lockbit | 707bb3b958fbf4728d8a39b043e8df083e0fce1178dac60c0d984604ec23c881

Resubmissions

02-01-2025 17:47

250102-wctmlasqdn 10

02-01-2025 17:37

250102-v7dn7asnel 10

31-12-2024 15:09

241231-sjtdmaylbk 10

31-12-2024 14:28

241231-rtcm7axjej 10

Analysis

max time kernel
749s
max time network
753s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
02-01-2025 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LockBit-main.zip
Size

292KB
MD5

68309717a780fd8b4d1a1680874d3e12
SHA1

4cfe4f5bbd98fa7e966184e647910d675cdbda43
SHA256

707bb3b958fbf4728d8a39b043e8df083e0fce1178dac60c0d984604ec23c881
SHA512

e16de0338b1e1487803d37da66d16bc2f2644138615cbce648ae355f088912a04d1ce128a44797ff8c4dfc53c998058432052746c98c687670e4100194013149
SSDEEP

6144:n42LBVCsV+PkMeW9zTiY/NaQmHst5ySPzmcfIMwmafvR:n4EzwkMeWgY1NmyESPB1/aXR

Score

10^/10

lockbit discovery phishing ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\LockBit-main\config.json

Ransom Note

{ "bot": { "uid": "00000000000000000000000000000000", "key": "00000000000000000000000000000000" }, "config": { "settings": { "encrypt_mode": "auto", "encrypt_filename": false, "impersonation": true, "skip_hidden_folders": false, "language_check": false, "local_disks": true, "network_shares": true, "kill_processes": true, "kill_services": true, "running_one": true, "print_note": true, "set_wallpaper": true, "set_icons": true, "send_report": false, "self_destruct": true, "kill_defender": true, "wipe_freespace": false, "psexec_netspread": false, "gpo_netspread": true, "gpo_ps_update": true, "shutdown_system": false, "delete_eventlogs": true, "delete_gpo_delay": 1 }, "white_folders": "$recycle.bin;config.msi;$windows.~bt;$windows.~ws;windows;boot;program files;program files (x86);programdata;system volume information;tor browser;windows.old;intel;msocache;perflogs;x64dbg;public;all users;default;microsoft", "white_files": "autorun.inf;boot.ini;bootfont.bin;bootsect.bak;desktop.ini;iconcache.db;ntldr;ntuser.dat;ntuser.dat.log;ntuser.ini;thumbs.db;GDIPFONTCACHEV1.DAT;d3d9caps.dat", "white_extens": "386;adv;ani;bat;bin;cab;cmd;com;cpl;cur;deskthemepack;diagcab;diagcfg;diagpkg;dll;drv;exe;hlp;icl;icns;ico;ics;idx;ldf;lnk;mod;mpa;msc;msp;msstyles;msu;nls;nomedia;ocx;prf;ps1;rom;rtp;scr;shs;spl;sys;theme;themepack;wpx;lock;key;hta;msi;pdb;search-ms", "white_hosts": "WS2019", "kill_processes": "sql;oracle;ocssd;dbsnmp;synctime;agntsvc;isqlplussvc;xfssvccon;mydesktopservice;ocautoupds;encsvc;firefox;tbirdconfig;mydesktopqos;ocomm;dbeng50;sqbcoreservice;excel;infopath;msaccess;mspub;onenote;outlook;powerpnt;steam;thebat;thunderbird;visio;winword;wordpad;notepad;calc;wuauclt;onedrive", "kill_services": "vss;sql;svc$;memtas;mepocs;msexchange;sophos;veeam;backup;GxVss;GxBlr;GxFWD;GxCVD;GxCIMgr", "gate_urls": "https://test.white-datasheet.com/;http://test.white-datasheet.com/", "impers_accounts": "ad.lab:Qwerty!;Administrator:123QWEqwe!@#;Admin2:P@ssw0rd;Administrator:P@ssw0rd;Administrator:Qwerty!;Administrator:123QWEqwe;Administrator:123QWEqweqwe", "note": " ~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: B7568014A48684D6D525F3F3722638C4 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly" } }

Emails

[email protected]

URLs

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion

http://lockbitapt.uz

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

https://twitter.com/hashtag/lockbit?f=live

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000400000000f4c8-831.dat	family_lockbit
behavioral1/files/0x0008000000024fbf-1130.dat	family_lockbit
behavioral1/files/0x000400000002501c-1131.dat	family_lockbit

A potential corporate email address has been identified in the URL: B2AAF3C959275C660A495E7B@AdobeOrg
phishing

Executes dropped EXE 7 IoCs

pid	Process
2584	keygen.exe
1932	builder.exe
2900	builder.exe
944	builder.exe
4228	builder.exe
5036	builder.exe
3260	builder.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133803136553373127"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "7"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Documents"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4248760313-3670024077-2384670640-1000\{2BDF12D6-6C52-459E-AE7F-3C2C52A61700}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000b6d5ec0b5625db01385543a05d25db01d00b7ad83e5ddb0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Documents"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 6200310000000000225a438e10004c4f434b42497e3100004a0009000400efbe225a288e225a438e2e000000a3060000000004000000000000000000000000000000a7ba47004c006f0063006b004200690074002d006d00610069006e00000018000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\NodeSlot = "8"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3900	chrome.exe
3900	chrome.exe
2020	msedge.exe
2020	msedge.exe
104	msedge.exe
104	msedge.exe
1408	identity_helper.exe
1408	identity_helper.exe
2160	msedge.exe
2160	msedge.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
1076	msedge.exe
1076	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4292	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
2020	msedge.exe
2020	msedge.exe
3900	chrome.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
3900	chrome.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4292	7zFM.exe
Token: 35	4292	7zFM.exe
Token: SeSecurityPrivilege	4292	7zFM.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe
Token: SeCreatePagefilePrivilege	3900	chrome.exe
Token: SeShutdownPrivilege	3900	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4292	7zFM.exe
4292	7zFM.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
4292	7zFM.exe
4292	7zFM.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
3900	chrome.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 2100	3900	chrome.exe	80
PID 3900 wrote to memory of 2100	3900	chrome.exe	80
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 3040	3900	chrome.exe	81
PID 3900 wrote to memory of 2752	3900	chrome.exe	82
PID 3900 wrote to memory of 2752	3900	chrome.exe	82
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83
PID 3900 wrote to memory of 3008	3900	chrome.exe	83

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\LockBit-main.zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff79a7cc40,0x7fff79a7cc4c,0x7fff79a7cc58
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1696,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2104,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4408,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4644,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4932,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4684,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4596,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5156,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4344,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4712,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4700 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5024,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=868,i,9204375129778876784,14677716595526276852,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff79bd3cb8,0x7fff79bd3cc8,0x7fff79bd3cd8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3946371544425043071,11984266680784507451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4356

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Documents\LockBit-main\Build.bat" "
1⤵
PID:3992
- C:\Users\Admin\Documents\LockBit-main\keygen.exe
  keygen -path Build -pubkey pub.key -privkey priv.key
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2584
- C:\Users\Admin\Documents\LockBit-main\builder.exe
  builder -type dec -privkey Build\priv.key -config config.json -ofile Build\LB3Decryptor.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1932
- C:\Users\Admin\Documents\LockBit-main\builder.exe
  builder -type enc -exe -pubkey Build\pub.key -config config.json -ofile Build\LB3.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2900
- C:\Users\Admin\Documents\LockBit-main\builder.exe
  builder -type enc -exe -pass -pubkey Build\pub.key -config config.json -ofile Build\LB3_pass.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:944
- C:\Users\Admin\Documents\LockBit-main\builder.exe
  builder -type enc -dll -pubkey Build\pub.key -config config.json -ofile Build\LB3_Rundll32.dll
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4228
- C:\Users\Admin\Documents\LockBit-main\builder.exe
  builder -type enc -dll -pass -pubkey Build\pub.key -config config.json -ofile Build\LB3_Rundll32_pass.dll
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5036
- C:\Users\Admin\Documents\LockBit-main\builder.exe
  builder -type enc -ref -pubkey Build\pub.key -config config.json -ofile Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3260

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004CC
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
8b08c910c4aa8425986414c29c1d37ee

SHA1
2acfaa7a0d561a6d8dd5466ac4fbe50d87da58ac

SHA256
423425909cc9172ed20b7a4c5cf9c32a9ae4518b64bafeeca592fc2fa4c62075

SHA512
9eceb45ffe3824c9e44cc921413f81d244835373b6eb495f834b0b3585afe96a0599aae483bed98027fda5e7220b9c408feb6e42c0e497eca4f9147f21934f13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
8cc21f4e9c025c1a52bb068d0279c519

SHA1
8d5555a0a22acc350c0477aea5fa6e20f3438836

SHA256
c25d2d2922435a6c31b59c706263add0e2d8ffa350cb5a5e1f302219afb4ae80

SHA512
8b3f20b9c10c38b74760ad7f58c50e91a5fe28faf83be959aef1a2e1b1fe02d83ea3b1c7d5a9090a0ebe8e44634c66cd763243e961bc4a9817a2fcadc2862e17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
147ef3e13d64f2dfea8cf1256baae12d

SHA1
7040706d31e076d9550eb6bc72cb92a97a7a995e

SHA256
172302ab8b188b5ad251c2afd932ab6b6ea74cfed8c7685005b674d68fc568f5

SHA512
3371e73bc1efb637f3086feaa1a61a96d4ac0ab7a02cbe3449acd4ecf6837343738b893e205969ec7fbf691245d0275f6e58c6653fc9caade7b1ecd1128bdb75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
c2878dc77a0bb39521140d449d425043

SHA1
178e08ea83875ffe842927346d9d418619a71419

SHA256
d802a1e19634ff933a8f5200a46e638fd1943116af5ff24adb217142f5ebbdc1

SHA512
114dc738de63d838e6c53fbedd1a5dc505414bfe429d844f0e0fc3cd4869d13486abc3c868029fdc41d91ce0bbb2e733eac3c145e235dfc17c6134a8729d6963

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1ed1e73a5b0c57c97b59c71a8ea47472

SHA1
f3aaab8ef4711dc2e142023e529bf534ec598cde

SHA256
049d8504eaac006e59cf41095267ed11e5f5889e75ff0b6116e407cbed958582

SHA512
bb5b5797b6ecd968af9c2731024c143de9abfb745b7b5a98ff4d4765e02d2d20d50bd140ae3325609b9a98e93170e8ed59fd9302344af7e3df20a3bea5b25c19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
d6aa9d6f5191c6fbb3c52c2eab6ff469

SHA1
47bd269be69641a5ae26785ad5cc597a3206bcc3

SHA256
4243c4c817b16cf41feb856711595ce26af91655585fc956c8e274934d5959da

SHA512
3fd4672c5ddc2d30abb9d37149640ab58206b13d56f8f0ef8909c0cfc15b8606c5a6b602112ef925e4dab601b46071d0d22d8e85a392116164f9921d92af26d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
d2ecef67a3650fead7bcafb68f41b811

SHA1
84ad6fd384fe63bc4329a702ea9af8b0851dbe82

SHA256
4bb86724f07caab736e7be5be482e4f526fd14ea3d9f65d11c1fd246a62b6a80

SHA512
7ab1cbee1f409950617c3d885b169de1ff4637752e29653963153311873909967f92dc64674ee6353e809851946d0da466a5bacafeae2944684410a815e88c1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a234b28b08146de682b22c489325c8d8

SHA1
40c368444b7c86d7f45f158b33ce0a827622b615

SHA256
ef2f2e822fd80696ef6059844d335becbd5c349b25fd6aa013a26764cdfcb45c

SHA512
a414c463e6405ad7f884adbade3380a659b4ec044ef894fcaad576228c4c5089d3799537d318f0963b6504239fc120cd845c30986a6f4a956712e6c061704f83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bebe4a84d09e171f59166504a838ed8b

SHA1
bd72f3308095aa64a70fc056861f2c4cfa40e816

SHA256
10c2f06aa9ea7d427d3f0cf313974af6ddebe3b3547d1cb8377539e06625692b

SHA512
087daf6e05544adfb3746f726ed34861dfcf8dadf5976f8805a8a1017a669b72f0f28b9c5646c5ded03fd2c7a01db2b1f6d466107d7934cea5296faab3484d0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ed0cff8a0e571c69a6d5307bb33ecbab

SHA1
bfd13935fe27ada5f8d088b6403ec22364fd1f69

SHA256
d8f3beb57ed478a8d2926677df1e6e648d70154dbac23886c93c0aa34154972c

SHA512
6c0eb1553d8528ce8a7c6f03916e0909547bed7f80cf7603f3fd4332a9d24cde1205af8679492a3e40a163a556e8e5a22eb32d9180a36ff3120f968da49a2c1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b3e08f68d879ec0c5861eb66b26bff62

SHA1
2b428ad4b2f4ce3ee5e976ef04d9cd5ae7200274

SHA256
c38b7d98512c1c9c27619893da1022fa2a717c7a2370272e4f4b12053a8d5733

SHA512
0c5ef46045e93f4b945bc4b391c16d478c233cfdcab539579007a05a328748692014769439764cd07f65b8af3f267af1f7bfe51a2a4250adb6111afcba4384e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3e53c8f65b1778f1c119221d47ee52d6

SHA1
61f36c15558ef74f78e1e54f9a7b41a4315709e5

SHA256
8c230bd5b3cfab8500f6a6aa163846fc745211dc9b9dec8c976a053847b8264b

SHA512
223c608850ea1d49141d496919f5492e2a2e9083ba737d08eee6703cd64114ed53e630eb4b042c9330a0fa9e5fb4a6eb4efbb4d3e6650fb67711713a59e1a6e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
451ef7d16245beb75542a7628c2a7db8

SHA1
b2cbca1c58c454f0e15a0f772299a49dcda462b8

SHA256
f11f5820f7e847c75cd4d3d041d034372174661c3a658353c3800d66ed6daa55

SHA512
abf7777bc17415325222a7e7fd1675daf3ffcf279f0de7021f13a6788c1ab2a44c4bd311ced4608a708ad6d4ecf55fcef908d4b052bef702dd948389e2a94303

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
af3c3bde5244cfcf3d3b109c2eb4c605

SHA1
e60f5ae69eb163b31de0e5e9e64cff549a0ebb77

SHA256
d665f76255c7ebf7cb446f3fc0f5401ea9c0001916eb4ff19fcd7dc26fcaeb57

SHA512
47fc6b76cd484212787f79bd7a40afeb2d6458f334d930c2a6221ea17b87d9bfdbd8c151a9c948fac9e364f6266d9c3a4dd49f8834396771d2af66efa8b75aae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bef7ad466cbf72b45ca356b2b540423b

SHA1
6e5ac4c1255e35f17dcb7a34b13f605a4f49736a

SHA256
c61827a680c66070cafc7eccadfe7f3065bb549b0537c2fbe059eecbb6877213

SHA512
2c1a142c94b2e8329901f74e3f98d7762aa0ed7e7a6d5c6e37008bb91e3608d8ef090a004bcc04bf0edecabd2f69d9afd1e9a40264c1d8bc734f534b29dae947

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7a612731d141de02c05846bd9fdd4ad4

SHA1
7990b24b468fb41bb97b9a1ebab23b4de316b41c

SHA256
808869585efb62dcf6f182b78c96e3933778c034a4120e557533896bf958e249

SHA512
2656006c235cfbb6072e97e5a8266419c1a08486c4a1e625497174b1661d029a6a95715d7bf4292cfdc6a5d11cf7f27b045183ade5bc7fd51dbe14b55482854a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a745cb89f11a4599c18375bd9d80d6f3

SHA1
151e1f69ec1155f20ea1a3589f6b2e8809ed198a

SHA256
14d81c00c63713f16c67b1faf4a0e0e40fd00700f10bf68e65d19785fcfce3e5

SHA512
68ecf8d9d2f54af1277c1700a929ffe493a254b066c838bf311e2c1868a4e1b5ae5aed2136ad44c18ef75a20816034ec0009b24b28cbc5f04ae8e66ad8eb2b40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5e6148f241b0ff3c4dbc1006e2a99a6e

SHA1
725d99a939c1d7a76264bfd1bca3718161591e7d

SHA256
99e124264b34c91c0582ca4b688f7dfe8fd5bb047a6c3077eceaa7413a4de34f

SHA512
556606b8fdc3e4ee5faf6290719f5d8893ca3ff6ff5b0ffbb17e180e93340a669145ad785083621ecb7c1916c280d20adf8c99764a80172f78fb4a27ab042948

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
33052ff2696414167861b473350aa509

SHA1
5a80c8d7b71acba991d00cfd0bf7be3b7efade93

SHA256
cf6a1037034b6913a02c0277beda0de1af48f06ee2828517cc72def8d7e11a7d

SHA512
5953e3930dc4d6be70d9560987a3ffad57eac1e72786c98c4784ed4800e482638b31212faac5d08af7e4f3fd6caa2f70937167a2197a3a3e0b589563f6fd2258

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
51e1fdac4296cf51c41e56faedb2b30f

SHA1
16d4628cb4a7d941feb0d7dfcbc6cc0f32572653

SHA256
e611d3b75e626f53279e70177b82739207e22426dc225715f32ad692c4cd9aeb

SHA512
a4df11c0e2237ef0463adc6b24553b487cf68d5e4180483366ec86e0a574f6b4b08257872400de02e7d49de65026bc0a43d598aedc9ad4eda2fb6833b3377573

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2186f1bea04e68b146632f9b8e6c721f

SHA1
dc4e46d26d8e2517fdbb177a9ad56ac76e77429e

SHA256
7e05ede0da3df7561ad8b210d8e194653f2ab9cc78345d2068174b5dd5b67d20

SHA512
78e10bad67cf4229f2dd356e3b4e9ca578edb30b0ac951ade56089e9f411bed5a9e94cf3806a676c2dabfb13aae665279107bf4d7a6992210bbba77ee6b0b4c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
51ad5b7a58fd2912707d71ad195dba23

SHA1
309058c0f9d6057b643f9ca1af224146de36e13c

SHA256
f768d9b7a8fa2c820af5927db786d62b3c21cee9daecb3620880859d7e0834d2

SHA512
86934f1294df2ac28e55dd8c4e9f084c2ee37b68820b7984961198c27e8fdcf8812882c52120df984f734d0432c90909d2c6597860b32c86125a50735bb3a928

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
922747aead32666c5acd230e809683b4

SHA1
81586bd10805c20cec25ae8a5c7d1c3886cac170

SHA256
adaf46b897dcd5ed8a1a0095e4cd6dbfdc2cab284d66b7740679191172b90c11

SHA512
45569a03ef0e9a9ab759149cc6bf23d7c4a0ce65f87fc09c62004cc13ccce90fae1fc130c7516ef763dcbe70f0aa1daa1c921cc0c12535ef8b57bfe3c751c13f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5654bf7151c2657e2d9ec47615b757f9

SHA1
fb22418ac779231ea4d760b3c2883a564030b168

SHA256
6cfc3fbed7f4f2129daa26bf33c5bf87f1e8de08637f7def5f08c94eb2ac4d1a

SHA512
7e29601685915bf161dfcbe354426693c8ea2eb4f236b33880896abf25e573a2431cc50ffa3d703ada58207f5d07a8fffea5dfa62afa7f33a742c746da79ca33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4929fa280dddc99f4b0723687018f77a

SHA1
5abf842e0e7b17cbb76c2dcf6771e00fdd2fe4a7

SHA256
10c06c393325fd13a82758f79acd7dc15651370279b1d6f1b16ac05ed171900c

SHA512
1f784a5039476143e4e8ec4f7537f4d438975d8b25782a15f8683a9472f3677566038dc7d8689098cee0f37c5f93953796655f2df3052f3fb9ebfafe28e27cc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
03c074a9332444c8e44126fb7d5d5ea6

SHA1
3a65e1fc218f2705304e38eaf5ee2317390a19a6

SHA256
a2803cd96b17d0dbe597817de3242dcbdd777166454706b54476dc3c595a217c

SHA512
cf501114940ec16918ce1f4e3b305b5f9ef7b8f5e9d8614ecfbcd76d3385a48a68d156b80ad4663d07da65eb72f352b7eb35e254073c8f5cb608bc777d564f22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2225a6a2f7dd3d76575cfdd67a60fbc4

SHA1
6d41e4390ea929d660f15d017eda911cf40e0c2d

SHA256
e7cdb60be0df2a373a3e8f6186d86eee5daa93a77861564ef3927e21d5b02597

SHA512
0cc9f4c8a505e944d1bfd31c4d58092d270ca4aca98c7b70b4840954757fc7778e280b8a48f1cf8b1e466d294fc9d66585e46667ed1c1211ef83d117bf28a578

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2d36593f9e896a06a838fc20e8a126e5

SHA1
f7cccd081c1778955e8b61236ea43bfed7649239

SHA256
e5228cba6d1c4a90a8a513fc3b742e058a8c9bf418e0895e7c37d47fe366af70

SHA512
40613ad93732fe96eebabf82ea816ffa89ad3546a72eb77396f5ebfbfee65349967f07cd36e4dc036df2b4a708496d3b5055badfc2476649e3c3b3b17262a4a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3a1da19c9412bc800e3fbe6cb0d531c5

SHA1
51ace71086cf955aebda5c6330e0bac187f46a8d

SHA256
7a7d87e134304f88afcd3514734749a411cb5e29b0833eafa5e14dac4a49cf09

SHA512
a131053f560c94379c424f76d799a381aa375cd0519d9d6bd0367b0d60147ff7f5f41f054590d9b72230c56cd3a0fe5866a522ea48f88e59066d07c9d1895cc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9dc54ede2f7aef02808547a6bd8c816e

SHA1
33f97e36b6d3dc65bae77363a3a69f6318896bbe

SHA256
d653a15e80f2d73ac89fb1eaa68c7cde5f1a34806e9c3ea8b0868714e1bc79dc

SHA512
3e88216815ad3c9edf39db8cbc59afc559206c0d859f551db92767adaa94b8ae2ff6a603a8b49cd7878df985c3560ab90d4586e95a0dbf73ad563ddaef31805c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
57dc15098548c5f1c1e56f5b1860f269

SHA1
2b177feb5038906f96e3f10965499565589ec9a2

SHA256
71170719bbbdc20708bf77e3e66be46d3710c074b39b0d188de99e35637d7492

SHA512
2f130e918aeea49c7a5fc78fcdc3337eef757ad3027c4f6fb1d9a57a444eb6e6c76da7831cf5f00d588407982a261ae78b84a848d053cf4b12a9b08a634590ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a8f6261cbb8490da47184925b9724a61

SHA1
e5ca3c66e4cac11354a5896780a4e8be9d626f65

SHA256
fce3f6d74b53c4838cb54e528ec6bed1182669b0ec041acacf642676d59f7216

SHA512
dfe471c7599875c7863030b9b691e7041594c00340db4d216873bb32c5429bbb70c1cc2f0e196390cc26e7e4407d8cacf2b76d09c7ca73e46abb3bab592f1e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fd3661ad1f1f3780ce8604db3d34f675

SHA1
ba0e151d05246092bfbdfaa35765495228244c41

SHA256
69bc6b91b1fcd5450907cec3d3ea9efcbbd7b6c404612d6d9a521f4748e20424

SHA512
35f112ef869c7d17cd8fc2a595e09b20ceff00011d3154aedb96835a8429b4cd698a2d9fa08d441fe57e4f0eb376f09a99d47193d2121b86e7abe0f62a73c9c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a4a955c6f2dfce959f90b6259b45d059

SHA1
a1a1d5c15d769da653829846aba40af38f7b3f08

SHA256
5d817fbe25d1891aa62af85734cbf09fefe03d68a6c5daf54e26e898fe35fbea

SHA512
3c17992790c5a7c8792829c7747f63945d4938965fb26e15437b36032a4570c8f3d4ab69bf9cc0dc86df30e7b271d7fa2aa3207274cda6fd4347b9770152a531

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
281f33e46b64aba8a4551f2221d20fcd

SHA1
5c96ea11b13c3c3723415ae1f00901f3b53157ea

SHA256
81a76a39aad5027d379e32d1086141b1b8f3ee4a02bf54e4d814b20580f06b33

SHA512
5c1b40dbfe3c75b4d3799c8b07e254c4a1e056f1d4cb0f2c9414e22c0215aad2ec8002371422822d442105896b76161a5b63f9cc0ed3fc35fc567a7e5902b251

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4179485a677d0833d9bf32462b8c4d23

SHA1
b08faed064e54391f9a71c7a8d1ac86f52ffa6de

SHA256
55c8dc14627be0de2eab43a65e72685d242ff0a09d3d2f9dbf9dba3569dbf806

SHA512
1c703c92b0437008d0414684382edd830bca91892af123afc3ef3199ab2f7427f703455b0614586e1b5cfee08d13826574df70db71d6e1e004d8e9b4af2be39d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
005a43a51f5b5733515f3e5ba756fca0

SHA1
d20ced23194a7d33ea0a9c821ac811211116d62b

SHA256
354935a9129fae273f05a854a1d107c1b1204b29a5dcdb57142b5198ca7b2c62

SHA512
61b29eee57e9afd3b87d9be9ad80b3883db3b6a293e4310d7de59a8c4bc94a9f7759c7a094b8a4ded2b8a25d428e81c9ff8c681c82175252542d09bdb39ccfe6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ae21a3b8e48d33b1339a22dc5cc94466

SHA1
839b00a14951e50c408e0a7ba2ca5ac8c203627c

SHA256
31478a1b464ec93265264269b0022b999c5968a3421c5354c9d12e538df8cf00

SHA512
f07fe980a718a6cf10e3452ddea795c5aa82b5431784913e8989e95cfc13490ac88822af3d885523689f368e5764160982e16693b5cc07e9fd22dd745d3f188e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
839c8139c5cae0d3ff3424209365ade1

SHA1
008e0367d50d9b91ae174f0f5db4ce763f687d4d

SHA256
d4a606fefee1650a415b948269725256547e94d9f9374422206eaa11d9885a87

SHA512
45e382d847975d5cd9e383cbe96cb36afbe4c69ff89a48de1c689c0ef6a87ddaf77e38c93c2b1bf79ab258e54e9bede0cf0dec5d74405e12de831bba9b300c16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
deda97572d7eb5bbcba6cdef7e6b2a83

SHA1
9c72b46bc8d8dc5502e3cf6e6e8529cdcd2d8165

SHA256
3f7f301ca7afd04f4098c16b152f66318a41beffd3fb6709fdaf3d6f49369a5f

SHA512
b209bdd82e8a8f89e2258752dec3c68dfd8064b55c7fbdc5486e2ecfd2f8ae90f22e37e50f1143b21413e936ef3ba8382589143dc8d37298f7b5060ad7815de2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a0b86e86d6639da2152c6107d7319e86

SHA1
2446ab10c506f448e63dd982755e3b24562464b9

SHA256
9f5259027a5f794f89e9d7357d5bae646eb622d004b071b1e1a6f4535a3fed1f

SHA512
d16b5e6d97648573c8d34c4612cb8cecc115dd36871c6ebe9b1ba92df41f80152aba4a44675c0974b9deb54b24191c12333a93b5e0131883a08fb3f620edd52b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
580c517b15451feab7fc0eb7264c9034

SHA1
1ee1c3d2ef8cfb2a912097a94a46aab80eed4a9b

SHA256
789e047006b9673f734b60bfcd7da5e0e69236121491fa1e85bac1f0c4d3d47f

SHA512
de9126db4c6a8668f9837e7e87dfc56c4c5da20c90e26a59e1ad412f717a1013528990b755cf47d7e7028dce825a44421551dfb10a210ca0b20c9b999003305c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e8d07d6df5aa3da7f522478d5a03e348

SHA1
2d3b3108af9ad6f1d655cab440786ae91c1f188d

SHA256
e98f991eb31559084bd55aaf73561ba26763e0f672685776f02f77f168892bda

SHA512
da03d21aaad0c81f06534918eb9b3ac4d2a8b50a2ee44e107e07518a62bb1c05a78a16b0a0c8d54f13aeb34f0edcfb8c2bfd591552c355617e462b414a57f293

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ac51ba1517c8d87d5b8313949b37c323

SHA1
d8e62b6c359707bacda6e1927c96259ebce017b2

SHA256
e4c1f447ef27ef2ee14917cac0b9c63b6250060b9ba5830f995c4ce01c035eaa

SHA512
bc339a1d23d6dc6a03073412e8cecbeb27ad4679f7c9bb91fe3ff98cebef5e3b78aaf2d9d3ac07b207c4d7591360554403b9b4649c5234fb2496b14b8acb160d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8c6622e6f770b6afde45f48416bf8eb3

SHA1
ca27eea916e2b00f51bf570f2f59e59cd7a68bc0

SHA256
02ae278b345428ba99b67b286349ba00924a0db7037f85f688a0629b1aff0c24

SHA512
2f5fbc346d0988eab1f9583c08c4ce77cd82c0c9d0f2f08acfe60269929f47e2c58a533634aa212763d2c7a2c50007356cec838983daf939465787d9ceb03c99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ae085beeb68ab88f187acd39d878fb71

SHA1
4c3c82a081125c3a81d30360a2f13eed387330fc

SHA256
88daa604906ba88cb9d08f86d6ff6a20ceb623a00775f461a7eacbb280d0baff

SHA512
2d05fd336813eec5d54ba8e043b882553667551ff47baa4563f28d07ad88074be16927c4109be815442190a13f20a229a37d62f321b70bb3fc10a0443c23fec5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
296f72271b3c7a5db111ef5514e69bb3

SHA1
240cbb6730e8d30ccfc899857b1e0ccf30b1695b

SHA256
96b2a4f7d9857dae48aa46a32d7b6101a4944b40f9d48f946aa0d94a7afb536c

SHA512
b03b48c67fe4b36abab6a13100567bbc71c5b31126b40e77f90972aeca0fc330b9f20a0ef7cd88c20290423ff57293b487fcfec34e08e0d641f705a98cf5af98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1faa9dd76e9a41624353b1766e5d745c

SHA1
f636a9e6ce62ce955cf66e8433b31e5fc6c3f45a

SHA256
40a904ae854f50259322eb88e64419abc18cf48756d0f2886372d768901b0dc6

SHA512
eb3ec74435ea1731beda46ccf1e0d16f1c03337d8a2113760d59583aaaaf2633491971072ff20d026403d041f769b3c158b6a9433b47faeecc70402ee5fdf3b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
84b7cb25ab6b04753a0a82233530f4d2

SHA1
314e61eb766e086d735ed8c712166281a6244ea6

SHA256
19d13ac2027ce60d057b35efa415356a4f3e4d7b67f714a9248af64ff6e5937a

SHA512
ddd5ab56ad2b4d0877de0b70a9d5402e6ef5f48090e30689ed0865f0741f01cf7a8d4e363e92f016a9df4a8fe559acd146639c8a423401e01a7d48b6102a9801

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
645b0a85045ea27c2020f8dfe36d7487

SHA1
68137963faef4fc19c34faee1ee72a5e3f8cf75d

SHA256
c848f31dba4644609d8110e6e264b30f6b5e8aaed26714e72c0c0e5b3742d6e0

SHA512
29d236b6cebecd372e7da779ef6a8e9f0b77f243a226ffe3b4e12224e97a1575d4c62b280ad6fd8030ddd8c9fbaefda24328f2f46d2f21d67ae24bb176a94ff7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
970f904793a0dcfa088152a899454329

SHA1
1c6304084489e33aa0d9b6073304e1cd0c72c34c

SHA256
b19266bf8c2201ccf6346e0dfbee91bc3a406c93657739a069cb5e136d9df9e1

SHA512
32e93601279a8e8a98bb527d8320ad5c69597d330873334d92faa0e9e524c6320813cbbbb87f6f19aa48ed573213bb80956317848f0ac7855b1286328966ef47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d717b6d7bc1b517a6ff7e736e3d13b7f

SHA1
603f22e6e50eecec88d3be2ac680909f65984dd0

SHA256
8c176727f8c50a192269c47798f1948d91415392138f0017e84fad22c5c13478

SHA512
119b693e6f1be3e5ac62319c440c778a872e77a1e21d45602d800641774e56dbdb2cc4754063de0275585813e1fde3ecd3cf2da3cfa08442a4e9c572a2472b72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
85c9b37ffc3031e91434cfceec9d14d1

SHA1
233fcb59a5112f709f684998eda11b417e5dcef6

SHA256
5732fe9111ca89a8f59a86d608ffbc6d7b7d157487fc79cd5ed3834f952d3b44

SHA512
0c7d4b21b596c1e9f96ba1a19e314365b6139dae73b381262f225155665d47c70a8cf826e0bc383e1f22782e7837a223c41810ba62c8a52e2f87c5e886db433d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9a75d4607bd88dced2ec855d884042cd

SHA1
40aa5037a60a396c09dd2e2a8bce67e9fad31ee4

SHA256
311b1e0deeb3fd05e01364c09110ebc63802b885a62e37f68d6aef6b5364380f

SHA512
0c6abda80ed241025df7ef10ba6e46f90bbb0989254d3697ca957b796706bb374e90a3ef0be703b76d72d316e652050588dedf89d7bca4925dbea99e345ed5ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e6078d9e65238d25b6a0019ed0983d60

SHA1
0d1dfce985619c6e796cc67562c960475f279cfa

SHA256
b4083019af98be8dd4053b01e33fe27340f9a9dc588d9ecc5d327c2327880a93

SHA512
a3b25b0f0b86ceea49c7bb556ffde4864b1bb42bf82909e5379a7583356d6139fa9c9031f81b6c20ea10cbc8121657a1f31e5b71f42def2c443ac00be4256b0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
76999a53fbf1a8b57c1837a4fef520d0

SHA1
291c4012fe860ccd9abb3756eb72925c95aedf32

SHA256
dcb362eb0792a313241cff3e5cbea972595208094ae2df767048c8ec31ce3cc4

SHA512
7afcbb49367bfe2ca30f3bae1dae0c12a4a877f1b78c34b66286b459c26900f6394ae5270f997fb65f4bc6779b3917572cdc98dd68476f7f998a67c5a7128a19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
d817ca2637e588d10e1e62386f86ea15

SHA1
06a30e0a49108e9e3b1302f8c48c1e65fd8c97c9

SHA256
657769931d06095d42e440536637c0dafd50ac684c13b672a7e24052530be981

SHA512
530b440637e3ad6fe0daf31d0b52927b6e2432a1adc4246180d501909a511cd0ae8753877211a2f41d75797a8f8cdd9b8c17d32a55cbaae0b0adcb27a4f41e36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
05d9c96ff36b2805dc27c6c111a480b1

SHA1
993fcddcf6210e9fa8c0691eb5ae50ff1bca5eb0

SHA256
e3e4c3db6102c220070c70d4aa9b4afff444d9bb6b5327de908028e7def89109

SHA512
d5436adb9d9f8a849bc754092c15d75eedadcce070b3969844187e7bd6f48bca7a3ad5795a951b1fa0b89b9bcf19fa8e90a7936abfddbe6176878eaffc055435

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
d36a385f5d652072dd633dde6e8ffdbb

SHA1
0e707eec3d1415c6ca7310a2d581dd88b4611f47

SHA256
bbaf99c9dda9011e27c7d8f83035741f6fb86e3dade0d89b8864cc2b54b3e90f

SHA512
fd84dc8213a0752c860ef1d28a1cd3efb5cbfc56209888521c82de0115fb92703e6b63f473de374927bca8e6b930daef9d2b8ee3ba03ca6c924ddf55818a3b57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
9ba277af1aec786022f669b1f2e090af

SHA1
96b8bf5b9f660b74cb26a79a7848883fe1b0df3b

SHA256
c46fce325c7e712a8f4b4c20387a61a42dfa295575c5855c39662c85e3e09ce6

SHA512
738d2de27335eaddf85f2b7a45530c930d919853ff706d1d4106322d6486ea4b058f1bc7a863dde05868b017e12985eae994c4ac051543f42fba6c2e3c52fb3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8e505266-51f3-4927-8444-78b0bef3cf18.tmp

Filesize
3KB

MD5
f9e3bc5f056186b132e495f2ff54b036

SHA1
d90936b0d6327786bce62e6833b58e87c73e1ac0

SHA256
7bdf086be0bfb8675d6f82e8ef707935910d884543b2c043872f816518409503

SHA512
bbf97786c3622918db8bc1102b1b16a241f8f7c8f96a779087901aea3be63f36c0224f0cbbcb6560f7f5d83d0fd832e60e1921f1b1b55cf0b9509127e1eefaa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
41KB

MD5
ca9e4686e278b752e1dec522d6830b1f

SHA1
1129a37b84ee4708492f51323c90804bb0dfed64

SHA256
b36086821f07e11041fc44b05d2cafe3fb756633e72b07da453c28bd4735ed26

SHA512
600e5d6e1df68423976b1dcfa99e56cb8b8f5cd008d52482fefb086546256a9822025d75f5b286996b19ee1c7cd254f476abf4de0cf8c6205d9f7d5e49b80671

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c82feaaa7cd9d1000a531a42595ee6af

SHA1
be9100429803189cf08ac0e9255435591e0bc944

SHA256
cc2650d61f31ad87a7a709808be3fcf1ed27c3f27f9a7e6380ce36339e870cf6

SHA512
3ee0416a819b98a95a12724383b858cb54d4b45e97d2e65e5c38a5a74c2096b9c1cc26f81af6ff2d0a00966f1f76d2c00a3535ae31c6adf544d401e63677f017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4e6ced7540077ae95e2de02ce9a5ed1a

SHA1
0c1bdda6c445a18c632d08c3507911501a7d1eac

SHA256
c3505fe43f737192a152fb685902b3b304ec34a36bd8086b32ea01705fbfd699

SHA512
17a183aa845dfba916db6880dbaf7cdc4fbf2fae4f5aec8bb990a279a9d4e1bd49a5f7bebc7062740caa3dc376aba47ff39cf3fd36671c691e7ebf3d5d4938af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
cfe0abd6491a916882cf696ffef62e79

SHA1
4aa95f8c71d4907e06e6c29702577416460a0fdf

SHA256
56a08c3eadaca8106a908c88f60f466422794e2e464a0414f0dd7473f45794c1

SHA512
fd0060d069b02e1b85be4d12ac352ea9018a6fffedde6963d332a178a40c195baca9ab602b8464f06787d174b8a24a19dbcb3aee88649f2a2b7f8cb193b5dac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
03557147ab4789bd2e0570512b8ae675

SHA1
52b737d2c4986aea744bf2fb62c310758aff7350

SHA256
b8889e47ff4633d932616412b7f1a6cfbce42cfb9de311300ff233990db1ce86

SHA512
57fbcafe766a0fecab77ad09dc9a0839651287525fdae946005887f2362816c37aa716a029c76144c8a5f80fb63cb6c091e205baa6f24fb7c7d84b5472ff2431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
92fe6b4c0c07d78bbabd1e5b72c92cfb

SHA1
021ef3ce56a49b227e0a706517dfab96fdad7860

SHA256
bbba5650fdea3f42e4126ee8071130d3af27772a974bb4be6b82653bdebacec7

SHA512
bcaf81881751825acd8d9c69784190de217bdf083888ca15609b84aea8660d68fcac53db1a431fd792999f3cff5e71a114cc8ad9b03010afb4698bcf07dbe003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
747B

MD5
a1ebf6db4714cd4ee174976b2d217d3a

SHA1
039e963c62b2a6315cb8d34b9b6e9754bdef6cf3

SHA256
de4167fc0e79c7abcd47884e0dcfff257335a274040ec798c77738a563a05b91

SHA512
adce1a081fd0c9215be786a0f4fd093a0fb46ffbfe2f264d52485f7ebed5ea493de3fb90fd4d25118ef5d3f42c0f42ae04bfdad65edd67a1f7bc263d0d627212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
500f5cfbd6eb04164050f7f5073a07ce

SHA1
97eef0de8a306c2f2d834a88669941430da90ac9

SHA256
ddec6e6eeaa21a5a595984725d32e8e2f3468ab04068480110c605b2dfcd6595

SHA512
7ce2b4af455d4c6296497c19700cba9d9d674b1cbf02596f22f8dad1493970ec6d08842ad01d9f9d2bd4ae01492f5da6b8371897ee73924dab92dde85d2e3a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
181d77e652e3233c146520cc2b3e63e9

SHA1
8a4aea90b0792934101610fa801316c9c737fa0d

SHA256
c779578f20e81a387d44338ce0fe1b2199dc8451bd469993b8fd370dfdaf85f9

SHA512
ad1272738b4d641185c24370682dedc15336a3ce2e328f9332dbfe3bc79c3dc24c7b56b92cb058e108b49f6c6b4405a6fef66f08ac5fc42fbe3a941ee215a2d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
816f990df153a864541944116a8d443d

SHA1
40c0a4e4e7d35357bfa5426b6b82af2af2383909

SHA256
b2b31d79d70fadadfc2ad328b5ae07515d506f766fd9cff7a9908229be7a7d7c

SHA512
67d309f1e289cb3a176184afcb3d3c83e21c9668fe3288b9a66d5f8781170dc4dfb88ecbac1e6e4993f4db7ac112d2b181ef0629749ff1f770aae04984f6236c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
fc6990be1330a60c8b8b8e5a1793cbc2

SHA1
4422f441e8f7489ee56151931e2b033793709677

SHA256
1d9aea1c4c62c77efef2fe96869514213521fe6d01a18ee6ce13253f9165869f

SHA512
6752468997063fbda96a568544c61e9aae4c5746aaefa5c128981d6dae7acdd83ac450f1db0ca006b40185f9cf3d65248a62feeeb556965e58124ae4fa5722fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39d23fcc5190b5e6af60c5714723d109

SHA1
aec7943eb89d8ed0bd189a0fce420b4330230947

SHA256
5695cf7ff10b83e4a226252eefe131a118be42af88c025a78a307e245faef764

SHA512
bd2eefb8c65c29649294eeb3e21f8f008e1de8418c680a98962d542af84a21c4a1a7302c9fefe2949cc3d93bdb4046f51c9075cf18457596103106880c85927f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7f7ccd8e318aa12602bc72362ff958ce

SHA1
2ecd51491685fb7d039a2d54fad23b71f934921f

SHA256
08a5bb8d33fa0485468f98208097babe7664a0855ab746bf8c89e0407ac14530

SHA512
e8a9442e92dfd521039dcf6f8e40aa089f1e0c05cd5b98686dfa16121589ca3721868c82efeb3e83f8c79c08c2ce2bda11cc2f1388a0bf9f9991811a7e4993bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42eb49d0dc8b8631367e31a0407ef9f8

SHA1
b85ae56b33e3da333834b86f72bdf8d70ea5d324

SHA256
d4819039d5b0df2ce8a9c1a855260278060b5074517abbd01d9b7cebe390264f

SHA512
b6073a13d846def478f1390e309d43eae2a082fcaebfd548269040ad4aa6e2828e9155ae6f4fda75a9033095eda9f300c627ba92e8014191b46c74a7b487600c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa2a9f0d8d620ffb47581176a6eecc0a

SHA1
c88cb5720eea2327e1c4bb3720845c1d2a2fe223

SHA256
155bd30ee6b7e4cb3f407afc551cebacac26f2842fffe048f30026a53f8c2f75

SHA512
2166a74c3425db526a5762c8b588a902871ded9760955c2cd7a22417510cc836c5459130e28455f1518c6d7052fe0afe549789e048e03e67f6a2f2edacb0f529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
9f1e529c4591661392cbf5c8c0ddcaf8

SHA1
279b3aeaaa3afb4d4f47db0aa79b2e07e320e177

SHA256
f099055ed8894256c3b6b044562eae68790688d68f9bca4345a1a7517bf61fbd

SHA512
706b614ceb36fff21d75e22b393180e63a5b1b0b5679bd8c517895d9bfbc5ba593d5505c1e7b53308020a582c30f1e19eef2dfd0b5a95b221cec49a7cc045839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ecccbc4c49ca3afc62b27141379b7291

SHA1
252fd89f72481d6e330304034fbedd78b61ccf09

SHA256
a49148abc20d6d4162cd39d3405cf55182946cb910d60cd6c8364b99056edb57

SHA512
f892e9f7b7bea58a063ee810a816d2a244bff75ec24bb8d955036e908eb89310def8710dc54fdbf3d191389ddc3c602c90b95431c90b0bf2de265e6ef5ad09c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
431bc4ec21b07971a19e3a7e97f84940

SHA1
d9b6892d67ee2e5416f865b1ae4c51ef5cc825fa

SHA256
3d4109b53bbb30ac693dc842a299f9fc89761623a4fd3c51eaf99d5cd2f3177e

SHA512
fa25aade0431b998b88b66b50f4b00ec4d710db83286bf26fb8948db6d5472ae5f27a43ae3a25186ad613efcdd1935be164905dc981a7e8a7a6e2e87f6dc5f2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cb9f5295fdafb93f2ebf4f486bdac2b1

SHA1
41e18026071cf1cec028b47bf90904d5af63f78d

SHA256
44f4d3d46d24f017a3e0212d88caeb7d4a8de5902fc2eee94473510c36b6ec6c

SHA512
a8558eda88393b29ba9a4cd636cb7eb77e71e662f7b1eefb8f850a086b15bd664f5235a55ec30a19db92778772a007795bf5649cc2436d5cc974c6b4ff0369f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f7371087c59c7e8418cc9642aa9af8ac

SHA1
e43807075801d0a4caf72a2c21ada2a7c5efc04e

SHA256
539f2641c2b27d7a93c018b2cd0b4efefdc944e43fbe2cec7d3026a384466729

SHA512
f68e5931ef86d6dffe5992f4182025bf47620241124ad2b2cdd049ae710838b30c48975e0da27ab9c27784e1a425ba72c42310c4bf61db715aac88df7be0cddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f42874142264ac0079b22eb793c6eb51

SHA1
e99c2e5549174310aec66b685e4841ba5fafa887

SHA256
009e099f9dd0b0cf3258a772d0ebb7e397868298173717db84c555e95afa0cf8

SHA512
99baa2fe55e1b8594410d3b67f8488b3a19b927dba43d94d71c5a9373b207a97b24abd8eacd2754d63191219571287f171fcc99d3bc0bef62807d84ca6b95977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8dd6e404303a20463c2b8e6ebf0a7b4d

SHA1
44a79789c0489189848f4bb6654ec8d60a81a86a

SHA256
3aa387e3ee3406d80b57026f06abad388315f74ef2c82814b9a6d7346647e367

SHA512
fef8097517c18f38acebd4837c63a2760f4977ef371a1e5967f57d07c54d5d81590c9346bae3bee2110eebf38ba9270113284995ed41193ad7a6c6cd01459c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
60c0222e5ffa579a5b6d653371aa1675

SHA1
d905cb876006b9cbc00d5427ec2249d22e3d885c

SHA256
62f32f14a705b27e41783f8861959097ce98f992f9d2ddf62bde6337ab82f0f6

SHA512
42f65870fd18c37be09fcaedbe0914f14da4b88feb57b46d6d6f58232681598df1eeed018298219e498c027aec580693812a33edd437ccc95a17c2429487463d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0ea28bf049036a8c944450cdef993b2f

SHA1
ff64b96d5aaee34ef92ff1cc2cdf6dc117dbae18

SHA256
efec1d53c3718b5876820b1d825dcaf9d9bcbe9628e4dbcfd78f541f3694f71a

SHA512
b1707c51f6594a9c649f579f638d63181a70bec8d2f648dcee68086602ce0b1dc18643b7b442becc1190f1858561eb0fff68bcfcba65124e3a77e90472f28b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
acf65f7f332ddf993dc7f3cfe290ebe2

SHA1
0a4e95c797e0bbd094a44cd2ce6f8df252f3faf8

SHA256
0d9cd3a6fe23fe61b5fe2a2b2db2a33a33542be3ce21ed2ca212fa125ea4b1d9

SHA512
a24b4fd2cdc97ee3aef6600d5ce37e515bb68b729d04deddf450ca1364b974e962b497d8bc65ec35a7c6c77f88265d950bd10b3e007d48028892201f2b6c9f9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
910ae5594689bcd64a1bb39c98ae3c71

SHA1
dbdda80037a7b514cbee2928f7ad8b880f6f54e8

SHA256
16066c45c7365326c56a2f4f592fa3f8dc96a712c940d4582203615815731265

SHA512
06bb108384d4410a5a0762db02c9fea20e28f087bec4c314f4544e663471cb93c601876f3fd21f60ff0b5ee6209a72b0d84043a129702e29a6041b0d0e8c96e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
40fbdca8667e5b6030b90db0f9ebc56d

SHA1
833f4de5468f161eca3c9838d418ec1cf25cef4c

SHA256
1366227d4e4d496f8236ba4a27da32762fb31d778dfb5f86d2af6a065a70ec74

SHA512
700b4426ca2e3ef5c94039a164fce4f462d4c3e9fae7f84a9b3dc0c63bda289ac2f31d78d10f51df1fd3fe2bc4b4b64f3fb0410f98baf16c9e5986d958b160c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
de4d52d92df45cd97aaf4121506a80aa

SHA1
8d194f65c8da63da7eb46fea9aad9117398df807

SHA256
8cc97f568993e9b740f5d6e75a9739b5c213bfeb45801392767ec3313822ff61

SHA512
64fe79df4608da6e6ef3c5a942170691fb175690116f12f4052727475acf59b624fd89e391ea0dabecbd592ad3d42f2eb427f989f967c021f82b3fe36deefe2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
540b6929dd791a6a00b7e4e600ba5bf8

SHA1
a5628ad09a9c7d5daaecea563a3f21db412bc987

SHA256
acc0322e1d6217ea06ff314eb16ae74f1ae15a56b9adb87d07e41f6643f5af5b

SHA512
c0cf80897e26ca98c36f2ce7492a2c4c117a5230fe1b79e577a68ba24ecb7039bad791a038fb675c346be0879227c075ef9f5bf1f86a123ea342de18f4af916c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
34d7a39098d61d62fdece87bcca320fe

SHA1
e453d8f405a89bf67c9a42a9f8c603c27441c9dd

SHA256
7b24d9e3d9683ad980f2eebc2977fdf265126790a7035dc2affb9b99c7983da9

SHA512
7353fa8379202fa8f473ab069160b8c40fab40febe969cce75b64b2bdcd660f820c87d8ad1a581b9bd3010cf83ed970381f0821d415233479d90708d782ecfdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
38d8e6fe2bf7c59c7ddc540390369ce7

SHA1
91435aaf9cc769410d910d196a88943c88cb8783

SHA256
788596d8bf00d2b5c1b796400e48944b2ddb371f685133e58d7e915470912a4f

SHA512
3d516b523f0af5c30a3d7bb96249809848257012fd756589f209789b574bd9ef2ac8f61be7adf39580f47f741107ff352a6d585027bac08010927b99586ff896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c63795c371bd53a39b6be4a928746545

SHA1
91c11cafab550d6bef6b82a99806bef7ae3814cc

SHA256
37819cc9a26bfe958bd0451e56c1bc4c6f1beefde062be4ceffb3f34d0b04e3c

SHA512
7e37f3df8a0394fd0c9391e7dc70e35778dec363ce68ad156b773cd3e570398a3904a93af7aa37192a6bf408311b03b775055190344d708c326f193700d0cf66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f56a10f5c2dde6c85469f4129c4118b4

SHA1
033c7a3b701b0ee78ecf1fd15d57d860b030cc72

SHA256
6380b0596fd127fa00e25bef862a0f1ddcfa5d093c56ea25277c2c7d8f5eeae5

SHA512
becf4f259fafc2797302c040287c5b5b06f14fe4f9e2985bbc10ecb328ef4f8d476e9300a4cc77c9739689d777ac1e3b6e3988e9584ffb940dbf9f9d21bd149e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9ee3622ab55b277d431de2ca94b26583

SHA1
0667b6fd4cd394bae9900da871be1dddbd53d8ae

SHA256
67e06222482a0d35645e33d1c9aa4f291d02061eeb51c3381d0ca779f6a2588f

SHA512
a3bae1c9881454b0201d88a6a9741985e41807c49d123cab6c4bdfbe49dd9604dc6f6f154951bf0b2b853abc63f64e6505e31e867b04fb66429cd9aff8e2cf90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a67f3.TMP

Filesize
536B

MD5
71ffeef7053e77d7c96dfb7f61ff94d1

SHA1
d8e4b56792ea507ed9d5241d481ba830e44635ca

SHA256
9155b33ba3cddc8f2c157db8bf83a6947189d00e9a195e88c758c1bcce808d99

SHA512
819c6bf7cc911b63d5f54c0b059e25a2cbe7f71593649cf3e54d461256dec02564d212a35514bb1ec003d210ba2477397397d1df4c6869cebd7ce0dd5f4704f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1fff61fa84778ac8ab4c4b21310cb47b

SHA1
fb85582db3b8b53166b16b5f4456d2da47a8ec58

SHA256
4138c7364da305f6d553b7347a9d4a16c4ac1960c17dd2b3314653e6614c3fad

SHA512
a9d26ee52979f14971069d7286095933d30450079c3a4ccb36002a7bce6f27e685e21392ba949cbe9e346787dbcf236fa9bb4e6da542498db3421c6f75d1f0d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
11e16778b6993e3e444d2b85bd9dc8b2

SHA1
09afa015789e1eb03ecee85bb22ed50ceadcb2ab

SHA256
b75e2e868669ce085bc3d4dacd2d4dcb008b31f3aa3e241c175917a1879bff92

SHA512
43c54bea47fd621af37460cae28ae00de4a1d32e6754143495a74aaf5e2b7949fdd4abfca77239b019cc39cd1fc741c5bdf719092874c043174d84fa703e88a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
68b443bcbcbd7592936c35afce71059a

SHA1
99af5bffd8e98368b5ea66f723f1c8b075fb43a4

SHA256
a80386d8f3870914e7142823e204ce168705ec615bd95d7e5251a8c496de3389

SHA512
54489cdff5e0189919d50e511e163fa8e9a9aa04c8ae6118dbfec1b7032df8bfaf895a95afe4fbc44441bb5b9a4a9da30d4c51d03338d6e528b1d44f9072dc28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ef2d754292222202c3abcc92b7d4d2c3

SHA1
fb0eb1cbc054ca407f96ff34dbb51de30d18c5a8

SHA256
21a00eb5f40b6edc85c688aa0f724cc12adca8dda10fecf94f5096187d0cd00a

SHA512
214c97963ace8c3547cd501a21ecaec5cd9fbc724951cacf04f9ae6a943ce3d31dbdef45d9e1bf96e503ad3ec234af0ccfb5f9ed306a96171ca66df700b21ecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
60930e96c8ced99c52fb8f6725a19181

SHA1
396ae6bc8dbcd0516ef6a07c798a5eadcb06eeff

SHA256
de12722622ff7829fd8563536d76acd1d469ddfc2b833f12d80f5d5947526833

SHA512
784d731098ea5ae0f3671780bdeffca3f8b26423313a0713f0908244f37992ec8d7296028877c46c19c641926abd1c4bed57345464d3076fd4ee91a3b07d14fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
53d6f789e05e6e63240f5d093ab60a03

SHA1
72569635a78114308024a670eb0b2bebfe9afaeb

SHA256
a25914aa2360574a2a4e22c6bfad0257b724c319959ac686dcd3a1e3a9347e9d

SHA512
a64fd7f01400194c2f6140c62f55aecbf03a5a648177e0d2739fbf4144180daad00442deaa47629d39d72a0908ab4bee450930b4226d05394e5b9cb15d8fac3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
c42177576ac7e1a453b3ffc81a7610a0

SHA1
0e621bf338888ee36135da79930fbe13df9ce32e

SHA256
ddd00aec1b2cf4fbb8747fef4f5d8af4b64eb16e7ab9ebdd27b140da8a976863

SHA512
b589ecbb57c5e2eef3158147aac716d5d051b18b38f79de244be86c794253f8aa9f86ddfa629ced9d2a6ec8f05dfdf4ef2d7def544929561c3bdd129e943324b

Download Submit
C:\Users\Admin\AppData\Local\Temp\0f9e8053-a821-4203-a304-fee401431757.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3900_577605540\72fd7dc2-fd46-409a-83c8-371d0dd2961d.tmp

Filesize
150KB

MD5
14937b985303ecce4196154a24fc369a

SHA1
ecfe89e11a8d08ce0c8745ff5735d5edad683730

SHA256
71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

SHA512
1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3900_577605540\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\Documents\LockBit-main\Build.bat

Filesize
1KB

MD5
b8f24efd1d30aac9d360db90c8717aee

SHA1
7d31372560f81ea24db57bb18d56143251a8b266

SHA256
95df1d82137315708931f1fc3411e891cd42d1cab413d4380b479788729248ed

SHA512
14ebf7905f15983593164d1c093bb99d098daf3963f1b7a913c1a9763acb950075a0d2cceab3558cce3e7269c2a2d5dacc2b3c6c55807b0b6bda6bfad62dd032

Download Submit
C:\Users\Admin\Documents\LockBit-main\Build\LB3.exe

Filesize
153KB

MD5
68fe447930de90506c57c7baa778e411

SHA1
c4eb3b46ee7bc2c25aa5605a4010742f0a812cbf

SHA256
b562f2ce4ebb520b2cbf95c4651133c2051b73df9f9861ecc08f5b2c6e1b7419

SHA512
65677ca2fff31584717d8aeec0659e41a0d7b0112d3907033063e8ff28d926f5ac64c33f7e416a8cc16550d9dbe6e5d4dbe01f16f00a992a9a854364999c272d

Download Submit
C:\Users\Admin\Documents\LockBit-main\Build\LB3Decryptor.exe

Filesize
54KB

MD5
710593559a60c7697978c7bbcf5db3b5

SHA1
dc444290890b01d027c73fd057c4904ba2e7c770

SHA256
4a831f4f2623610d44f6795437cdf16e38586acff1305b5c025aeef97ffab697

SHA512
6ca55ba8613a71ef6c399e3a1faa64a402f0d2fe99f659400940f27bef04d6cafa84306bff7abde8caf30561d75ecf11cc7959c20020e1c513840bf6a36ea5d5

Download Submit
C:\Users\Admin\Documents\LockBit-main\Build\LB3_pass.exe

Filesize
149KB

MD5
bd3adcb16b3b087f9712ec9c1b3a406a

SHA1
e7daa9b9700165897e6dae7d82b3aef25adb5ca4

SHA256
3fb702e74a372c9cc07094f4a0b7ead54d9d1bf7837f81c67fc3ec6527b1876d

SHA512
aab7e5891f477715a2ef126dc9631c5e13ae7b854e5a39f9517180acb0d0f62aac0bd75517ebe7c3346dc3169f03fbe3b6be1e8273d5b5a050656dc3ac3563e6

Download Submit
C:\Users\Admin\Documents\LockBit-main\Build\priv.key

Filesize
344B

MD5
846066065a60a984be6dd654c3dac5cc

SHA1
311e724633b2caca04b95db18e350b5ec87454a7

SHA256
2f08fc815d8bc8b7da90d3645315accb2aebae16c2b66c4bd6f8183d0158b042

SHA512
0357e3f3ac5dc8268a90fef1aaf81cec92e2cf9da5c73819f0ce93a7bc558b1cc9a9ab0cefddb0594c05e919d7c51f70f3d2886df7643f27054b1702ce997263

Download Submit
C:\Users\Admin\Documents\LockBit-main\Build\pub.key

Filesize
344B

MD5
8d352d20add25d2b990f90fe9a9dc017

SHA1
adc4c2bfc808717fc6343ad58350747068ce44fb

SHA256
4d35364edc64a230c6b36e31fc487b43a31e779f0aa314f75142ca0bf6120859

SHA512
d5dd299c92cb94612546bc309deb036dbd902dcbc784595571ec1b62205cde9501ea168bbe171218b366deca28cfa4d1ca0aa416684a8040ac23c8407d66c9f5

Download Submit
C:\Users\Admin\Documents\LockBit-main\README.md

Filesize
4KB

MD5
dc8d96087e0094c3cc793b3445bef8de

SHA1
8bf22f847b778daeccf43468516e775bcda2802c

SHA256
64312260bf9f040c92ece170d05250526f138f059760b8a5b9023d6d38e71db1

SHA512
f939d6a2b9a957a5c0c45beda2e0103a84bc907e2fef0b747c91144b23c5663de388d3076fced1a5a696bb45e7314fd86f19f8fdd668d0d1aac3947290276c2e

Download Submit
C:\Users\Admin\Documents\LockBit-main\builder.exe

Filesize
469KB

MD5
c2bc344f6dde0573ea9acdfb6698bf4c

SHA1
d6ae7dc2462c8c35c4a074b0a62f07cfef873c77

SHA256
a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db

SHA512
d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0

Download Submit
C:\Users\Admin\Documents\LockBit-main\config.json

Filesize
8KB

MD5
de177fa08e9b2eaa378760afd53be6b2

SHA1
a18050f9e5f2412955df4b868ffb866209d2b84a

SHA256
d121f4293160e0a39cbb184c032cd45baf1372db00cd33afb0e166ac0a60ac4c

SHA512
44f4e745013eaa7d95486c91457c23fd9694f859920766f0139cf5ca9c84ff6c82d59be9675dd1a0c7b3216464c85cf732dbbdb0e641a5e47cbbf1830f4a0a8c

Download Submit
C:\Users\Admin\Documents\LockBit-main\keygen.exe

Filesize
31KB

MD5
71c3b2f765b04d0b7ea0328f6ce0c4e2

SHA1
bf8ecb6519f16a4838ceb0a49097bcc3ef30f3c4

SHA256
ea6d4dedd8c85e4a6bb60408a0dc1d56def1f4ad4f069c730dc5431b1c23da37

SHA512
1923db134d7cee25389a07e4d48894dde7ee8f70d008cd890dd34a03b2741a54ec1555e6821755e5af8eae377ef5005e3f9afceb4681059bc1880276e9bcf035

Download Submit