Analysis Overview
SHA256
b09403adcaf79f3602815c242b3698e43138156d848ac1b0802232d4afc36154
Threat Level: Known bad
The file a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip was found to be: Known bad.
Malicious Activity Summary
BlackMatter Ransomware
Blackmatter family
Executes dropped EXE
Modifies extensions of user files
Checks computer location settings
Reads user/profile data of web browsers
Drops desktop.ini file(s)
Suspicious use of NtSetInformationThreadHideFromDebugger
Sets desktop wallpaper using registry
Program crash
Enumerates physical storage devices
Suspicious behavior: GetForegroundWindowSpam
Modifies registry class
Modifies Control Panel
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Opens file in notepad (likely ransom note)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-09-22 05:49
Signatures
Blackmatter family
Analysis: behavioral1
Detonation Overview
Submitted
2022-09-22 05:49
Reported
2022-09-22 06:20
Platform
win7-20220812-en
Max time kernel
1633s
Max time network
1635s
Command Line
Signatures
Processes
C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2022-09-22 05:49
Reported
2022-09-22 06:20
Platform
win10v2004-20220901-en
Max time kernel
1393s
Max time network
1219s
Command Line
Signatures
BlackMatter Ransomware
Executes dropped EXE
Modifies extensions of user files
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation | C:\ProgramData\B5CE.tmp | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation | C:\ProgramData\C209.tmp | N/A |
Reads user/profile data of web browsers
Drops desktop.ini file(s)
| Description | Indicator | Process | Target |
| File opened for modification | C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini | C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe | N/A |
| File opened for modification | C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini | C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\62ZdIU5ix.bmp" | C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\62ZdIU5ix.bmp" | C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WallPaper | C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\OwEGtgGxQ.bmp" | C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\OwEGtgGxQ.bmp" | C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WallPaper | C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\B5CE.tmp | N/A |
| N/A | N/A | C:\ProgramData\C209.tmp | N/A |
Enumerates physical storage devices
Program crash
Modifies Control Panel
Modifies registry class
Opens file in notepad (likely ransom note)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\7-Zip\7zG.exe | N/A |
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\" -spe -an -ai#7zMap30849:208:7zEvent23246
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build.bat"
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe
keygen -path C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build -pubkey pub.key -privkey priv.key
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_Rundll32.dll
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_Rundll32_pass.dll
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_ReflectiveDll_DllMain.dll
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe
"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2228 -ip 2228
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 184
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe
"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe"
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\DECRYPTION_ID.txt.62ZdIU5ix
C:\ProgramData\B5CE.tmp
"C:\ProgramData\B5CE.tmp"
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe
"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B5CE.tmp >> NUL
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe
"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 748 -ip 748
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 228
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe
"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3660 -ip 3660
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 228
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build.bat" "
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe
keygen -path C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build -pubkey pub.key -privkey priv.key
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_Rundll32.dll
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_Rundll32_pass.dll
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_ReflectiveDll_DllMain.dll
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe
"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe"
C:\ProgramData\C209.tmp
"C:\ProgramData\C209.tmp"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C209.tmp >> NUL
C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\OwEGtgGxQ.README.txt
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe
"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe"
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe
"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 420 -ip 420
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 268
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe
"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe"
C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\Password_exe.txt
C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\Password_dll.txt
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\config.json
Network
| Country | Destination | Domain | Proto |
| US | 93.184.221.240:80 | tcp | |
| NL | 104.80.225.205:443 | tcp | |
| GB | 51.132.193.104:443 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 204.79.197.200:443 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build.bat
| MD5 | 4e46e28b2e61643f6af70a8b19e5cb1f |
| SHA1 | 804a1d0c4a280b18e778e4b97f85562fa6d5a4e6 |
| SHA256 | 8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339 |
| SHA512 | 009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b |
memory/2276-136-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe
| MD5 | 71c3b2f765b04d0b7ea0328f6ce0c4e2 |
| SHA1 | bf8ecb6519f16a4838ceb0a49097bcc3ef30f3c4 |
| SHA256 | ea6d4dedd8c85e4a6bb60408a0dc1d56def1f4ad4f069c730dc5431b1c23da37 |
| SHA512 | 1923db134d7cee25389a07e4d48894dde7ee8f70d008cd890dd34a03b2741a54ec1555e6821755e5af8eae377ef5005e3f9afceb4681059bc1880276e9bcf035 |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe
| MD5 | 71c3b2f765b04d0b7ea0328f6ce0c4e2 |
| SHA1 | bf8ecb6519f16a4838ceb0a49097bcc3ef30f3c4 |
| SHA256 | ea6d4dedd8c85e4a6bb60408a0dc1d56def1f4ad4f069c730dc5431b1c23da37 |
| SHA512 | 1923db134d7cee25389a07e4d48894dde7ee8f70d008cd890dd34a03b2741a54ec1555e6821755e5af8eae377ef5005e3f9afceb4681059bc1880276e9bcf035 |
memory/2548-139-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
| MD5 | c2bc344f6dde0573ea9acdfb6698bf4c |
| SHA1 | d6ae7dc2462c8c35c4a074b0a62f07cfef873c77 |
| SHA256 | a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db |
| SHA512 | d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0 |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\priv.key
| MD5 | b643b31d0fad8b816a566de682b9f9ac |
| SHA1 | 02f95943b1b6841366607892258728f171d5ea21 |
| SHA256 | 0c91172845ef5ba3da0bd98de8a485f2676702e15e1d9d138d7be311c18346b9 |
| SHA512 | 584c9b4cf9f8999861e0d27df20c950dc0dbf425e4a07042d5201e7751c2da21667aaefbc4374dd879ab5d133a198fc5ec0bd956ecaa28c1f9847b75dce61c71 |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\config.json
| MD5 | a6ba7b662de10b45ebe5b6b7edaa62a9 |
| SHA1 | f3ed67bdaef070cd5a213b89d53c5b8022d6f266 |
| SHA256 | 3f7518d88aefd4b1e0a1d6f9748f9a9960c1271d679600e34f5065d8df8c9dc8 |
| SHA512 | 7fc9d4d61742a26def74c7dd86838482e3fc1e4e065cb3a06ae151e2c8614c9c36e8816ae0a3560ad5dd3cc02be131cb232c7deacc7f7b5a611e8eec790feea1 |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
| MD5 | c2bc344f6dde0573ea9acdfb6698bf4c |
| SHA1 | d6ae7dc2462c8c35c4a074b0a62f07cfef873c77 |
| SHA256 | a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db |
| SHA512 | d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0 |
memory/3512-144-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
| MD5 | c2bc344f6dde0573ea9acdfb6698bf4c |
| SHA1 | d6ae7dc2462c8c35c4a074b0a62f07cfef873c77 |
| SHA256 | a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db |
| SHA512 | d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0 |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key
| MD5 | 642e7a7907b04c58094b496357ceebd1 |
| SHA1 | 9b8b1272c19d6f79cd7ee258503a1ff990b7e71a |
| SHA256 | 64acd213f8e7e63c90bd107e3f1f5595406f698842ba18faedcb213d14ae7827 |
| SHA512 | e11db46920bb0eff037a5b8c0c02df4fff70b765fbe0d475c5894844e3b8ad1113120874d7d94070a45d865d229868cf1c2871ade9cda3edf148c54950b6a844 |
memory/3360-147-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
| MD5 | c2bc344f6dde0573ea9acdfb6698bf4c |
| SHA1 | d6ae7dc2462c8c35c4a074b0a62f07cfef873c77 |
| SHA256 | a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db |
| SHA512 | d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0 |
memory/3928-149-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
| MD5 | c2bc344f6dde0573ea9acdfb6698bf4c |
| SHA1 | d6ae7dc2462c8c35c4a074b0a62f07cfef873c77 |
| SHA256 | a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db |
| SHA512 | d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0 |
memory/3984-151-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
| MD5 | c2bc344f6dde0573ea9acdfb6698bf4c |
| SHA1 | d6ae7dc2462c8c35c4a074b0a62f07cfef873c77 |
| SHA256 | a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db |
| SHA512 | d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0 |
memory/2760-153-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
| MD5 | c2bc344f6dde0573ea9acdfb6698bf4c |
| SHA1 | d6ae7dc2462c8c35c4a074b0a62f07cfef873c77 |
| SHA256 | a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db |
| SHA512 | d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0 |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe
| MD5 | 9ae278eaeca72e000cca998bb30dbe36 |
| SHA1 | fabfa9ec9180968dfe0941246c82b9563ed1a8bd |
| SHA256 | d9c93aee203a266fb0b2b077904d6bd9b23244b6e17b826c1f30b4df94e80b88 |
| SHA512 | 8beec575b8d7d6f52c31b0572b428e13f161309531c93c28fd18ba476a1bafda1b485585ea5a51c94c3e9ea777c6c1ad97500adbd0ec6cde372c48b1f8905909 |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe
| MD5 | 9ae278eaeca72e000cca998bb30dbe36 |
| SHA1 | fabfa9ec9180968dfe0941246c82b9563ed1a8bd |
| SHA256 | d9c93aee203a266fb0b2b077904d6bd9b23244b6e17b826c1f30b4df94e80b88 |
| SHA512 | 8beec575b8d7d6f52c31b0572b428e13f161309531c93c28fd18ba476a1bafda1b485585ea5a51c94c3e9ea777c6c1ad97500adbd0ec6cde372c48b1f8905909 |
memory/2228-157-0x0000000000400000-0x0000000000429000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe
| MD5 | 9fa54c15b7983cd3b9dc88384cd4a5b0 |
| SHA1 | 73a152eb067e949dc1a13b0b76f48ad670f46480 |
| SHA256 | fa30dc6dd4c05bbe7f5b923b93e2746ddadc85615eb3fb1e94a21f4c91410011 |
| SHA512 | ecb831275c0c55bffeb7c2192233b3e7bb2702c183d609aafb23f0ca70bee074bd3bcad99a10fffc790bb467ebc7e455a0825564f47a1797d4a5260de4bd0270 |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe
| MD5 | 9fa54c15b7983cd3b9dc88384cd4a5b0 |
| SHA1 | 73a152eb067e949dc1a13b0b76f48ad670f46480 |
| SHA256 | fa30dc6dd4c05bbe7f5b923b93e2746ddadc85615eb3fb1e94a21f4c91410011 |
| SHA512 | ecb831275c0c55bffeb7c2192233b3e7bb2702c183d609aafb23f0ca70bee074bd3bcad99a10fffc790bb467ebc7e455a0825564f47a1797d4a5260de4bd0270 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\BBBBBBBBBBB
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\AAAAAAAAAAA
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\OOOOOOOOOOO
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\NNNNNNNNNNN
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\MMMMMMMMMMM
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\LLLLLLLLLLL
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\KKKKKKKKKKK
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\JJJJJJJJJJJ
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\IIIIIIIIIII
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\HHHHHHHHHHH
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\GGGGGGGGGGG
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\FFFFFFFFFFF
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\EEEEEEEEEEE
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\DDDDDDDDDDD
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\CCCCCCCCCCC
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\VVVVVVVVVVV
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\UUUUUUUUUUU
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\TTTTTTTTTTT
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\YYYYYYYYYYY
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\XXXXXXXXXXX
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\WWWWWWWWWWW
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\SSSSSSSSSSS
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\RRRRRRRRRRR
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\QQQQQQQQQQQ
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\PPPPPPPPPPP
| MD5 | 4fb52b66544ac904e4c82badffd5d6d6 |
| SHA1 | 3053f3e5d1412a14aded86903e55dfcee179b6a5 |
| SHA256 | 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068 |
| SHA512 | 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01 |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\Password_exe.txt
| MD5 | 6726c79e0823177b6aaf8992c8bf67f5 |
| SHA1 | 0b22d9b273ebdb05b24ebafe7c61bc35aedc753b |
| SHA256 | c186fbb4cf5d8cc7049de11a9be58dbc65797ccbc395438f1df4180037155b40 |
| SHA512 | e030e0f137d417785d558f9d6029edebf3a6c8aaf6b58e338e79903f661c3e73766edf6f60f4671a458aee4d199d810e0fb12edee10a148d8b1fb32364492fa4 |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\DECRYPTION_ID.txt
| MD5 | ddd8b26e1add752ededed260c8eb0da6 |
| SHA1 | d80fce6421860a7c9b554e515196b59182a679bc |
| SHA256 | a3d56cb3d004cd66ff496af6ae7c585b682403bb27f7bf5df2f58c0a790d07b2 |
| SHA512 | 9703ffa0c41da7e158effba702622bfb0ac99bd2913051e68eee3e99063c81a15b68f81e9e07c1cddd370e2f7b41ad896a448a0be38f6c43c285c18de6390389 |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\Password_dll.txt
| MD5 | 4b80b617c1455060ed5008eeb6624293 |
| SHA1 | cfa7f676ece915a7ad00af09359ac19973aa0bdb |
| SHA256 | 4f1bf2afefd9590395eab382a898872646abd3611c3158d42edb9dded5c3051d |
| SHA512 | bebf2b92586cbf9e09128a31f0fac23a4cc6c25329432e88398d8551b41f84b41e5a7905d25374725062945f6bd457ccfb1c386a2f991a8995f4461fcad9ad3e |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\DECRYPTION_ID.txt.62ZdIU5ix
| MD5 | ddd8b26e1add752ededed260c8eb0da6 |
| SHA1 | d80fce6421860a7c9b554e515196b59182a679bc |
| SHA256 | a3d56cb3d004cd66ff496af6ae7c585b682403bb27f7bf5df2f58c0a790d07b2 |
| SHA512 | 9703ffa0c41da7e158effba702622bfb0ac99bd2913051e68eee3e99063c81a15b68f81e9e07c1cddd370e2f7b41ad896a448a0be38f6c43c285c18de6390389 |
memory/1316-190-0x0000000000000000-mapping.dmp
memory/64-191-0x0000000000000000-mapping.dmp
C:\ProgramData\B5CE.tmp
| MD5 | 294e9f64cb1642dd89229fff0592856b |
| SHA1 | 97b148c27f3da29ba7b18d6aee8a0db9102f47c9 |
| SHA256 | 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2 |
| SHA512 | b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf |
C:\ProgramData\B5CE.tmp
| MD5 | 294e9f64cb1642dd89229fff0592856b |
| SHA1 | 97b148c27f3da29ba7b18d6aee8a0db9102f47c9 |
| SHA256 | 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2 |
| SHA512 | b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe
| MD5 | 703e39a6e26258db1616f2a662fc3cef |
| SHA1 | af729a61819a7a8e4e761d22b4c672826768db13 |
| SHA256 | c560694875093f2b7defb132029b05c05e82f52ad16a5444de2396d52d1be843 |
| SHA512 | 91e6c217c57e0b5738df9808b5d84fbfb51939f5fe1b776cb63aa38aba2f2bfb3adf0f5a82d673583c7879bcab52788cf9162812d6d59c2828ae92a79707daab |
C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe
| MD5 | 703e39a6e26258db1616f2a662fc3cef |
| SHA1 | af729a61819a7a8e4e761d22b4c672826768db13 |
| SHA256 | c560694875093f2b7defb132029b05c05e82f52ad16a5444de2396d52d1be843 |
| SHA512 | 91e6c217c57e0b5738df9808b5d84fbfb51939f5fe1b776cb63aa38aba2f2bfb3adf0f5a82d673583c7879bcab52788cf9162812d6d59c2828ae92a79707daab |
memory/64-197-0x0000000000400000-0x0000000000407000-memory.dmp
memory/3064-196-0x0000000000000000-mapping.dmp
C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log.62ZdIU5ix
| MD5 | 4ad47551cfdc9a9f4e78d2e5d6e79c6c |
| SHA1 | 655483c4736026c20187274ea0ce7c91f12d683f |
| SHA256 | ad8240dadc312f54424a9abc542af4708314bf45df9f1599ca2400e2e724b1ce |
| SHA512 | de577b2436b00f800cd1cd7d52e36d3aeb7e5ef5e4e2dec96d865d28f9a4933cc67e7b57c767db68ce330d7ce0d7783e09e100997a9e8ca49a8cf15af390f449 |
C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log.62ZdIU5ix
| MD5 | 82940fb09b2f1aaa45e09678732a5cda |
| SHA1 | b75e1681b838926a35691c4e17ee6c802b5f26fd |
| SHA256 | 9781ee008e307c9087c19605b77014e9af26ea2b64da86291b73a040ab6094a4 |
| SHA512 | 3fd8d60d2a071909894b429e54b608696ccc75ca490ca9d7718b1f0b40f2d6697bf138ced8c98f8b8d2c17021efc4ab1d000669d08aecdb26a5d55527763f9eb |
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.62ZdIU5ix
| MD5 | 3648d0aca02d8efa810466d623bcf8ad |
| SHA1 | c9b0572b5f235c9986ebcf00714e51eab7a164e6 |
| SHA256 | acaec5cf05fdff31a113c17ede2519e31af7d2771f2a73a69db5f9d02834dc6b |
| SHA512 | 1c67e699a17c3820cdc1a34433a3445fbc41fe40880719d060e1d397899c546047535ac76d8848d2000e1be6bcf1f53d3df4cae636715be87fd72f92aad88caa |
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log.62ZdIU5ix
| MD5 | 96b21a9e23f98f41b40e4de2ed876dc9 |
| SHA1 | 8b11d8fe9a3119903dfe86b8cd443d43a41758b8 |
| SHA256 | cd97c4835cb6e76fa11495af5f166527c3b5c54a9a7125b6884039d07ebafe21 |
| SHA512 | 07f2c501541786d72d87fcf5a76847d0f57a6d67406d725f58aade626a00fdad706236972c90b3f42966dba78bb438ed52c2d90561537716a9e649c39d2fe2a5 |
C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log.62ZdIU5ix
| MD5 | 0981d66f020326b110975d246cc1e879 |
| SHA1 | e69c14e55b0a03c308fd0b892d3aa58e58b9f8bb |
| SHA256 | e9f83e92b8847bb1ed995458cb1f3db47e91c9f4d8deceedebdf15fa85e4e61c |
| SHA512 | 7862e6ebfa2900921983859e3c0caed0a9ab879be06663ffb1d9291d7b0592917fa89a00d6dcfbf19f57660d234555dc01ec935c1b2a9c0896182b6524724ab7 |
C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log.62ZdIU5ix
| MD5 | a95c5cf05886565570b1a6c043902f60 |
| SHA1 | 624fe06701413671ff677ed310df101fdc26e5b6 |
| SHA256 | e77b70d7b9c61f79f9c133240d29d1206f52ce76d7e1e4d2f20ecd228c722ff0 |
| SHA512 | 0d60ecdc0952e5c5ee03bc0b28bf55ace0e032d7f9bb156fc427f0ac753a056cb39a6c69b067328162a642307d5c9fed3f5d799d463446508bbc92ae34983c32 |
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log.62ZdIU5ix
| MD5 | 4c1e7be82105e7ee1f280bf6740f2daa |
| SHA1 | 86d747512178ab653f3c7174b575c5aac458f91c |
| SHA256 | 91561bd2ba2a687847113024391cddbdd3741326aecbf20b58a08e626c86af1f |
| SHA512 | b1c8a3c2d883bc9dbbbe85d07a1e16f210b4be1b47448c08201f38e520a911cfaa8d7f3385c1f164dd0fb3ddfac4540c1d0575477de0a2786bbf7ce507da95ad |
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log.62ZdIU5ix
| MD5 | 3d6258130855f4689ccbf9d2921724d6 |
| SHA1 | c87743baa769e2749066bfa0e11e975e3062672b |
| SHA256 | b070be84ba994f12850a352e2871d18cf20faae54f43829131baff43dc7372eb |
| SHA512 | 408879465566226d68353883000e698027dc9691601d40bac43967392914b81a2d90b866a55d78610cf8e3e134ab713c03179bec9f8c67256dd7e414b71ca88e |
C:\vcredist2010_x86.log.html.62ZdIU5ix
| MD5 | f95ce212a6866530fcf15cec064aae70 |
| SHA1 | 546ae22ff613d40215d978ebc792a195b60bbb85 |
| SHA256 | 1338ac4e3b85d3d670d8fdfe4a33b40b780f8b74d8997255ba0472d9a6fc0cd8 |
| SHA512 | 483a0b797be9075c77488e5f458e74af714a765d6578472e5c23fda1e7e47ade1d0f1dd92ffc9ad98c57fbc0b46f741be9ec21f932da1d1d8ef99884d71b4c25 |
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.62ZdIU5ix
| MD5 | fca4721f5597ed2b62e3480605c53906 |
| SHA1 | 2a5e8ac06005d839d9d57d069a6d33b6c3a827e1 |
| SHA256 | c158930660d357bbdb2c6f457957f1323ba4916fb39ed4e328422cc227c98038 |
| SHA512 | 3cebb785dc3c3bd53ce0ca9add399d59b227cb37d98427898ff5d12465713e5355e2f6df92a89375aea15669519d960630b50d939a184d62ecd9d28407f76b8b |
C:\vcredist2010_x64.log.html.62ZdIU5ix
| MD5 | d84d748cfc1741c8b9db2dbec355dbb9 |
| SHA1 | 30f0eea8372fb00587c5933048c4bf688b9fa9fa |
| SHA256 | a1691d2f6b67116ed81cad96825e741806c9b1f26f338af5d1e86f67a1369214 |
| SHA512 | 9e63b847ddfb11dd40da371c25ac6189c1d78aab3f03f945031537627637bd89ab8a315094b55cda42b0d3fcddc22047c53153f529cf0c38cef0b92e5120545d |
C:\vcredist2010_x64.log-MSI_vc_red.msi.txt.62ZdIU5ix
| MD5 | 587dd4810ce2a5038c1174336535b038 |
| SHA1 | 6376085674d8bcdf6182935a55eb7449a3e125fd |
| SHA256 | 7f85ff5aca075660496af11b000d1b0ea9b3b347d94a29d6ff120a57ee7d0fe2 |
| SHA512 | 65bb49750f77243dd2cd3c176d409d3071f20b834200468853da05c115b7b5e858c5edb352942181858f4bd67a068e7916875d55605938b9deb63a7065558c2d |
C:\62ZdIU5ix.README.txt
| MD5 | dd844fa8f294728b44502410c5d5006e |
| SHA1 | a74635673c92ac3113906dcc427a1f10b2863680 |
| SHA256 | 08abe702a210d4ee55c66b232e5f665cf23cbd17d48dac9431781590e575a582 |
| SHA512 | 13e9feabde6a41fc9f8d1ee9160fa5034336e85d966e1993ff544bc24f61cd4598305e06eeb58cc6e70f7b1056b89eb4039828ebd01839e7b15a587fcd0afdd5 |
memory/64-211-0x0000000000400000-0x0000000000407000-memory.dmp
memory/748-212-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3384-213-0x0000000000000000-mapping.dmp
memory/4032-214-0x0000000000000000-mapping.dmp
memory/4828-215-0x0000000000000000-mapping.dmp
memory/3104-216-0x0000000000000000-mapping.dmp
memory/4356-217-0x0000000000000000-mapping.dmp
memory/4072-218-0x0000000000000000-mapping.dmp
memory/2664-219-0x0000000000000000-mapping.dmp
memory/1812-220-0x0000000000000000-mapping.dmp
memory/3980-221-0x0000000000000000-mapping.dmp
memory/1812-222-0x0000000000400000-0x0000000000407000-memory.dmp
memory/420-223-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4776-224-0x0000000000000000-mapping.dmp