lockbit | 129eb76ff1420e8484f55641518924812662bd50af797067262082829043b9cc

Analysis

max time kernel
331s
max time network
530s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 08:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f4ac4d7bbd9998071b17ef30d3cb7e4126db06cdcc0c4b3548a01012a00fd1f5
Size 58KB
Sample240309-kst3hsfb7t
SHA256 f4ac4d7bbd9998071b17ef30d3cb7e4126db06cdcc0c4b3548a01012a00fd1f5
MD5 eeadfcccb6d95dc04d81f68ae7865f8b
SHA1 2f78abc001534e28eb208a73245ce5389c40ddbe
SHA512 6cdbf64ea30a47d4a6c757a0a8c0e57cf7b6e31806651508d9b350413893997f3682ed2b0a99788ff497be38c8466a976938ab7bc73efbd46d4b0286b4280bcd
SSDEEP 768:TKGA9gxT1Q6fAMmLtn+gCYeXwtI7TKTZID1njtVPjRsFyV8amvl0ZOcv/k/tJpdx:Ty9gZydLmT8q57sFGovl03e3Dx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit ransomware

Malware Config

Extracted

Path

C:\P0s5GuiYn.README.txt

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: B7568014A48684D6D525F3F3722638C4 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

Emails

URLs

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
behavioral3/files/0x00050000000194a4-361.dat	family_lockbit

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2872	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
804	chrome.exe
804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	364	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	364	AUDIODG.EXE
Token: 33	364	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	364	AUDIODG.EXE
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe
Token: SeShutdownPrivilege	804	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe
804	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 1964	804	chrome.exe	34
PID 804 wrote to memory of 1964	804	chrome.exe	34
PID 804 wrote to memory of 1964	804	chrome.exe	34
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2908	804	chrome.exe	36
PID 804 wrote to memory of 2124	804	chrome.exe	37
PID 804 wrote to memory of 2124	804	chrome.exe	37
PID 804 wrote to memory of 2124	804	chrome.exe	37
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38
PID 804 wrote to memory of 2676	804	chrome.exe	38

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\f4ac4d7bbd9998071b17ef30d3cb7e4126db06cdcc0c4b3548a01012a00fd1f5
1⤵
PID:2072

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x584
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef62d9758,0x7fef62d9768,0x7fef62d9778
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:2
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1400 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2336 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:1
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2348 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:1
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2012 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:2
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1556 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3836 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3452 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=808 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:8
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3304 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=1472,i,5430892313915325943,8240960716001938044,131072 /prefetch:8
  2⤵
  PID:2576

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1680

C:\Users\Admin\Downloads\LockBit-main\LockBit-main\builder.exe
"C:\Users\Admin\Downloads\LockBit-main\LockBit-main\builder.exe"
1⤵
PID:780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:572
- C:\Users\Admin\Downloads\LockBit-main\LockBit-main\keygen.exe
  keygen -path Build -pubkey pub.key -privkey priv.key
  2⤵
  PID:1968
- C:\Users\Admin\Downloads\LockBit-main\LockBit-main\builder.exe
  builder -type dec -privkey Build\priv.key -config config.json -ofile Build\LB3Decryptor.exe
  2⤵
  PID:1724
- C:\Users\Admin\Downloads\LockBit-main\LockBit-main\builder.exe
  builder -type enc -exe -pubkey Build\pub.key -config config.json -ofile Build\LB3.exe
  2⤵
  PID:2500
- C:\Users\Admin\Downloads\LockBit-main\LockBit-main\builder.exe
  builder -type enc -exe -pass -pubkey Build\pub.key -config config.json -ofile Build\LB3_pass.exe
  2⤵
  PID:2548
- C:\Users\Admin\Downloads\LockBit-main\LockBit-main\builder.exe
  builder -type enc -dll -pubkey Build\pub.key -config config.json -ofile Build\LB3_Rundll32.dll
  2⤵
  PID:1152
- C:\Users\Admin\Downloads\LockBit-main\LockBit-main\builder.exe
  builder -type enc -dll -pass -pubkey Build\pub.key -config config.json -ofile Build\LB3_Rundll32_pass.dll
  2⤵
  PID:2384
- C:\Users\Admin\Downloads\LockBit-main\LockBit-main\builder.exe
  builder -type enc -ref -pubkey Build\pub.key -config config.json -ofile Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  PID:2692

C:\Users\Admin\Downloads\LockBit-main\LockBit-main\Build\LB3.exe
"C:\Users\Admin\Downloads\LockBit-main\LockBit-main\Build\LB3.exe"
1⤵
PID:1896
- C:\ProgramData\511D.tmp
  "C:\ProgramData\511D.tmp"
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\511D.tmp >> NUL
    3⤵
    PID:948

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\P0s5GuiYn.README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2872

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:1112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x154
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini
Size 129B
SHA256 02a300a2972adff46232e71b8b2de8929bcb4965011384bd7a90e5cbd3fd2b43
MD5 278f2eed6226533afdab88dd83b28392
SHA1 4db03882c58efc2bc01520d07817cb4d617bd316
SHA512 4a600c3f858fe89d4d1dc12815e1b1e4510282fae831f437ed6017f200ac4e761144317aa3975599bc6884f4b77af1190f4cfc4e745e0ad44cb8ed42c0f87c78
MD5 SHA1 SHA512

Submit Download

P0s5GuiYn.README.txt

Path C:\P0s5GuiYn.README.txt
Size 6KB
SHA256 b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
MD5 dd746ace17e44ace00885b91400f11d5
SHA1 4a0302d2dca400598f396e4230fdae71779cbeaa
SHA512 8ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1
SSDEEP 192:uWo127U5RbnfuoHVMemUMHGU+d8EQv8lfziY9B8N27U5RbnfuoHVMmmUMHl:ZoUSnYxlAiYscSpYF
MD5 SHA1 SHA512 SSDEEP

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 67KB
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
SSDEEP 1536:4vHkVfDISE//aDY0WAXTF+0daIpyFQaqPZkatNjgkFOE4/JZZWnEn6:4vHKfMSeKFXdBcmnXkksE40E6
MD5 SHA1 SHA512 SSDEEP

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 9d75221443945188ddda34d2194ae25b3f490bf205f2932b74efb0fdf185bfe1
MD5 4d3a9152f1f1f51fcfd9cb64a70c612f
SHA1 ba91848ab02dcf2fcb787870f486f2420627b064
SHA512 e85571d6cb4b84059849e9a4e327c86def9b5ab761bb13f1e973f44f6f00f05914d994a4330e8b183b3ba48b0407d18743a512bb2189c7a8c013441468397c6a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f46d8cdf1812d342e3b49ee242fdba78935d597ccdf86989d165e28696cf62b7
MD5 ecd8ebd0d441c0b49b641fbcd5444d17
SHA1 75760164655f0e440880cfb868a10a01b67b6c90
SHA512 99913f343bc9df93bcd6d789c4ddb2378e7f49778836e844bee55de79a98c39a9793331a22c2e6b6f171fd3289c77586a4e32b9d9bbcefd68a0029f6d11d2256
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 194KB
SHA256 845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6
MD5 f5b4137b040ec6bd884feee514f7c176
SHA1 7897677377a9ced759be35a66fdee34b391ab0ff
SHA512 813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40
SSDEEP 6144:e7sHFbHCRoslPSywl9fGm+a8pvt6/UVxuxNsPgu0xQN0:ewlbiisRlwl9fGva8dtQUVxu/Huz0
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 ff77c562957747a8493574be31f053fbf6986a4e5297cfca8382bfeb3f71fe73
MD5 60c898664e3a3d17bc4153d35b4aabd7
SHA1 7ab1486778a7916dbf24ba6d4faceb3acaeb082c
SHA512 c93d8ae8a33aeccf24bc2871d69a150c157ad148b458db634612ab0d70a96222256469c0a901f1c9da0990c78989dcfba21fa0577037158a3dde8ffd9bc41d70
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8939098f54071b16cc9572d992c6accb52326cb286354679f02456c506aef37d
MD5 767d57a366011bcd56aae35e6dd30c09
SHA1 c4e2854b46902acd18d1beaf60ff0ae6d6f64ec9
SHA512 ef93b949490db6ad386f0ff1f834eed5c8e9228ae7d59fb3f1e8c3acdcb2d062f081dc6e535feaa363a2b0e6cf96c594071cb66f55be7f049a7c14f50f6ec4f6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 74ea3e6e259b62b7467f2dc54c3f8228bd52d9fb3b2d990cb4c0606a06f58517
MD5 ca091dc76ee90d17edeaa5e53eab20c8
SHA1 a7515ccdffd31ff3940e427c9b0f751634caa7d8
SHA512 b6577476ec1786107b464d8cfa820c792208679d7dbd32a765c411354f6fdaf72e582b4b37b6e26152c8d01f473f714330fd6d9547f120e2f3640d9b25873265
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 363B
SHA256 44d141f65cd39a46a3f04dc2b74de8061bdfc63b448acc613823ccb11d58f621
MD5 071ba5b0ef9511967ceb4cd9c5173fc0
SHA1 7da32d9a113e026665083273269400c2d94f1ef6
SHA512 fc539dd64b2432245b55b682d706ab63c6fdd8b579a032f7634f5a2dda2e0d989fa3d73e6db7887301aea00d00843ddb01e00f7d3724d2a6f015aed89618b118
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 526B
SHA256 df55509ed4f7c965229431b0eaaaaf615cd05205e05c2d203c9be2f4fb5e5922
MD5 ef0585a9d5264cdffb9c860025bf9c76
SHA1 48ac2ed9d31908184587b7a7c3fb08156543b7a4
SHA512 0ef16a77db369f1d9fbb53e037e90e74914f2f2f4a3743f8e34437005757c90273578aa5410b252125a247b828b67f8a7d8b16aaf0b6869a7984ee29ac6b4a00
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 524B
SHA256 e374bed9e9671acb030297102fa66404d70cd081fc27150c9c97053d84d9ee54
MD5 a9e1b617dc1937fd65416208c7c835ba
SHA1 0b6b2caa2656833c29a16b112ddaed1096d7b619
SHA512 53f9e48596d39bc0ad534a08281bd174c48548f4e97e78bedb82b4af479b7102fb5f17a31a98b3ad9f18dc643a0b989d21720367451389bb800560ccd940864c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 363B
SHA256 4af307f55cc14b69a13cfe27203ca7fce2e59648ba8a300b4529746094728cce
MD5 d855614d42e0531330c47d0dcd594f62
SHA1 2045353a3b628ce87860127ea292b15aea3f89ab
SHA512 036ff8bc8fa591c6395d4c6d8f8a9754e0e0e4c7bd1be6563c52f5cf5e82b9b3d71afd5fa0171058d638cb088aa7323d1724288428c74f6a0aa56a81a8f72668
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 59463176de96b99c2f36a9fea659110b7c946792d65a0d75a461a8d0fb92dd86
MD5 64f0cb1150efa64c390ca4db063559e4
SHA1 1ade3ecd0a4ca3720d7c6bb12bd845c283504e24
SHA512 fcf249281f7a935076163b87300676fa30504c8ceb8de67f3cb15889d0716da084d8688bd8b28127f9affca147e077884a79b1a2090c76063a7e770015127ed0
SSDEEP 96:tMluKI5dd8iZRy7Di+6Msmde0kbjEOvvXUOjV39:t2uX8syy+FjkbiOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 e008fdb0f83a44379c1f97a40b69150f181e2dfb03a39b4a4b3b3d4b60b5140d
MD5 c6af2ba06d789e59fdf2c5a3fabba3f0
SHA1 cafa6fdedd8016a6eaff7654d531a6bbc0e5f56d
SHA512 0dff17461be9c77a6691f76d5e101550c706da53ec9e81baffc4bfc5c6a03d00e7c63a0186106689252d5cd4f8a1db5dff9b8f8a0b7a5f239b6d675c48557d8a
SSDEEP 96:tMluKI5dd8iZRy7Di+6MsmdedkkMFNOvvXUOjV39:t2uX8syy+Fmkk2Ob
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 83535e9b6ed024e55a5883987534ffc9f116bc06feaeb0288553783dbdb6e33b
MD5 4e887d7048a7d3f1efea6f893b97c120
SHA1 21c013b75792c91a490d13a006692ec07e181e09
SHA512 e510cb964b6bce0ab2131a75a970580556d46e17f3fe7e41e49cf865c9d2517b37b90bc9f8b36cec9349cfe9eaa6cf7fca6f59975d0cae1ed8a581f22c4eaeae
SSDEEP 96:tMluKI5dd8iZRy7Di+6Msmde6kFvHOvvXUOjV39:t2uX8syy+FRkFvOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 9417bc6c6b63701e571cf42110c70821d703ed34c7ef1e0e547e970a3e60e758
MD5 632f23bf62bba3cad1db25704e67161e
SHA1 e3cab0046b142594ca0bfe7652a02b9fde86fa15
SHA512 1710ecd555e8832f2207432d6fa2b4636472cbecd6dc445e659df8b8a522850afc5d293f3aa86512e209a426a28ef6a8dc1537ad2443c00bf2cc0acbb8122719
SSDEEP 96:tMluKI5dd8iZRy7Di+6MsmdeHIOvvXUOjV39:t2uX8syy+FOaOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 3957920fe6949de6de3d79ff67351d61ece5b52c1a0962fb5ba82dffde97563a
MD5 eabd4be540caa0b3a4b3ff5319939891
SHA1 43356d91811f13b71cbb0fdbcad9b2378783d46e
SHA512 b82a6b88a85b722ae429a2e417950ae46b2817397cd525306165f1c83f53ea6741c09d80d62dd590c390019e4a9e71108daf1eca00f59c548e1cc133bf862d3d
SSDEEP 96:tMluKI5dd8iZRy7Di+6M5Rgmde54kMENkFvYhOvvXUOjV39:t2uX8syy+F5i4kMskFgVOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

000007.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Size 16B
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
MD5 SHA1 SHA512

Submit Download

font_unique_name_table.pb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\font_unique_name_table.pb
Size 125KB
SHA256 27fa2852b6a67f300a93ea3bf253a5e4506eefad8de790795aa3a5a814a032a6
MD5 b5e0aca761903acf77a6d900f9eb3e98
SHA1 b4176b1c1bcec8163c2f51b7ab3040b1abab7fcf
SHA512 a974a4c610ec57c85959b572ba21f7078a4d222598bf2745d61e2b8274c787462ca4549f63ca90d209efe37cc56c9294191321c4c6eb6d2a7b8a4a2cf5a53240
SSDEEP 3072:siwDLCETShw0xD+pRyQVMI7MStvgxokAdlXoJUSo4mTZyUw5vdeYkMnDCACBMmWK:siwDLCETShw0xD+pRyOMI7MStvgxokAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 14B
SHA256 4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d
MD5 9eae63c7a967fc314dd311d9f46a45b7
SHA1 caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf
SHA512 bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 258KB
SHA256 ee813e851d663d6d6d797afc48eda95972d99fe3bd4ea377e696a324506a4918
MD5 c5163bdd2a1042a27b7669fdc5ec2457
SHA1 7aa806569e67bdb1d5fd116158b7e62918ddb034
SHA512 dad8d5dcc420f00a7bc7b39638d1b5d91b8268e015a8cc5d0c052a8a5a3258b0b8273fa32d65d46f4e23332af8a49acab94be317928fb3d0c0d6c3103a0984b3
SSDEEP 6144:+ZpCEbbN+1mae3oNOO1D7ZC7OGq/DDgvfApOKb8I/bgdU:OC+Nqmafz7WOdngvf/obgdU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 81KB
SHA256 db0dc2a7c77da82bad831191e3f4cdef5d10fed798af4399cc387efc02256a81
MD5 cdcb0b6501795a341a95e50e6a703937
SHA1 8599db614c21d928c453fbef36a4bed097378091
SHA512 66fd1fe11ff0c53cc0816a33880addb6453cffdd764f5ba45c46f9c33c08d9b589478ef2eec7e892254b15315f00a990963fa834ea414e7e8de23c59e84152b2
SSDEEP 384:gj7nbY5+YkpXf2B89Xx+Ax/JNntn7v9nB54xi6HLzLrFGpX//nApLpKR+F5t4USu:sU+YQ/y7J28CrI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 74KB
SHA256 fa6f0f4353a6381ba682c1ab5fa67ff3c6d9d61a934891b7e9f445939aada78f
MD5 f89934e2834341fc7a64cfdd1a143199
SHA1 358ad75a40726c3517b044c46422d80bf5ea7d3c
SHA512 8b2ac4b83e700cc861dad9b2332206cdd7fd2b091bb51d386680e840d2274b3b6aee75fd2c174350efa6409ba1111387a61ca7bd10bdcc60b8ab2323f46028d9
SSDEEP 384:UbY5+YkpXNB89Xx+AT/JNnt5v9nB54xi6HLzLrFGpX//nApLpKR+F5t4USCHHKHs:L+YJfy7J2fCJb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
MD5 SHA1 SHA512

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Tar2B9A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar2B9A.tmp
Size 175KB
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
SSDEEP 1536:DAuJ+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mr:D9J+qTR0XCy/dmASru2Aijbd0
MD5 SHA1 SHA512 SSDEEP

Submit Download

LockBit-main.zip.crdownload

Path C:\Users\Admin\Downloads\LockBit-main.zip.crdownload
Size 292KB
SHA256 707bb3b958fbf4728d8a39b043e8df083e0fce1178dac60c0d984604ec23c881
MD5 68309717a780fd8b4d1a1680874d3e12
SHA1 4cfe4f5bbd98fa7e966184e647910d675cdbda43
SHA512 e16de0338b1e1487803d37da66d16bc2f2644138615cbce648ae355f088912a04d1ce128a44797ff8c4dfc53c998058432052746c98c687670e4100194013149
SSDEEP 6144:n42LBVCsV+PkMeW9zTiY/NaQmHst5ySPzmcfIMwmafvR:n4EzwkMeWgY1NmyESPB1/aXR
MD5 SHA1 SHA512 SSDEEP

Submit Download

DECRYPTION_ID.txt

Path C:\Users\Admin\Downloads\LockBit-main\LockBit-main\Build\DECRYPTION_ID.txt
Size 16B
SHA256 2f5d5aaa852664dde2b4edcdee1f2611342a628acea07076ceb9f855f8f20dda
MD5 d05c2f7a1657671848b238a01c911a23
SHA1 5931d62fb316e6bcfd67347d00fe91f4106e47c6
SHA512 d10e332f4d2c4be32aa3a55d2c5a8863cff16f2c78c7c217e38eeff09177184539ded78950bd536bd3e00959578b3975d2b4163b013550f1541a58b9da2b2537
MD5 SHA1 SHA512

Submit Download

LB3.exe

Path C:\Users\Admin\Downloads\LockBit-main\LockBit-main\Build\LB3.exe
Size 153KB
SHA256 835bca2aa789e1437455f793e88c666b2e646276e18de971bce838e64fce326c
MD5 f67e8c0e658bde09bca32312a3ae1abc
SHA1 c1a348d56f7053990fc18d60a04788c4f94484b6
SHA512 8ffe933a032b2414aa891988bdebf3b186c712b412ffd3e15be66e4cfe1c8c563c153539293833cfefccbb5926fafd23a24a2cf4155d931f27dceed62097f0c7
SSDEEP 3072:wbCA9rYFk12kuIQkitbCA9rYFk12kuIQkitbCAi:g9rYF62/kK9rYF62/kKi
MD5 SHA1 SHA512 SSDEEP

Submit Download

LB3.exe

Path C:\Users\Admin\Downloads\LockBit-main\LockBit-main\Build\LB3.exe
Size 153KB
SHA256 19edb104105b74186253b9d482f42c0287e1036e3738e061f0a4958e4b0bb7a4
MD5 4342f94710b1a2c7dc39b5610794bc41
SHA1 83e1f46f5b2cfe7a8f229ccdae159c93b64227ff
SHA512 30a36e1b1dd21aacf48a1c3e6610179a2a88e814efc5d6f2176de9c743b726eb4e0ac7f73340fb3e58ed9d6625d1900480b39bf1a754ac63455b84f1356c3c78
SSDEEP 3072:+qJogYkcSNm9V7DLP1JmTyYSDv2t7V9thV7dT:+q2kc4m9tDBJmda8Nj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Password_dll.txt

Path C:\Users\Admin\Downloads\LockBit-main\LockBit-main\Build\Password_dll.txt
Size 1KB
SHA256 40104ff6a2daf0c36a053defa34b943f094883179cd939bfc7612742d87c0781
MD5 bd6d0e6302829615c64690d96461b1ab
SHA1 241339416623f87e69e3f76369f8f609ac3cf7fb
SHA512 2db5321be87da70a605fd47432290699a8dfad52a1e213d993015c7e9ef63a67dc5f0d53dab9087b0666a026f769cbf3e38a3d4a86534e1b221dbb4c781d7f19
MD5 SHA1 SHA512

Submit Download

Password_exe.txt

Path C:\Users\Admin\Downloads\LockBit-main\LockBit-main\Build\Password_exe.txt
Size 2KB
SHA256 325c46f4ebdeceb139adce045269dc4d6d14f3de90247df56925cf13d3be2cfa
MD5 be16d0f6230f545fa52ba6cfd35fa414
SHA1 a516945799a5283c2a25a912516a1f556f5f825f
SHA512 a8c70c7a3d5f429f503603b5c284b706421682c5149dbede83689bbff006208535ad2a4bc9b50ad705f267135c6b929a1a2ce692bf59bf05ef5d7abba679e21c
MD5 SHA1 SHA512

Submit Download

priv.key

Path C:\Users\Admin\Downloads\LockBit-main\LockBit-main\Build\priv.key
Size 344B
SHA256 d28f2c3b5cd0adc9faf290e6715f9f58ebf75c69cf2076af362b155a3c8bf804
MD5 20bc88da2ba6c12a5b4b8cc1a86e6fbc
SHA1 28caa7d20321ff9ee33c2f65d83c5b4ed959516b
SHA512 3d91b63f22711f5f9ec7dca352d03579f8103db9a5889fb68bc1a46c72105e76e3f2611cbb005c2066ba454d651e0daab92945d9b8194f6505225d42caffea72
MD5 SHA1 SHA512

Submit Download

pub.key

Path C:\Users\Admin\Downloads\LockBit-main\LockBit-main\Build\pub.key
Size 344B
SHA256 18906ae415d9f28971988ddbc15e81a3ab44fc0f0b77a52f1130dcae67d32d56
MD5 9db65b69ca859a3ac04afb24819b6819
SHA1 f92e06a970dfc12aac3793463d8be4e7fa5deef3
SHA512 fb52217713322a8b0381545c73e81abfbe825dd19d0838d5c5309db96edc4a210878cc6b0b033e465c6a74b2f26c28e5e95b599cce4a99b7a3a2596845c589c7
MD5 SHA1 SHA512

Submit Download

DDDDDDDDDDD

Path F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\DDDDDDDDDDD
Size 129B
SHA256 fc754f20369f3d739a99271870c01bb1375cbbad09ad33bdea1b08f10415ab94
MD5 b1b8c366df645cc3e574a21cc1159e4a
SHA1 3f15147ecdb1a35308563c454ff055732dc1b092
SHA512 ee1b8f6d2e82bb83422ca367621a9a9e0a6ea6e8ab018e8aaa4d7e5491a87774f0eb89175039b3b534013827e1d5a8a28bd637bce64ad89549a1a8282b3946f5
MD5 SHA1 SHA512

Submit Download

511D.tmp

Path \ProgramData\511D.tmp
Size 14KB
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1112-1269-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/1112-1268-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/1896-362-0x0000000000F70000-0x0000000000FB0000-memory.dmp

Download

memory/2936-1232-0x0000000000380000-0x00000000003C0000-memory.dmp

Download

memory/2936-1237-0x000000007EF80000-0x000000007EF81000-memory.dmp

Download

memory/2936-1260-0x000000007EF20000-0x000000007EF21000-memory.dmp

Download

memory/2936-1266-0x000000007EF60000-0x000000007EF61000-memory.dmp

Download

memory/2936-1265-0x000000007EF40000-0x000000007EF41000-memory.dmp

Download

memory/2936-1235-0x0000000000380000-0x00000000003C0000-memory.dmp

Download

memory/2936-1231-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download