Malware Analysis Report

2024-10-16 03:22

Sample ID 220922-gjgt2sabf4
Target a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip
SHA256 b09403adcaf79f3602815c242b3698e43138156d848ac1b0802232d4afc36154
Tags
blackmatter ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b09403adcaf79f3602815c242b3698e43138156d848ac1b0802232d4afc36154

Threat Level: Known bad

The file a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip was found to be: Known bad.

Malicious Activity Summary

blackmatter ransomware spyware stealer

BlackMatter Ransomware

Blackmatter family

Executes dropped EXE

Modifies extensions of user files

Checks computer location settings

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Sets desktop wallpaper using registry

Program crash

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Modifies registry class

Modifies Control Panel

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Opens file in notepad (likely ransom note)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-09-22 05:49

Signatures

Blackmatter family

blackmatter

Analysis: behavioral1

Detonation Overview

Submitted

2022-09-22 05:49

Reported

2022-09-22 06:20

Platform

win7-20220812-en

Max time kernel

1633s

Max time network

1635s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-09-22 05:49

Reported

2022-09-22 06:20

Platform

win10v2004-20220901-en

Max time kernel

1393s

Max time network

1219s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip

Signatures

BlackMatter Ransomware

ransomware blackmatter

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\ProgramData\B5CE.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\ProgramData\C209.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\TraceResume.raw.OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File opened for modification C:\Users\Admin\Pictures\RedoPush.crw.OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
File opened for modification C:\Users\Admin\Pictures\SyncInstall.tiff.62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File opened for modification C:\Users\Admin\Pictures\SyncInstall.tiff C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
File opened for modification C:\Users\Admin\Pictures\SyncInstall.tiff C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File renamed C:\Users\Admin\Pictures\RedoPush.crw => C:\Users\Admin\Pictures\RedoPush.crw.OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File renamed C:\Users\Admin\Pictures\SyncInstall.tiff => C:\Users\Admin\Pictures\SyncInstall.tiff.OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File opened for modification C:\Users\Admin\Pictures\SyncInstall.tiff.OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File opened for modification C:\Users\Admin\Pictures\TraceResume.raw.OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
File opened for modification C:\Users\Admin\Pictures\SyncInstall.tiff C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
File renamed C:\Users\Admin\Pictures\SyncInstall.tiff => C:\Users\Admin\Pictures\SyncInstall.tiff.62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File opened for modification C:\Users\Admin\Pictures\TraceResume.raw.62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
File renamed C:\Users\Admin\Pictures\SyncInstall.tiff.62ZdIU5ix => C:\Users\Admin\Pictures\SyncInstall.tiff C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
File opened for modification C:\Users\Admin\Pictures\RedoPush.crw.OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File renamed C:\Users\Admin\Pictures\RedoPush.crw => C:\Users\Admin\Pictures\RedoPush.crw.62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File opened for modification C:\Users\Admin\Pictures\SyncInstall.tiff C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File opened for modification C:\Users\Admin\Pictures\TraceResume.raw.62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File opened for modification C:\Users\Admin\Pictures\SyncInstall.tiff.62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
File renamed C:\Users\Admin\Pictures\TraceResume.raw => C:\Users\Admin\Pictures\TraceResume.raw.OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File opened for modification C:\Users\Admin\Pictures\SyncInstall.tiff.OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
File renamed C:\Users\Admin\Pictures\SyncInstall.tiff.OwEGtgGxQ => C:\Users\Admin\Pictures\SyncInstall.tiff C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
File opened for modification C:\Users\Admin\Pictures\RedoPush.crw.62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File renamed C:\Users\Admin\Pictures\TraceResume.raw => C:\Users\Admin\Pictures\TraceResume.raw.62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File opened for modification C:\Users\Admin\Pictures\RedoPush.crw.62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\ProgramData\B5CE.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\ProgramData\C209.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\62ZdIU5ix.bmp" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\62ZdIU5ix.bmp" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WallPaper C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\OwEGtgGxQ.bmp" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\OwEGtgGxQ.bmp" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WallPaper C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\B5CE.tmp N/A
N/A N/A C:\ProgramData\C209.tmp N/A

Enumerates physical storage devices

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\62ZdIU5ix\DefaultIcon\ = "C:\\ProgramData\\62ZdIU5ix.ico" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OwEGtgGxQ\DefaultIcon C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OwEGtgGxQ\DefaultIcon\ = "C:\\ProgramData\\OwEGtgGxQ.ico" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\OWEGTGGXQ\DEFAULTICON C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.OwEGtgGxQ\ = "OwEGtgGxQ" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OwEGtgGxQ C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.62ZdIU5ix\ = "62ZdIU5ix" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\62ZdIU5ix\DefaultIcon C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\62ZDIU5IX\DEFAULTICON C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\62ZdIU5ix C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zG.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5092 wrote to memory of 2276 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe
PID 5092 wrote to memory of 2276 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe
PID 5092 wrote to memory of 2276 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe
PID 5092 wrote to memory of 2548 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 2548 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 2548 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 3512 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 3512 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 3512 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 3360 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 3360 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 3360 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 3928 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 3928 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 3928 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 3984 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 3984 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 3984 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 2760 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 2760 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5092 wrote to memory of 2760 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 2536 wrote to memory of 1316 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 2536 wrote to memory of 1316 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 4772 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe C:\ProgramData\B5CE.tmp
PID 4772 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe C:\ProgramData\B5CE.tmp
PID 4772 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe C:\ProgramData\B5CE.tmp
PID 4772 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe C:\ProgramData\B5CE.tmp
PID 64 wrote to memory of 3064 N/A C:\ProgramData\B5CE.tmp C:\Windows\SysWOW64\cmd.exe
PID 64 wrote to memory of 3064 N/A C:\ProgramData\B5CE.tmp C:\Windows\SysWOW64\cmd.exe
PID 64 wrote to memory of 3064 N/A C:\ProgramData\B5CE.tmp C:\Windows\SysWOW64\cmd.exe
PID 4936 wrote to memory of 3384 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe
PID 4936 wrote to memory of 3384 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe
PID 4936 wrote to memory of 3384 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe
PID 4936 wrote to memory of 4032 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 4032 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 4032 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 4828 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 4828 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 4828 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 3104 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 3104 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 3104 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 4356 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 4356 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 4356 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 4072 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 4072 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 4072 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 4936 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe
PID 5008 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe C:\ProgramData\C209.tmp
PID 5008 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe C:\ProgramData\C209.tmp
PID 5008 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe C:\ProgramData\C209.tmp
PID 5008 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe C:\ProgramData\C209.tmp
PID 1812 wrote to memory of 3980 N/A C:\ProgramData\C209.tmp C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 3980 N/A C:\ProgramData\C209.tmp C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 3980 N/A C:\ProgramData\C209.tmp C:\Windows\SysWOW64\cmd.exe
PID 4132 wrote to memory of 4776 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 4132 wrote to memory of 4776 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\" -spe -an -ai#7zMap30849:208:7zEvent23246

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build.bat"

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe

keygen -path C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build -pubkey pub.key -privkey priv.key

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_Rundll32.dll

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_Rundll32_pass.dll

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_ReflectiveDll_DllMain.dll

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe

"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2228 -ip 2228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 184

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe

"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\DECRYPTION_ID.txt.62ZdIU5ix

C:\ProgramData\B5CE.tmp

"C:\ProgramData\B5CE.tmp"

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe

"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B5CE.tmp >> NUL

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe

"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 748 -ip 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 228

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe

"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3660 -ip 3660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 228

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build.bat" "

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe

keygen -path C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build -pubkey pub.key -privkey priv.key

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_Rundll32.dll

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_Rundll32_pass.dll

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_ReflectiveDll_DllMain.dll

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe

"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe"

C:\ProgramData\C209.tmp

"C:\ProgramData\C209.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C209.tmp >> NUL

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\OwEGtgGxQ.README.txt

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe

"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe"

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe

"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 420 -ip 420

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 268

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe

"C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\Password_exe.txt

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\Password_dll.txt

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\config.json

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
NL 104.80.225.205:443 tcp
GB 51.132.193.104:443 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 204.79.197.200:443 tcp

Files

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build.bat

MD5 4e46e28b2e61643f6af70a8b19e5cb1f
SHA1 804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256 8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512 009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

memory/2276-136-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe

MD5 71c3b2f765b04d0b7ea0328f6ce0c4e2
SHA1 bf8ecb6519f16a4838ceb0a49097bcc3ef30f3c4
SHA256 ea6d4dedd8c85e4a6bb60408a0dc1d56def1f4ad4f069c730dc5431b1c23da37
SHA512 1923db134d7cee25389a07e4d48894dde7ee8f70d008cd890dd34a03b2741a54ec1555e6821755e5af8eae377ef5005e3f9afceb4681059bc1880276e9bcf035

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\keygen.exe

MD5 71c3b2f765b04d0b7ea0328f6ce0c4e2
SHA1 bf8ecb6519f16a4838ceb0a49097bcc3ef30f3c4
SHA256 ea6d4dedd8c85e4a6bb60408a0dc1d56def1f4ad4f069c730dc5431b1c23da37
SHA512 1923db134d7cee25389a07e4d48894dde7ee8f70d008cd890dd34a03b2741a54ec1555e6821755e5af8eae377ef5005e3f9afceb4681059bc1880276e9bcf035

memory/2548-139-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

MD5 c2bc344f6dde0573ea9acdfb6698bf4c
SHA1 d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
SHA512 d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\priv.key

MD5 b643b31d0fad8b816a566de682b9f9ac
SHA1 02f95943b1b6841366607892258728f171d5ea21
SHA256 0c91172845ef5ba3da0bd98de8a485f2676702e15e1d9d138d7be311c18346b9
SHA512 584c9b4cf9f8999861e0d27df20c950dc0dbf425e4a07042d5201e7751c2da21667aaefbc4374dd879ab5d133a198fc5ec0bd956ecaa28c1f9847b75dce61c71

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\config.json

MD5 a6ba7b662de10b45ebe5b6b7edaa62a9
SHA1 f3ed67bdaef070cd5a213b89d53c5b8022d6f266
SHA256 3f7518d88aefd4b1e0a1d6f9748f9a9960c1271d679600e34f5065d8df8c9dc8
SHA512 7fc9d4d61742a26def74c7dd86838482e3fc1e4e065cb3a06ae151e2c8614c9c36e8816ae0a3560ad5dd3cc02be131cb232c7deacc7f7b5a611e8eec790feea1

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

MD5 c2bc344f6dde0573ea9acdfb6698bf4c
SHA1 d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
SHA512 d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0

memory/3512-144-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

MD5 c2bc344f6dde0573ea9acdfb6698bf4c
SHA1 d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
SHA512 d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\pub.key

MD5 642e7a7907b04c58094b496357ceebd1
SHA1 9b8b1272c19d6f79cd7ee258503a1ff990b7e71a
SHA256 64acd213f8e7e63c90bd107e3f1f5595406f698842ba18faedcb213d14ae7827
SHA512 e11db46920bb0eff037a5b8c0c02df4fff70b765fbe0d475c5894844e3b8ad1113120874d7d94070a45d865d229868cf1c2871ade9cda3edf148c54950b6a844

memory/3360-147-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

MD5 c2bc344f6dde0573ea9acdfb6698bf4c
SHA1 d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
SHA512 d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0

memory/3928-149-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

MD5 c2bc344f6dde0573ea9acdfb6698bf4c
SHA1 d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
SHA512 d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0

memory/3984-151-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

MD5 c2bc344f6dde0573ea9acdfb6698bf4c
SHA1 d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
SHA512 d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0

memory/2760-153-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\builder.exe

MD5 c2bc344f6dde0573ea9acdfb6698bf4c
SHA1 d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
SHA512 d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe

MD5 9ae278eaeca72e000cca998bb30dbe36
SHA1 fabfa9ec9180968dfe0941246c82b9563ed1a8bd
SHA256 d9c93aee203a266fb0b2b077904d6bd9b23244b6e17b826c1f30b4df94e80b88
SHA512 8beec575b8d7d6f52c31b0572b428e13f161309531c93c28fd18ba476a1bafda1b485585ea5a51c94c3e9ea777c6c1ad97500adbd0ec6cde372c48b1f8905909

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3_pass.exe

MD5 9ae278eaeca72e000cca998bb30dbe36
SHA1 fabfa9ec9180968dfe0941246c82b9563ed1a8bd
SHA256 d9c93aee203a266fb0b2b077904d6bd9b23244b6e17b826c1f30b4df94e80b88
SHA512 8beec575b8d7d6f52c31b0572b428e13f161309531c93c28fd18ba476a1bafda1b485585ea5a51c94c3e9ea777c6c1ad97500adbd0ec6cde372c48b1f8905909

memory/2228-157-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe

MD5 9fa54c15b7983cd3b9dc88384cd4a5b0
SHA1 73a152eb067e949dc1a13b0b76f48ad670f46480
SHA256 fa30dc6dd4c05bbe7f5b923b93e2746ddadc85615eb3fb1e94a21f4c91410011
SHA512 ecb831275c0c55bffeb7c2192233b3e7bb2702c183d609aafb23f0ca70bee074bd3bcad99a10fffc790bb467ebc7e455a0825564f47a1797d4a5260de4bd0270

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3.exe

MD5 9fa54c15b7983cd3b9dc88384cd4a5b0
SHA1 73a152eb067e949dc1a13b0b76f48ad670f46480
SHA256 fa30dc6dd4c05bbe7f5b923b93e2746ddadc85615eb3fb1e94a21f4c91410011
SHA512 ecb831275c0c55bffeb7c2192233b3e7bb2702c183d609aafb23f0ca70bee074bd3bcad99a10fffc790bb467ebc7e455a0825564f47a1797d4a5260de4bd0270

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\BBBBBBBBBBB

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\AAAAAAAAAAA

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\OOOOOOOOOOO

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\NNNNNNNNNNN

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\MMMMMMMMMMM

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\LLLLLLLLLLL

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\KKKKKKKKKKK

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\JJJJJJJJJJJ

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\IIIIIIIIIII

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\HHHHHHHHHHH

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\GGGGGGGGGGG

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\FFFFFFFFFFF

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\EEEEEEEEEEE

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\DDDDDDDDDDD

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\CCCCCCCCCCC

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\VVVVVVVVVVV

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\UUUUUUUUUUU

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\TTTTTTTTTTT

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\YYYYYYYYYYY

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\XXXXXXXXXXX

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\WWWWWWWWWWW

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\SSSSSSSSSSS

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\RRRRRRRRRRR

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\QQQQQQQQQQQ

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\PPPPPPPPPPP

MD5 4fb52b66544ac904e4c82badffd5d6d6
SHA1 3053f3e5d1412a14aded86903e55dfcee179b6a5
SHA256 1fe811e12648145f170484f62f3694bf5c5c86d5f022fde6fbf4b969081d1068
SHA512 6bb89db7de28d1ad4293012e8b3bca3f4e236529551ca2a712780fae9d0f81f0b8637bbbb0827f8fed3e64ac98e570cb482c2877136353f063da416f31efdc01

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\Password_exe.txt

MD5 6726c79e0823177b6aaf8992c8bf67f5
SHA1 0b22d9b273ebdb05b24ebafe7c61bc35aedc753b
SHA256 c186fbb4cf5d8cc7049de11a9be58dbc65797ccbc395438f1df4180037155b40
SHA512 e030e0f137d417785d558f9d6029edebf3a6c8aaf6b58e338e79903f661c3e73766edf6f60f4671a458aee4d199d810e0fb12edee10a148d8b1fb32364492fa4

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\DECRYPTION_ID.txt

MD5 ddd8b26e1add752ededed260c8eb0da6
SHA1 d80fce6421860a7c9b554e515196b59182a679bc
SHA256 a3d56cb3d004cd66ff496af6ae7c585b682403bb27f7bf5df2f58c0a790d07b2
SHA512 9703ffa0c41da7e158effba702622bfb0ac99bd2913051e68eee3e99063c81a15b68f81e9e07c1cddd370e2f7b41ad896a448a0be38f6c43c285c18de6390389

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\Password_dll.txt

MD5 4b80b617c1455060ed5008eeb6624293
SHA1 cfa7f676ece915a7ad00af09359ac19973aa0bdb
SHA256 4f1bf2afefd9590395eab382a898872646abd3611c3158d42edb9dded5c3051d
SHA512 bebf2b92586cbf9e09128a31f0fac23a4cc6c25329432e88398d8551b41f84b41e5a7905d25374725062945f6bd457ccfb1c386a2f991a8995f4461fcad9ad3e

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\DECRYPTION_ID.txt.62ZdIU5ix

MD5 ddd8b26e1add752ededed260c8eb0da6
SHA1 d80fce6421860a7c9b554e515196b59182a679bc
SHA256 a3d56cb3d004cd66ff496af6ae7c585b682403bb27f7bf5df2f58c0a790d07b2
SHA512 9703ffa0c41da7e158effba702622bfb0ac99bd2913051e68eee3e99063c81a15b68f81e9e07c1cddd370e2f7b41ad896a448a0be38f6c43c285c18de6390389

memory/1316-190-0x0000000000000000-mapping.dmp

memory/64-191-0x0000000000000000-mapping.dmp

C:\ProgramData\B5CE.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

C:\ProgramData\B5CE.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe

MD5 703e39a6e26258db1616f2a662fc3cef
SHA1 af729a61819a7a8e4e761d22b4c672826768db13
SHA256 c560694875093f2b7defb132029b05c05e82f52ad16a5444de2396d52d1be843
SHA512 91e6c217c57e0b5738df9808b5d84fbfb51939f5fe1b776cb63aa38aba2f2bfb3adf0f5a82d673583c7879bcab52788cf9162812d6d59c2828ae92a79707daab

C:\Users\Admin\AppData\Local\Temp\a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d\LockBit30\Build\LB3Decryptor.exe

MD5 703e39a6e26258db1616f2a662fc3cef
SHA1 af729a61819a7a8e4e761d22b4c672826768db13
SHA256 c560694875093f2b7defb132029b05c05e82f52ad16a5444de2396d52d1be843
SHA512 91e6c217c57e0b5738df9808b5d84fbfb51939f5fe1b776cb63aa38aba2f2bfb3adf0f5a82d673583c7879bcab52788cf9162812d6d59c2828ae92a79707daab

memory/64-197-0x0000000000400000-0x0000000000407000-memory.dmp

memory/3064-196-0x0000000000000000-mapping.dmp

C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log.62ZdIU5ix

MD5 4ad47551cfdc9a9f4e78d2e5d6e79c6c
SHA1 655483c4736026c20187274ea0ce7c91f12d683f
SHA256 ad8240dadc312f54424a9abc542af4708314bf45df9f1599ca2400e2e724b1ce
SHA512 de577b2436b00f800cd1cd7d52e36d3aeb7e5ef5e4e2dec96d865d28f9a4933cc67e7b57c767db68ce330d7ce0d7783e09e100997a9e8ca49a8cf15af390f449

C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log.62ZdIU5ix

MD5 82940fb09b2f1aaa45e09678732a5cda
SHA1 b75e1681b838926a35691c4e17ee6c802b5f26fd
SHA256 9781ee008e307c9087c19605b77014e9af26ea2b64da86291b73a040ab6094a4
SHA512 3fd8d60d2a071909894b429e54b608696ccc75ca490ca9d7718b1f0b40f2d6697bf138ced8c98f8b8d2c17021efc4ab1d000669d08aecdb26a5d55527763f9eb

C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.62ZdIU5ix

MD5 3648d0aca02d8efa810466d623bcf8ad
SHA1 c9b0572b5f235c9986ebcf00714e51eab7a164e6
SHA256 acaec5cf05fdff31a113c17ede2519e31af7d2771f2a73a69db5f9d02834dc6b
SHA512 1c67e699a17c3820cdc1a34433a3445fbc41fe40880719d060e1d397899c546047535ac76d8848d2000e1be6bcf1f53d3df4cae636715be87fd72f92aad88caa

C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log.62ZdIU5ix

MD5 96b21a9e23f98f41b40e4de2ed876dc9
SHA1 8b11d8fe9a3119903dfe86b8cd443d43a41758b8
SHA256 cd97c4835cb6e76fa11495af5f166527c3b5c54a9a7125b6884039d07ebafe21
SHA512 07f2c501541786d72d87fcf5a76847d0f57a6d67406d725f58aade626a00fdad706236972c90b3f42966dba78bb438ed52c2d90561537716a9e649c39d2fe2a5

C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log.62ZdIU5ix

MD5 0981d66f020326b110975d246cc1e879
SHA1 e69c14e55b0a03c308fd0b892d3aa58e58b9f8bb
SHA256 e9f83e92b8847bb1ed995458cb1f3db47e91c9f4d8deceedebdf15fa85e4e61c
SHA512 7862e6ebfa2900921983859e3c0caed0a9ab879be06663ffb1d9291d7b0592917fa89a00d6dcfbf19f57660d234555dc01ec935c1b2a9c0896182b6524724ab7

C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log.62ZdIU5ix

MD5 a95c5cf05886565570b1a6c043902f60
SHA1 624fe06701413671ff677ed310df101fdc26e5b6
SHA256 e77b70d7b9c61f79f9c133240d29d1206f52ce76d7e1e4d2f20ecd228c722ff0
SHA512 0d60ecdc0952e5c5ee03bc0b28bf55ace0e032d7f9bb156fc427f0ac753a056cb39a6c69b067328162a642307d5c9fed3f5d799d463446508bbc92ae34983c32

C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log.62ZdIU5ix

MD5 4c1e7be82105e7ee1f280bf6740f2daa
SHA1 86d747512178ab653f3c7174b575c5aac458f91c
SHA256 91561bd2ba2a687847113024391cddbdd3741326aecbf20b58a08e626c86af1f
SHA512 b1c8a3c2d883bc9dbbbe85d07a1e16f210b4be1b47448c08201f38e520a911cfaa8d7f3385c1f164dd0fb3ddfac4540c1d0575477de0a2786bbf7ce507da95ad

C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log.62ZdIU5ix

MD5 3d6258130855f4689ccbf9d2921724d6
SHA1 c87743baa769e2749066bfa0e11e975e3062672b
SHA256 b070be84ba994f12850a352e2871d18cf20faae54f43829131baff43dc7372eb
SHA512 408879465566226d68353883000e698027dc9691601d40bac43967392914b81a2d90b866a55d78610cf8e3e134ab713c03179bec9f8c67256dd7e414b71ca88e

C:\vcredist2010_x86.log.html.62ZdIU5ix

MD5 f95ce212a6866530fcf15cec064aae70
SHA1 546ae22ff613d40215d978ebc792a195b60bbb85
SHA256 1338ac4e3b85d3d670d8fdfe4a33b40b780f8b74d8997255ba0472d9a6fc0cd8
SHA512 483a0b797be9075c77488e5f458e74af714a765d6578472e5c23fda1e7e47ade1d0f1dd92ffc9ad98c57fbc0b46f741be9ec21f932da1d1d8ef99884d71b4c25

C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.62ZdIU5ix

MD5 fca4721f5597ed2b62e3480605c53906
SHA1 2a5e8ac06005d839d9d57d069a6d33b6c3a827e1
SHA256 c158930660d357bbdb2c6f457957f1323ba4916fb39ed4e328422cc227c98038
SHA512 3cebb785dc3c3bd53ce0ca9add399d59b227cb37d98427898ff5d12465713e5355e2f6df92a89375aea15669519d960630b50d939a184d62ecd9d28407f76b8b

C:\vcredist2010_x64.log.html.62ZdIU5ix

MD5 d84d748cfc1741c8b9db2dbec355dbb9
SHA1 30f0eea8372fb00587c5933048c4bf688b9fa9fa
SHA256 a1691d2f6b67116ed81cad96825e741806c9b1f26f338af5d1e86f67a1369214
SHA512 9e63b847ddfb11dd40da371c25ac6189c1d78aab3f03f945031537627637bd89ab8a315094b55cda42b0d3fcddc22047c53153f529cf0c38cef0b92e5120545d

C:\vcredist2010_x64.log-MSI_vc_red.msi.txt.62ZdIU5ix

MD5 587dd4810ce2a5038c1174336535b038
SHA1 6376085674d8bcdf6182935a55eb7449a3e125fd
SHA256 7f85ff5aca075660496af11b000d1b0ea9b3b347d94a29d6ff120a57ee7d0fe2
SHA512 65bb49750f77243dd2cd3c176d409d3071f20b834200468853da05c115b7b5e858c5edb352942181858f4bd67a068e7916875d55605938b9deb63a7065558c2d

C:\62ZdIU5ix.README.txt

MD5 dd844fa8f294728b44502410c5d5006e
SHA1 a74635673c92ac3113906dcc427a1f10b2863680
SHA256 08abe702a210d4ee55c66b232e5f665cf23cbd17d48dac9431781590e575a582
SHA512 13e9feabde6a41fc9f8d1ee9160fa5034336e85d966e1993ff544bc24f61cd4598305e06eeb58cc6e70f7b1056b89eb4039828ebd01839e7b15a587fcd0afdd5

memory/64-211-0x0000000000400000-0x0000000000407000-memory.dmp

memory/748-212-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3384-213-0x0000000000000000-mapping.dmp

memory/4032-214-0x0000000000000000-mapping.dmp

memory/4828-215-0x0000000000000000-mapping.dmp

memory/3104-216-0x0000000000000000-mapping.dmp

memory/4356-217-0x0000000000000000-mapping.dmp

memory/4072-218-0x0000000000000000-mapping.dmp

memory/2664-219-0x0000000000000000-mapping.dmp

memory/1812-220-0x0000000000000000-mapping.dmp

memory/3980-221-0x0000000000000000-mapping.dmp

memory/1812-222-0x0000000000400000-0x0000000000407000-memory.dmp

memory/420-223-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4776-224-0x0000000000000000-mapping.dmp