B688CB5E9C876B2A4F2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\4BE7A5640F6E3DF466941B688CB5E9C876B2A4F2
Size 94KB
SHA256 a92c34bbe2ef04ce4c108c6a59ef7c1fc350bcf9a76c3bfa5568a983df44b170
MD5 d782f05c3ae44b3dae3c09bbacacb2b0
SHA1 418d67892fc66cb7291628253bb17be7633b3ef4
SHA512 5af104713b7fbc72a4cd50d72f3949620e040ffce3b6ad9b8a48eec10f40ae5143945997bd73498499e781618f8211ee102c3d5ba9915ef6b609b158d622a6b6
SSDEEP 1536:29jCEjUuFWsOumV1XMpmJ9kqQCoVi2kwg3QpOhtJcVXyiY3ZpyZ6W:29jvUu4MWRoVi3p3ixo3yAW
TLSH
T13A935D34BE736812D22195BA4057022B2F3BF0D795C3873ABF86E1E36CA19151DBA774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83354992430E77A36412DC723915A556D80C5BE0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\83354992430E77A36412DC723915A556D80C5BE0
Size 631KB
SHA256 6e04faafb1c4f6ea5e8583e6babf8ed019c829880150e04fda8d520e5739b5e9
MD5 b8a45cc2569bac3096640c80c2619f65
SHA1 e4e1b3475791d1de7d08dff73f4115bf0443e1f2
SHA512 594f18715c0dc402528b0895cb76c1b67af3592625de485d66603333f73f12dfaf4a3bc4878059c729eea6f144434128faaab99cc4e1b6db3a72672cc11110bf
SSDEEP 6144:acOwtj8XXAcPpwf7GYHP5zSi3Yk2v6F8XxUiknYvmWbFhn9vl44YNefklF5QPaVX:acztQAmwvPgBv6aX2I4LlMKX
TLSH
T1D9D4C5467D926E16C252527740EB23323239E0D16FC7F3175BAAB072FC91D5816EE2AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C4997F707BD5823908A7CF064FC95623B39B6DFD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\C4997F707BD5823908A7CF064FC95623B39B6DFD
Size 64KB
SHA256 67f80820cc95a182b47d6163bd0990220cf7364a1d66feeeecf319545cebe2c5
MD5 b00dc2403416421710e6b48ac4861177
SHA1 4091ec2f2dfcc61c27011118b3b7f4a3e5723f81
SHA512 b149464e133708677e78e94a2164887f610f8cb4e8085fdfd191483134220834c7552de03db69ef8b5eb56ccafa6aeff4a112c4b2e532f8df94c6666c264f08a
SSDEEP 1536:dlh6U/l4fHvgW+hARLRPjg5iQlQ6HvsW+hAXLRPjg5iQl8ub:5xoYW+hSLRPAEW+hiLRPVub
TLSH
T1D7534C99B592F025C2B2A4F154AF198DF9FE7941D40C98ACF225C6C43EB0ACC416BF5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D08F538F03DD8D9DE58EF80F3DB722AA7876D38E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\D08F538F03DD8D9DE58EF80F3DB722AA7876D38E
Size 79KB
SHA256 b5f3cb4c15b91ac183adbdbe3d187fe4fcdb8b2f635cdbe0cce000fc6eef6e13
MD5 3b429c49b00d1a8c3c8285cda295b6a0
SHA1 eee2ab495454366eec16529974339f6ac2b01bc5
SHA512 dd7de679723739d99c5613315b877de2dfa2064a4cb0c30442017a8b993423d9eab10e63b64b89509f4f631ba7b1333dbc7c72d7a8408103916a14dc8d71e8bf
SSDEEP 1536:bFosnN/PSdqh/FWN3lRVaixJecAM9W7RcTUPYrA+3r/p5XHDXY5ARCXAM17yf:B9wxxJtrU9K13r/3HDXhCJ1mf
TLSH
T1DB8302375DA1088D47E7EEC58B5647A29C95F3C7B426EFB12C604798E0C8A3FF85520A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DCEDFBD07ED93D7D30D5EDD912D196A6DFF5D850

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\DCEDFBD07ED93D7D30D5EDD912D196A6DFF5D850
Size 1.1MB
SHA256 121e2d4103d925cf3ccf1982cab018ea1974c57b7851fde490c4ada11427a15b
MD5 8410deb2df5583702305b0be2069a96a
SHA1 6dd885b3daeac472ebaf4a8a7a96508290b65f93
SHA512 f6c4dc8ebcdf97fc12c356128ce3dabbe4e8caa3be5f3ba8e6d118b62279706615a578f1e2ea474c5aa84d7f0849fdb2f4300302af0cb2b7ffc1351242ef92f9
SSDEEP 12288:O0DbYaxQm0PyRoU0BRJvQruNPcIun0mS5MWwJwUXCBFwdXoepoVUZIp4Hr7A+wPj:OEbom0PIoU2JvQruNPcIuNZn9K74dA
TLSH
T15045D726EE465E53C82103B240BB63323B34D0856B56F32B2ECF7562FC697751DA52AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6249E60AE6EF8686FE3B3CACA35996BA6DB2809

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\F6249E60AE6EF8686FE3B3CACA35996BA6DB2809
Size 6.9MB
SHA256 ae00d5d51e118ecdbaa07b978222f92964f52f70c97589bd6b34247181440bf9
MD5 7ca704a01a3810b6b59086b3908e7a63
SHA1 bc628b5ed957b72cc64853348dc18595ad8541fa
SHA512 abc17f0374dd46057fc70265703e7f6da704a87789c0cad2dab4491b67d6e2b0afd43e5692e6f28a40b3713674bd5cb92858ca0e69199c401bbc0ef0684a4888
SSDEEP 49152:v/C6PAY0Q6Og9Q40fAgStTUsAoVXs5Nrs01eUtJ2bd+n7sJZwgt3fj/wyklfFY3T:v/C6Ieu9dLS4Zf6lk
TLSH
T12C76F816EF525E23C43003B640FB63723739D0856B97F32B2A8FB552BC697650DA52AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\AlternateServices.bin
Size 10KB
SHA256 3bb45a555ffd932737b8651b2ddf2d6097cee11582de1e691428b5957bdb3aa7
MD5 adf670efd7ec41d6a1fba6a6e6ac9234
SHA1 044fd40461016f1f02fb9ed95ce0910e8f448e19
SHA512 e2a043f3060cee685a2350bbe6acc832fd4628d0fa589bfd6b89ee3f286c86f51c8d176f8489090f8a4a0378b0ddd6e6da79ccc564d56996a1259657277cbd40
SSDEEP 24:4MuhMZ+P91jRO9x0Bm79BYBj89FOBF55q9F55A5HB7f89VvyBp69lKB:Q9aiCuyI5I56hKBqWk
TLSH
T1DE2272E36B75A472F0B28FB45069758C8C330729157EE5C4CA54B0F712C6EA9D13EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\AlternateServices.bin
Size 22KB
SHA256 6bddf240834f587287f731f90502d8cb237821e3be321b34d8033f861125c194
MD5 7f29cb182aaa1fa01635962f80475bdb
SHA1 2e700e8fc29fbd61a6222e34931e20e53576e185
SHA512 a314eb0c7c5ff25620d70c244dd94e9aa080dfa0cf60190e94d5f8be1b5247c468ed9019bf5e530a86213a684b96c50902eb0464ce8b560c2c38147d8b9bd0d8
SSDEEP 96:oWom27aK7CM7JI56J7yBu7Wg7w8yM/pLryx2v3yuZv/y8tvMoYep5z4LOva4:jQZ22vZZ3Ft
TLSH
T188A293F32BB1A862F0628FB0447C748C9C330729586DA5C8CA45B0E702D5EA5D17FBAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\AlternateServices.bin
Size 22KB
SHA256 dcabadb2001b117b88eb9e2543304df1e158fbe8e1e8559e7a8bb36045b94f31
MD5 2f6659a0bdf26f87bf0d24cb727201a4
SHA1 8b27401f3d2b12b7e6992ee96035b53eece158d4
SHA512 bde725ab9b55ddf37554e6f05cdf06d863b55d50a5c8276ebcb19b3798a17e166d7cbee6b5578772afc1e2c6d2f0ab4524d743413db447d252a2d71613359dab
SSDEEP 96:J27LaOPM/puHZSyx2zMayuZzM7y8tzfHKg9hgg9sKTo4LOyQ4:aQ122/ZZ0FtFf
TLSH
T1BFA293F72BB1A866F0228FB054BC749C8C770729586CB5C89645B0E203D5EA4D17FBAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\AlternateServices.bin
Size 22KB
SHA256 3d889eb9ce91e9f88ca9113830c015e2455cbfa69f9f50fa9da751ae96c47393
MD5 b650dc324336e909795b05ee0b102490
SHA1 ea202537d23da02ecad76e99751b49392d21bd7e
SHA512 31fdd9353a0933e792aae8da881c8c951025b086898dc77fdc4bbc7ded1f18c74a663d296b4996b6e4549b6d9d2beadfe8f2ee158a8ce82d6b7865736b15f3aa
SSDEEP 48:K/m27Z51GgGbGBLM/puHZHKg9o4LOyQ4:K/m27Z51GgGbGBM/puHZHKg9o4LOyQ4
TLSH
T177A2E7F72BB19C62F0624FB0887C7498CC3307295879E5D88A19B0D60295FA5D1AFB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\AlternateServices.bin
Size 22KB
SHA256 22f0f5749c27bd01dc36e380541adb8fc8b3ebf9913e3e9e025806d627fd0c8a
MD5 6422bfb78832d6324eb85d0ad93de91d
SHA1 ce8feafb5089959f19e98a9032996bec47327596
SHA512 93a85c07f72c86d7f5d5a93db29e0fcd15f75595f0de0171e01ec09935ee75617d8f51b8deef14b902cf9eeaeb8ce96cd31387dc9d5a348e71ae25d68eb5b831
SSDEEP 48:J27mdKPl2GgGbGnwZM/puHZHKg9o4LOyQ4:J27mdKPIGgGbG+M/puHZHKg9o4LOyQ4
TLSH
T141A2C9FB277298A6F5614FB1446C74C8CC3306299478A5C89A16B0D60285FE5D0AFF6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2454bd2c99f1800eaa6f959c51e9e79a007f46f2348b97cec1d6cab82b9ca45e
MD5 9ea4978c454ea590c0e005c37f9d34f0
SHA1 1d7bc189b2de2532466668ac5dd2cf6ae05d21cb
SHA512 da36df67345cc6eece591103934c71591bee36a3bfc6af08635050703024ba7f8e4a22b28651f1af18993c0c94fc03902d9ddee4724723413b0b0407eed2e646
SSDEEP 192:3Ov5zbomZCWyjlwN1d66JozGzgCl6mc0d:IbomZCWyj6d66JozGzgC1j
TLSH
T1FFE1F164E629863FC419023BCDA52F510F3A398A984E3F1936DC75182C9B6CD76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 5dd9f7f9536273c7f275d2065bb1e272c4a1ef99b290c7bdcc134b0796f5f5be
MD5 29996132fe1d30319ef2c83d19bc8fb0
SHA1 850530cb0808566566bcc976c1c27fec4ce3aa4f
SHA512 f38f60c8afe1e4290a14d9c57a17bd172bc052bf0e42d402fc0091ee3de4e97f93e4c6e7d771fcd65a31330210cfca645c350f8ebcf1d076924733c61fb5ca56
SSDEEP 96:OnFw2FXFwFYFD/dd66JozGzgClKtmc0d/UgSdF95/7bkW60rvECWyUR6IWI:81d66JozGzgCl6mc0dvOv5zbowMCWyjk
TLSH
T132C1E068F639863FC419023BCDA52B500E763986988E3F2932DC35582C9A6CD76CD17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
Size 5KB
SHA256 43181378575eb2d3c0a786f0895a975f248eb94f4bc438c92090cf1a4493e6e8
MD5 e3321177ce32b5a1c7c7d46cd3d4998b
SHA1 b821bc50b1f765693848fd7be01f6077121fae8f
SHA512 8112c147aa14b70a81ba54ed8ac61666dde3cfc39479a6893ae91baf94474ab0f6bec57dc4ab08fa3a516ee2399e8b8d61afb750c1cb47bc9e7db677587cdfe8
SSDEEP 48:YxFcHnYAs25v686PK36j15Yi/i+0K1nzzXSPbvn4MKaQt5deW4UY9IdwvVrpi/El:PSP5H8O5ebP4DhdPfdyNKDZVV7vQ
TLSH
T136B1111C36A84C7E79DBD29CB481069D87DD4B0284C72C4B4CDBFE49CD89E99725E12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 98d9c2c0a2921a4885199e5eb9fb0375850f16d17512300458fd2ad7f23b753f
MD5 40d81d7da44181e136909ffb7dac381d
SHA1 5dca1ff7cad2e9e60363fdbf79f7ed8d6a2b67eb
SHA512 3f9bcc102c002c6c7164892f81dc37a117efda0818def3335c0d5da0231272f0db27f348e8c318c0be16158b3ac38c36cbe1e070248a5b72287b418b5452eb83
TLSH
T175216D5C3AB98D2E68CAE25C7450068E53918D0604D72C4B0D53FE8DCE91ED972AA43E
MD5 SHA1 SHA512 TLSH

Submit Download

1a17c02e-f658-4d3c-aca3-97f427b94539

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\1a17c02e-f658-4d3c-aca3-97f427b94539
Size 235B
SHA256 ad003944107853c49cb8dfe5862707ea1be2bf9b54a1b2b9fedbc969cda9e67a
MD5 172445dcaa8a17ece3a5fbe118584c10
SHA1 8acf8f1fd14bda0318ec10f62d17dc98b20d588f
SHA512 3560a6ce667cc023755dfd07ac23c421097674d6f73c18c4a63007f867877970b6e32d0995d4e4536013b9629110aecc8cb92b5d0bf1ba508b81443f749a6406
TLSH
T1B4D0A7806CAC67FD88145F47B0E069D634898C3725B45860E69545B89EB99C8529191E
MD5 SHA1 SHA512 TLSH

Submit Download

29c7ba7b-8f02-4f5e-9e37-72656cc743d1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\29c7ba7b-8f02-4f5e-9e37-72656cc743d1
Size 235B
SHA256 97f1389543f3a6ae34c33552826733b6962783adcce16351b5d63b30179f88a1
MD5 5325e23fb3a8bc6ef65c5288aa32ebcd
SHA1 a6c8280e7fead900cb2aa038704a920458b4907d
SHA512 f34ac55f4a1ebf2e1746c2881a86aedc1f73997ac29f918a06febe90970cd71e7e03b0bbe41f5b676b900ae7835747ce7a056516f9ffa0dce2b504e98e9636c7
TLSH
T132D097D02898A39C08250F0BB0E029C231548C332464A820D65185B8AABC9C4829280B
MD5 SHA1 SHA512 TLSH

Submit Download

6ea03c81-1e98-4d58-81ff-bb0d6eaecd08

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\6ea03c81-1e98-4d58-81ff-bb0d6eaecd08
Size 883B
SHA256 4b25bf6cbf1e9f08e9945ac31bb5e30293d8c8acbc2f83f4927f5ac109b08ca7
MD5 a132e5cff560c79c5bd1f774e210cc37
SHA1 b819cbecc7e826771bd24b1174baf0911a19676a
SHA512 dc27f547ff061315afe7dd187aae64b7b4dd9f1915179d948c3f914b02d4401c79e07328ff7f7b33d0f780b22ee8d6aa028cf5ceeafb8894c11f6c6cadab249e
TLSH
T130112381D530F9B3CD38D21B9A4577638FF8652380C951143EE15A140C7EA1EA3AB24B
MD5 SHA1 SHA512 TLSH

Submit Download

848e085c-8d5d-4ebc-9752-54aba203cfb8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\848e085c-8d5d-4ebc-9752-54aba203cfb8
Size 2KB
SHA256 692574759802bc1ec02ae11b348582cd7a33227f0d27b19b21bb9369a5fe259b
MD5 88a79240b634e0fd9f654d1e3412fa40
SHA1 41aadcbcbb373a7c400ea7c0fa814c02eb3b165f
SHA512 df38024ccf17e6ab1d3bb491275c5c3deac292bea2f3be87644cd8dbad9d0495f9066b982a2535383009ad591f3b9c169d991e6ea91e825a1e2db3a8b149f923
TLSH
T1E241415C35789DB78EDBE19DDC81239E47644A0240C619832E56EF0C8CEA75D33AA12B
MD5 SHA1 SHA512 TLSH

Submit Download

a038e177-ae13-4f11-a070-8f9e70f3b755

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\a038e177-ae13-4f11-a070-8f9e70f3b755
Size 886B
SHA256 1f2b18afa14ced851fea2e319b69230a3762b3f2a5d5709e140eaac6c96c8763
MD5 4876b1bfac74fcadadafa8c69443d882
SHA1 7385b8dad8c61caff9d9a06c7ec0f52543933efe
SHA512 613be097d44e8035d6dd29df9b6d019adeabfb2f0984e51d6bc98309b39401e676ba542b29869b27d094d7db2381ae45b556fd84782fd0f679bbe727dc4277fe
TLSH
T1BD1100809634F5B3CC7D9247DA9177528EF47113C0C659187EA16B184CEE51EA3D730B
MD5 SHA1 SHA512 TLSH

Submit Download

a5a217d6-6485-48ef-a4ef-b6277377e2cb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\a5a217d6-6485-48ef-a4ef-b6277377e2cb
Size 15KB
SHA256 a84c73c0294bd3bfc06c9499880c9c26e87e3989c9fb577c95395e1987db61af
MD5 c5b8b0175ba2e29f856ecf0f8b05b56f
SHA1 9a04dcf161a8fa06fe2c59f82fbd845e61bedb3a
SHA512 6ebe97842f342d1ccc4655e5bc6262a45f2e81343f56b14819fe145c4a77bba9507739d65e62e9326320c7f6da4da9d6efce50b21203ef970853c46aa6954b88
SSDEEP 384:HOuQx9wP3ZuWlnZdQvtuliSEYR1tUKaMx:HIWP3MWTdQVozx
TLSH
T12772C8565820557A8651E36898FCBFC3E6F638CF4C018FCA9BE4BE086DDE06D112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\extensions.json
Size 16KB
SHA256 8289fd676983a374d5c816213195a53c50d0c1b4c4f58e0ca6025d58c4eb8d75
MD5 268c9980b294d68a80fc5efe8be1cba3
SHA1 8fee69c3b555832a7c75277fe9f475d9f5a3329c
SHA512 8f8fa2e92d9b8e8ba8206c8446461c952127ef864a0fe834874c3c99d5ffd4a3275772be8d8104c39a83569b91cabd5f4154a7b00e19a56b1cfcaffa85f6d9fb
SSDEEP 384:qkI4v3Umldvc8dhWA94z196o3tL4HzlL4PTL4HeL4HCL4Hi84hH:NI4PRflXV4H6Ct4p4H4E4Q474N
TLSH
T14C72531545048EB8298FA79AAA367D02C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 7KB
SHA256 c95b02f597bd3aebc4365c2b89d6c958af67b40af6191f88a729ca46badae4d5
MD5 38ae214e300b2903e9f1c9bee14d77a7
SHA1 6c061b0d2155caa628129136fd39fa6c25583b4a
SHA512 d55a1fae5f3088a85fa0b06711a85b2f4c28cba5544da6d4f4b401730c9acac738eca5c61f4607f9ad2250a8672dd2169ca686eae74d6aeac3e114a25da7eaaa
SSDEEP 96:xHgUTUPDqGqnfL6RmbzSaSSladv9j9n3H8RNBw88n8L4cnFpLGS:yfORnfL6RsSSa8HBw88y
TLSH
T1D9E1007895088F7F64B6776CAC6888716AB2013B77BF68C750B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 12KB
SHA256 1a209654e21b4eee08e11ad25489ee24507f90e2d5a76b64909cb3b877bc2493
MD5 55977f1084fa49b22d5a3014391720a5
SHA1 1f5d24fa0cbdae7dd985693795539022c7e31c5d
SHA512 f1585e4f86c85fbd8b587d4cca6a9a6e36abbd7f44b184bb528811f75d46f6011c979744b9be6ea9dd061f399b82ba006be147477bee1b5aadc63884bcd6cceb
SSDEEP 96:xHgVTUPWPqGqnfI6R3bzSaSSladv9j9n3pwoDRCgRnopOBw88DwEoMgjyL3pB8Yv:yiWCRnfI6RFSSGLRjuOBw8870niDzP
TLSH
T1E742AC3C9114CE3F20B232BEAC254DB159A5072776BFBCDA05FA94D1444CF2441EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 8KB
SHA256 96b0b0783f14d7f1d1c8f4a22b74055867222961b19ef0b417d6c4672e64dd61
MD5 7a1ece4bbe8296acfc0d330c6e96cdc3
SHA1 06d267796bed1d01752f1e254d969fc36b0fbe52
SHA512 a53a1a1343a0ff669d9fcd0ad34695f484bc8da596b9db78177803fdbe6966e3d7fed48df3fdf8cd16e4ec600dc8fc99d8af804fc9be2589019fd696aa4e492d
SSDEEP 96:xHgVTUPDqGqnfI6RmbzSaSSladv9j9n3WRCgRFBw88Jjy5VTseMWR8L4cnFtLGS:yiORnfI6RsSSvRjbBw88nP
TLSH
T13702EE389504CF7F74B676ACAC284D7159B2023B76BF68DA10BA54C5014CF3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 ed2312dfdbec144b5340370b05e7c1984688aec925db42d8c10ebf2600f096bc
MD5 72b1b12e42c190d384d6267c01b09960
SHA1 c7e22d79843f492652ccb8a750f79ff32b167e13
SHA512 b795f080f2b5f6f691275bd52b1f9ecbd2ae6fedef5f412228e83b6b1c6450292f877b07f9d602fa96bdf7c01906b377af3ac13c2bb6832bf530c13effd4566f
SSDEEP 96:xHgUTUPDqGqnfL6R1zSaSSladv9j9n3H8RNBw88n8L4cnFpC:yfORnfL6RTSSa8HBw885
TLSH
T1DBE10E789508CF7F64B6776CAC688871AAB2013B77BF68C650B554C4054CF3882F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 7KB
SHA256 c464d3d756c6c482cccd36cdbd1b18d127c114a62ff683bc620d6b8a2d5cd555
MD5 3ca96c5bbfb55f72197f04ed2a715975
SHA1 eb4d3d27439e43a729eb93f48ebceeb968f47dfe
SHA512 866a16c811a9db59f0cbff74d25c1710411687b92ed590e3b26143697a58860ae8b2ca97856650308034530215f7971e7e6dabffa0d306606f41ef9c104fb903
SSDEEP 96:xHgUTUPDqGqnfL6RNbzSaSSladv9j9n3H8RNBw88n8L4cnFpLGS:yfORnfL6RfSSa8HBw88y
TLSH
T122E1007895088F7F64B6776CAC6888716AB2013B77BF68C750B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 12KB
SHA256 be3f73f0ab60cd3da23911880de4974a91455bcebfb0e0af01fe85b521b1ccf8
MD5 2020e23af5f113a1d21dd115d54bc951
SHA1 38b51dbf276d21ab81f9611f8543e7c7bcaa614b
SHA512 3507f77f8a96a32123439fcb5b886eccad2df04e04ed617b89c7f2cd5b3a9c6c31b61bcb226770f54761fb62888017915807c7909f2300039d84a0ad567624e8
SSDEEP 96:xHgVTUPWPqGqnfI6RmbzSaSSladv9j9n3pwoDRCgRnopOBw88DwEoMgjyL3pB8Yv:yiWCRnfI6RsSSGLRjuOBw8870niDzP
TLSH
T11742AB3C9114CE3F20B232BEAC254DB159A5072776BFBCDA05FA94D1445CF2441EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 e9f514e09c70408500262029d048475bfd164b5780f7d7801403afbf44edf8c6
MD5 de1e3cbdcc732d0f3c290e8d14a5665b
SHA1 06c286e727e79e2b0c5032747860b9bd6c39a7ac
SHA512 90ac26eaa7588bd42ad7ede01d5b5fd5967bf1851b62c0d44b40c5680b1d62b8d69f2202b058c4518f192b8c6428028ceba75fa02cb1bcdce3d2654b3e9d03db
SSDEEP 96:xHgUTUPDqGqnfLLy1zSdFSSladv9jWn3H8RNBw88n8L4cnFpC:yfORnfLLyqSSR8HBw885
TLSH
T12DE11F789408CBBF64B6776CAC6888716AB2013BB7BF68C750B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 15be1a1fa4ddf72c34759926131c266571dd3d71ef72fe6883a85026552004a3
MD5 77d41ee0cc205b9b645c211ad9a83ebc
SHA1 36139b20424a6139164568f1b78dea8db377ac6b
SHA512 b178ef4c145851e148ddd16fcc8dfc0da435f66cb295feac937e01920fa9b16a25d701ff698d405e0eded58a6bffbbd3bf2d4949b3a7ac9a965cfc32d95c88c6
TLSH
T1DB515EB71C2B7CFB7536C6A698EF0FC0CB63102014A9546DBD95AD1204FC206A997E6F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 11KB
SHA256 1ee8ee7e411a29b1261ac8e84831e094a7ae3c5f28497ea45b0a233eabfca158
MD5 b0a1b5e384b49cdb92b25ebcd7e87fcc
SHA1 7685d482a42f8f93355858db39804182d6d7a8f4
SHA512 0fd3718f9da27b39929db15f56a9ca1d4ed4858dc3b481e6fb00cdc3640be2f16dc7ea07fe6dbcd3fb7b973399ddb5f63c24a7a0329903457a00d76d32841af0
SSDEEP 192:3jqTL9ay5VTn/5Xx9p7r0Qb5oiAkAJIFi0v/4+o1b1MW6ZqCo5Ny5RJOE5L:eTLcuVzpj9YQbCiHy+pgxq/gCWNy5RJl
TLSH
T12342CEB3FE406EEB4A38BDC18CEE0FB8D6D31055C8F0216A5B6C985368BD608A1103CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 e4377460e1f52739739a50b5c8a1d907bcf48f42087ba3e23f85248313523802
MD5 7b66e3f064a22123eb1db83c7ecdf15f
SHA1 2f8709a0d9cc989a053b45d5b06ed912bdb4bf4c
SHA512 2074b3dcb1719e0e5e487fb14523c7ff86dd2b5f329a3aed74d419c0381004b1e8a77083059b78b31838f19c2dd9ae760cc669b2cfd44a789a025ab719c90be9
SSDEEP 96:X28yp5xjvL9aQ5Qo5VPpqAVnjha+of3qnXxGzieBjnw8OwSx2OiIoWKh+imkF0E9:XjqTL9ay5VTn/5Xxyhnw8fX6ol+iJOE9
TLSH
T1B8C17C27FA55AC970E12BFD9C8CCAD2DA7E710AAB9F01E489D2C1E2D0151A0C562839D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 db472d1d353ae41f6145045a6b871584aa7178bdafda07ace09212ff25714794
MD5 fd2a5de96fd12894279277a5b3773db4
SHA1 b761d0cd84984a783bd9e2c0c772a7ed211ef95a
SHA512 e11c4b83a9cabf3df0f41282b95022a36add00ed8863d53acecbf0834fbeef53d1b552b555fb2c61177b56ec8e0861a4a621fe5e7ef23ae6247ac73f2af41934
SSDEEP 96:m28yp5xjM9+O5aTKeNNo7GSx2OiILIbImkF0EdIc2:mjqQ9+7OGX6LpJOE/2
TLSH
T1E5915D4BD91A78870D25B8A884DDAE1D97CA91B2AEF009844D6C1E3E864070CB70D3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 11KB
SHA256 a55ae3a02990050d9140f4250fb7950debe7455bda676a39a2badc85404064ac
MD5 f4b02a8f7e33c18483c726027d8ecacb
SHA1 65143028d2051365ef53917c71d95446ca06071c
SHA512 053194b1bf14c375fa8e7840fb7f8857f52208988a4e103a6d501b3c4abca39a3812dc5a111f58e0ee31c9d312a971ca3b1b39ecf81d4fb159e0fdba25e800d4
SSDEEP 192:NjqTL9ay5VTn/5Xx9pB/0Ybq73i0v/4flj3ZBv39F6xJOEzL:YTLcuVzpjAYbApgNj3rv39F6xJOEzL
TLSH
T18F32D1A7BE44BCEF9E68BDC59CEE0F7CC1E31052C9F0017A566D4C23589D00AA41979D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 15ef6de6470c95cd06a0bc6d12aac087c869d66f159fbafc4bc2676ce739c403
MD5 8cb1d93b63586ff4d953445322307cd9
SHA1 312e6122ef5a765260e0c2862494d711dee3b1dc
SHA512 1d50523898379f946970b328eecd3b277f4b834abc526645f7ead3124b407d51a591554fd0e27a273ad8debb6f42b5d61c43ab3b82f0fd5fd30b9a7e5bb94099
SSDEEP 192:PjqTL9ay5VTn/5XxyJtnw8Fi0v/4mKeJOEVb:mTLcuVzp0wOpgm5JOER
TLSH
T1D7E18E7BBD05A8975E62EB8DCCDE4D3C86E31094A8F8191D6C3D5C26017990CC11439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 11KB
SHA256 4eecfd0156ed0d8f1a67f34f5b22a23a9093d819f469cb6a29753b9b3222d680
MD5 03c36626320707e8d814b66144a2c699
SHA1 9b954c4ef70e8bc1653aebc2630ff5048f61fbc0
SHA512 5502b4ad9a7c627d5ba7bc75645d3da4f3b1348f3850b2a9287c2378de3481dc2b0cec172dd55f8264963035d28c141f39d874fef514ed5655f00cc2b48389bf
SSDEEP 192:IjqTL9ay5VTn/5Xx9p7r0Qb5oYnwLMVf/np4WQWUpT1MpGRxFk4qCa+zQJOEazJ:hTLcuVzpj9YQbCywK/pZUpTypgxFkOaS
TLSH
T1D832CFEBF9049DEE4B2536C9C8EC8D6CC1DB3217E4E416B1829D1D4B78EDA0E216924C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 0a930500627ab17da09e209c768062e007f226b281137bac98a8c2ace28a7d85
MD5 2e93bf00f94444ade17443bcbf7b6d94
SHA1 b9f5a8b151fca4bc94172d977165154e8123d57f
SHA512 a653da2f44b25e543925b0f69c2f278904c26931f244387e0eaa3758b6fc8238def60d8f2a7289937c3b8ffdc2dc3bd0d772b7a7ff045827bb22b9c161dceea2
SSDEEP 49152:SDmgBuOjA5lUT2loNcNeaKvgmRBbFOYTg/:emYuO856T2KOeaKvgmc/
TLSH
T1131639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX66E9.tmp

Path C:\Users\Admin\Desktop\RCX66E9.tmp
Size 2.5MB
SHA256 c60eac6367ba0c2eac26c0102ac8f36437e6952c021b52df6cb3350b01992478
MD5 2fe2836ff1066e5f410c763289b13f6c
SHA1 41a55ed741fe05d97ddacce17091381374ea2665
SHA512 34811529cf74dd59acfd968eb56f2bed190ada7c24501f08f187421904a67b1dc03eacf7e1496bb56124df469dfce5a3301a4d69cff53aadfc0b39fdb0fefdb7
SSDEEP 49152:7zf6V1jqp9ekTDNSxfHLqY+xKkmyLW5RhM0gl4:7zyV0pCfOtIFIl4
TLSH
T1C1C5E122F3918837D55326345D4B93D86926BF201E2858877BE93E4CAF367C27839367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDD6D.tmp

Path C:\Users\Admin\Desktop\RCXDD6D.tmp
Size 2.5MB
SHA256 9108a592e04fa0e492a768b5e2e815ea43f06e877f5a327b971f93a28559d5c5
MD5 c2b951e056f813733f8b82834efde702
SHA1 d0ede22d9c53b87c212ea71a5dcc21b9aa320345
SHA512 9a42132986e91b3a070962b95f7a1fd43dcb0523506af823308e224c1b8d568fc6b0903827ffea9105df05ca375028d0c79171846561906b5b0d2f3a51c0e82a
SSDEEP 49152:rzf6V1jqp9ekTDTSxfHLqY+xKkmyLW5RhM0glU:rzyV0p0fOtIFIlU
TLSH
T153C5E122F3918837D55326345D4B93D86926BF201E2858877BE93E4CAF367C27839367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDD9D.tmp

Path C:\Users\Admin\Desktop\RCXDD9D.tmp
Size 2.5MB
SHA256 83ae76c3c53d373fb4d7a250d4e36427aba50bf568925d6ecae27b6b095c0704
MD5 eadb1a82415d5663b2e457a16910180a
SHA1 ea463eeffe571e2a7273be011ba3f17f56c6edf4
SHA512 d235f11791050572421d86448f451cc345305d962dd7753e74b592e2418568a4166bc32b74a3f60ec6aa05981e6aaa818d654fac822e127eee80d1a2bb7cebbe
SSDEEP 49152:bzf6V1jqp9ekTDHSxfHLqY+xKkmyLW5RhM0glB:bzyV0pAfOtIFIlB
TLSH
T161C5E122F3918837D55326345D4B93D86926BF201E2858877BE93E4CAF367C27839367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectUnprotect.exe.exe

Path C:\Users\Admin\Desktop\SelectUnprotect.exe.exe
Size 1.7MB
SHA256 feca0e7a86a9228d5a52c34a03a821d5674890068c4cc5d7b40619259f9b4084
MD5 3ca89d0565434cc87ee3d568637eaf5e
SHA1 35f1ccf7d89f9b26153c9fd91828e5d6aceb5ff7
SHA512 9c778ee6632175dd9cec4e9027c1325ef2b34b846b750948fe28b688b1d16dbb2d81825c099c2bbc2bb278779c6eb90943b657e09cf59feab7e1b3c67077f93e
SSDEEP 49152:pgWzFQAw7DN9v5Tul3GlSgiRceNbC18fm/FYZ:CWOAm5C9Zcebm+Z
TLSH
T10B853364D8402E78E83579B1D57B71E82784BC2B09B869B14E4EF5C6907B3CA98DF10F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectUnprotect.exe.exe

Path C:\Users\Admin\Desktop\SelectUnprotect.exe.exe
Size 2.5MB
SHA256 bf6812e59ac3f1c362c11d5199c1b04e042ea9a819691088649521b1c028b932
MD5 716005791a10bb7c3cdca1bbee37e161
SHA1 bcf90a2b3d49303621640430d812bd092c7db632
SHA512 8a40a4bba5d984fb7decea61f416d036ff8f1e3b3f6a67fc82580011deaffbbc4572fadf7844abe376952f9fd10019003d04f005eb6bf5d819d3d95592541ef9
SSDEEP 49152:zzf6V1jqp9ekTDxSxfHLqY+xKkmyLW5RhM0gl8:zzyV0pmfOtIFIl8
TLSH
T180C5E122F3918837D55326345D4B93D86926BF201E2858877BE93E4CAF367C27839367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectUnprotect.exe.exe.exe

Path C:\Users\Admin\Desktop\SelectUnprotect.exe.exe.exe
Size 1.7MB
SHA256 ee5ef046a651b066017561d689f02a6046680c6b309781ac66b657514bb92aca
MD5 eefd0c5c6e937110a7809ada573c028e
SHA1 18b3f69b053a4593a7f83acad6c3020385e4669a
SHA512 29b370c073af14bb17f2e4b7450b7ca49165351a9b957e83289cfe3202136832c130d7e4c4bd0048534200f812392be979777131d1adb250a3702cfb8c0f4b53
SSDEEP 49152:/gWzFQAwFBtl3lXmmTRrYUb0rbDRNmOy4L2oAafI:4WOAEf9BdkkQbDaOym2oJfI
TLSH
T19C8533548C10AD24EAB36DB1C66FB4F9668C7CA7455078B28E89F5CF893F2C124D612F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinLocker.exe

Path C:\Users\Admin\Desktop\WinLocker.exe
Size 1.7MB
SHA256 f8d62ed2b81edc526d16a4173bdb6e1192352fda9de778952cb481c43935620b
MD5 e67de3a9597260dd91be56e33a3c12c7
SHA1 3102b432bef5f034b246c9b669da1405592e0e74
SHA512 faadc7cc1552f0eed4eda3d170235332a0a936b37200aa250d770bcdcaddcb8e3c7c528bde5e14d8234d94f585d36b8f83b61f68012ad7a99e59c4e513f9b0ee
SSDEEP 49152:ngWzFQAw9zmW4OxmODqw5/MnOJT6GwUPoeZK7:gWOAgzd4QD35EnOKUPoe87
TLSH
T19F853300DC00AE77D922ADB3D467B0E9D6887C5B096C7CB04E89F5CAA0BF3E55AD6057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinLocker.exe

Path C:\Users\Admin\Desktop\WinLocker.exe
Size 2.5MB
SHA256 9d9a8c6b8a0c6a871352173da3e92f59e4735d1dcdb51daa118440c30cef5d19
MD5 d3e05e0757b0037a01cfa4eabf165002
SHA1 10fa14809530439be4da3dd6daa781d975bd1a93
SHA512 bd1955f8e9c52572bbb6c0629eb976a97f3f413693fd783500b178293f60a3d35f4a3e05b5376340af62f07d4c3c6e95da329ab65c05546c5d22cb2c2eb61acf
SSDEEP 49152:zzf6V1jqp9ekTDTSxfHLqY+xKkmyLW5RhM0glE:zzyV0p8fOtIFIlE
TLSH
T162C5E122F3918837D55325345D4B93D8692ABF201E2858877BE93E4CAF367C27839367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinLocker.exe

Path C:\Users\Admin\Desktop\WinLocker.exe
Size 2.5MB
SHA256 282a301fbba04d7ea7337311b10c8052bfa1611978a1792b70f7546129742ee7
MD5 9de65ee3bc8a6b369accd118bfe663e3
SHA1 03b60850ddeb0230f09ce65e2b04bd9435f925a6
SHA512 cf59c57829c00dccceef13f4c256b4dd89a71d6fdc61f41717094d8b00e258c07c14d7d99d89b87ed1c9f726760bdf724ddcf5071a0c746df1a97d885e1acad3
SSDEEP 49152:zzf6V1jqp9ekTDRSxfHLqY+xKkmyLW5RhM0glI:zzyV0p+fOtIFIlI
TLSH
T1C2C5E122F3918837D55325345D4B93D86926BF201E2858877BE93E4CAF367C27839367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upx.exe

Path C:\Users\Admin\Desktop\upx.exe
Size 402KB
SHA256 d634cde09d1aa1320a1d4c589d35d306f8350129faf225b2bca394128c2c4442
MD5 e8b39f250fb67e115e07e9eac5c99708
SHA1 51bf6ab0baa3a4c6f45be46011baa8ccd7ceaf8f
SHA512 37418c8941834c95f59bc026e82002035fcdd7ea217061a217d5ab28f9859f1aacf0e9f213bc5eb27e3f23db8d8817ae88abc3c2ab6a4f45ce3e4ca74c0ce7e8
SSDEEP 12288:eVRYo8O3lmhJ4/f9DbzyYn7gZ7gYESBOY8YsLwxpoS:O8O3BJlgZEczr
TLSH
T1839423C4B48F70E1D2B8753BC6BEA108A1F1765BFDB5CBB5224406B5041EE8EFB1494A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ransomware.FDbAnZL2.Petya.zip.part

Path C:\Users\Admin\Downloads\Ransomware.FDbAnZL2.Petya.zip.part
Size 538KB
SHA256 33ca487a65d38bad82dccfa0d076bad071466e4183562d0b1ad1a2e954667fe9
MD5 e8fb95ebb7e0db4c68a32947a74b5ff9
SHA1 6f93f85342aa3ea7dcbe69cfb55d48e5027b296c
SHA512 a2dea77b0283f4ed987c4de8860a9822bfd030be9c3096cda54f6159a89d461099e58efbc767bb8c04ae21ddd4289da578f8d938d78f30d40f9bca6567087320
SSDEEP 12288:h62An+lYWejkM9KIIoyoAWPPpxS8yrST5UvF50VHCJvD3DpNu7NwRUDxuJnU:hJA+BncEoyojpxS8yrSV0nvHpNu7eQxH
TLSH
T1F3C423620775E85C3CAE4B6EBE5FF6D7E728450D43BA4284267F038079ED6A168190F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinLocker.exe

Path C:\Users\Admin\Downloads\WinLocker.exe
Size 2.5MB
SHA256 40d2283516c4cf460fe395fd79ce71b68d7d2c154bde5c1be9ed9317008c094d
MD5 e71325b12f2719a0763e40d250d1859e
SHA1 b840c468447866c0a7734cde05559c75a8b7bf4a
SHA512 3230c9c8118a6217d78433ad58712118ec1eb570918b617158be5d7b350d39c8666a30313ad4fe296a2daf8a00fb3a4f84b6bb98ea4e169d292f795f7890666c
SSDEEP 49152:7zf6V1jqp9ekTD7SxfHLqY+xKkmyLW5RhM0gl2:7zyV0pMfOtIFIl2
TLSH
T1B7C5E122F3918837D55326345D4B93D86926BF201E2858877BE93E4CAF367C27839367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinLocker.exe

Path C:\Users\Admin\Downloads\WinLocker.exe
Size 2.5MB
SHA256 f5dc68aeefe261f4ae31ccb1da6db905543d64698d05f679f727df02803d136c
MD5 0533664338a1e437ae3e3e9c0bd10e32
SHA1 a2e612d4d3809b650d4e85e1caf35c6a8673f4c1
SHA512 ee6b34830080527da9292b75c08816ffc4739361cb95f7e5d928c19cb588f92c3113e1861483d90c62b27ac6f727b58702cb9c772f3a2c025332085555376718
SSDEEP 49152:7zf6V1jqp9ekTDoSxfHLqY+xKkmyLW5RhM0gl6:7zyV0p5fOtIFIl6
TLSH
T133C5E122F3918837D55326345D4B93D86926BF201E2858877BE93E4CAF367C27839367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinLocker.exe

Path C:\Users\Admin\Downloads\WinLocker.exe
Size 2.5MB
SHA256 0d9b12c49e28b267c790057853361acdfb8955e08a50e89f3be1b39707491618
MD5 c9748a0276a5a468232bdb92d184e605
SHA1 63b519a906b96bcd490230a38c3922474f03ebc7
SHA512 cacb26e7281435d3c52a25d23e8fc01c12c9529e4d375f273bd36097d8f27d3230eb3d79de156b35689d56797ade4af96efff72789712c9688d175db9f790d19
SSDEEP 49152:rzf6V1jqp9ekTDlSxfHLqY+xKkmyLW5RhM0gl:rzyV0pSfOtIFIl
TLSH
T114C5E122F3918837D55326345D4B93986926BF201E285C877BE93E4CAF367C27839367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/60-563-0x0000000000400000-0x00000000005F5000-memory.dmp

Download

memory/60-556-0x0000000000400000-0x00000000005F5000-memory.dmp

Download

memory/540-729-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/640-745-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/736-741-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/836-496-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1196-567-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/1196-568-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/1208-446-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1208-737-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/1256-494-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1264-207-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1264-441-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1264-169-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1264-262-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1264-206-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1380-735-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/1468-632-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/1468-631-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/1668-731-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/1788-707-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/1816-711-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-499-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-639-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-628-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-696-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-625-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-498-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-500-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-569-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-501-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-714-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-502-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-564-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1816-503-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/1952-743-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/1968-733-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/2488-637-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/3060-693-0x0000000000400000-0x00000000005F5000-memory.dmp

Download

memory/3176-739-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/3232-703-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/3348-727-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/3520-624-0x0000000000400000-0x00000000005F5000-memory.dmp

Download

memory/3612-710-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/3612-709-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/3640-719-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/4060-634-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/4060-635-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/4104-627-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/4436-705-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/4524-699-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/4524-702-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/4564-492-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/4660-448-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/4700-722-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/4700-721-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/4768-716-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/4768-717-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/4936-443-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/4936-489-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/4936-294-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/4936-261-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/4936-442-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/4936-450-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/4936-204-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/4936-488-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/4936-165-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/4936-449-0x0000000000400000-0x0000000001559000-memory.dmp

Download

memory/4944-725-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

memory/4944-724-0x0000000000400000-0x00000000006D8000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads