lockbit | hxxps://github[.]com/BalletsPistol/d9fb74g8db7d8b7db48df7g8db77f4drb7er8db7fd84d7b1gdb47d8b7brt18bcy87gdfb8hfg74h87fh8bf18h7

Analysis

max time kernel
213s
max time network
206s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
31-01-2025 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/BalletsPistol/d9fb74g8db7d8b7db48df7g8db77f4drb7er8db7fd84d7b1gdb47d8b7brt18bcy87gdfb8hfg74h87fh8bf18h7

Score

10^/10

lockbit defense_evasion discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\utZMwPnzM.README.txt

Ransom Note

███╗ ███╗ █████╗ ███╗ ██╗██╗ █████╗ ██████╗██████╗ ██╗ ██╗██████╗ ████████╗ ████╗ ████║██╔══██╗████╗ ██║██║██╔══██╗██╔════╝██╔══██╗╚██╗ ██╔╝██╔══██╗╚══██╔══╝ ██╔████╔██║███████║██╔██╗ ██║██║███████║██║ ██████╔╝ ╚████╔╝ ██████╔╝ ██║ ██║╚██╔╝██║██╔══██║██║╚██╗██║██║██╔══██║██║ ██╔══██╗ ╚██╔╝ ██╔═══╝ ██║ ██║ ╚═╝ ██║██║ ██║██║ ╚████║██║██║ ██║╚██████╗██║ ██║ ██║ ██║ ██║ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ What Happened? All your important files have been stolen and encrypted and only WE can decrypt your files but if you do not pay we will remove your unique decryption software and publish your data to the public. How do i pay? Send 300$ worth of BTC to the following wallet, then contact us on discord using the username: ballets4 we will give you the decryption software after the payment has been confirmed and delete the data we stole. Bitcoin wallet: bc1qgngtzxgt3vcgx7andfl2temn3vt4unf5lmcqkj How can i trust you? Because nobody will trust us if we cheat users and whats the point of not giving you the decryption software. DO NOT try to decrypt your files yourself as this may cause a permanent file corruption. DO NOT rename any file as this may also cause a file corruption. You only have 3 days to pay, if you did not contact us or pay us in these 3 days we will release your data to the public and remove your unique decryption software.

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000027e36-417.dat	family_lockbit

Renames multiple (504) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Downloads MZ/PE file 1 IoCs

flow	pid	Process
74	2916	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000\Control Panel\International\Geo\Nation	4B92.tmp

Executes dropped EXE 2 IoCs

pid	Process
4340	Encryptor.exe
5736	4B92.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-849517464-2021344836-54366720-1000\desktop.ini	Encryptor.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-849517464-2021344836-54366720-1000\desktop.ini	Encryptor.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
73	raw.githubusercontent.com
74	raw.githubusercontent.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PP7d9atz77vq43ezzjdz1t8soxc.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPls3sz611tb8c1cnp72agahf0c.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PP2ocffq_bo0vau068mfrpqqbs.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\utZMwPnzM.bmp"	Encryptor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\utZMwPnzM.bmp"	Encryptor.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5736	4B92.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Encryptor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4B92.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000\Control Panel\Desktop	Encryptor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000\Control Panel\Desktop\WallpaperStyle = "10"	Encryptor.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 519187.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5660	ONENOTE.EXE
5660	ONENOTE.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2032	msedge.exe
2032	msedge.exe
4392	identity_helper.exe
4392	identity_helper.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
4244	msedge.exe
4244	msedge.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe
4340	Encryptor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeDebugPrivilege	4340	Encryptor.exe
Token: 36	4340	Encryptor.exe
Token: SeImpersonatePrivilege	4340	Encryptor.exe
Token: SeIncBasePriorityPrivilege	4340	Encryptor.exe
Token: SeIncreaseQuotaPrivilege	4340	Encryptor.exe
Token: 33	4340	Encryptor.exe
Token: SeManageVolumePrivilege	4340	Encryptor.exe
Token: SeProfSingleProcessPrivilege	4340	Encryptor.exe
Token: SeRestorePrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSystemProfilePrivilege	4340	Encryptor.exe
Token: SeTakeOwnershipPrivilege	4340	Encryptor.exe
Token: SeShutdownPrivilege	4340	Encryptor.exe
Token: SeDebugPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeBackupPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe
Token: SeSecurityPrivilege	4340	Encryptor.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5660	ONENOTE.EXE
5660	ONENOTE.EXE
5660	ONENOTE.EXE
5660	ONENOTE.EXE
5660	ONENOTE.EXE
5660	ONENOTE.EXE
5660	ONENOTE.EXE
5660	ONENOTE.EXE
5660	ONENOTE.EXE
5660	ONENOTE.EXE
5660	ONENOTE.EXE
5660	ONENOTE.EXE
5660	ONENOTE.EXE
5660	ONENOTE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 4484	2032	msedge.exe	83
PID 2032 wrote to memory of 4484	2032	msedge.exe	83
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 3792	2032	msedge.exe	84
PID 2032 wrote to memory of 2916	2032	msedge.exe	85
PID 2032 wrote to memory of 2916	2032	msedge.exe	85
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86
PID 2032 wrote to memory of 5080	2032	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/BalletsPistol/d9fb74g8db7d8b7db48df7g8db77f4drb7er8db7fd84d7b1gdb47d8b7brt18bcy87gdfb8hfg74h87fh8bf18h7
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd9b1946f8,0x7ffd9b194708,0x7ffd9b194718
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,2664721274647713332,4698287559873875391,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2232 /prefetch:8
  2⤵
  PID:2920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3456

C:\Users\Admin\Downloads\Encryptor.exe
"C:\Users\Admin\Downloads\Encryptor.exe"
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:5288
- C:\ProgramData\4B92.tmp
  "C:\ProgramData\4B92.tmp"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:5736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\4B92.tmp >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5168

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
PID:5568
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{9F82BB06-8A95-494A-BDC6-AEE16F2AC0D2}.xps" 133828076769550000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-849517464-2021344836-54366720-1000\AAAAAAAAAAA

Filesize
129B

MD5
eb06828367890ac8f2d4c170b3a1258b

SHA1
268228b869dca0de02efcfbd5d6fe36d20e397f6

SHA256
8585a0d78c0b6b429ab76732067670714c95eda56fd9c97b0c9aa507d7f63fbe

SHA512
c5827284c8fb63bdfd68b0d51b7ffe440809147fd99c6d82a4ba39ac9ab1e526a8c90e7679bc2904837995dec3fd03dc90c607eab166126cdff64eb113fe0e7a

Download Submit
C:\ProgramData\4B92.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbc1e718c546d417730568d48ebe699d

SHA1
eaeddd028121ca603bc558471291c51cf6c374ba

SHA256
7ddcaa9364dea891bf3d443bdaec5e3a6e007b535336ced81af9a645dbee5c7a

SHA512
096342fe5457bb099bf5bc9304bcb1e34b93edea049e5cefdae2cc01d4ee2a1f046cf963714918ac24565bdf6eaf049df52bfc17da16dbf40c5d79157a42253b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\06166c88-9e47-46d7-99bb-0f9c4bb97389.tmp

Filesize
5KB

MD5
689cfd9e06c66a6b56830d4b5418ab62

SHA1
11113c6ce80f3e362e3e80afff2378ccfeefcfeb

SHA256
fcba52b2a255bd6b0a1cf1317cd72fc9600e7d6e452c4ca6168e6cc1e38cab8e

SHA512
0fcf5d144b58ce463e1913580ee83c191933f73bc4b28a47dfa717eb359f8d3fc6678783087600c7f7ddc32ae213cf628059b7ac12651b3a64a48c61c6100363

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9901ec4e98f4eee7d8a3f98be9c4e1e0

SHA1
016e0478c1fa559a8dadf85ce2b20889126abbc8

SHA256
5d5ba30d652ee04aeb357fa2d9fa7aa76a1de5040856584fc73f4a9a4fefe48b

SHA512
0bc623ce4f6fcb7f64875e0cb943b59bd68016672e425312ac6b8d701441f5c4268b70d9e408d825d9ba7fca0403b427ca7c6784475b5835ae50e069fba5d2ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bf60566d4f9a8b827185580650c589cd

SHA1
ab87b4bd9dbc085fd59e15a9f44dc8fbcfeb5062

SHA256
925522c7ff74a35ce16ee62e639e1494e6c9e26b26df9e3ba3d1e2a63c143648

SHA512
b22efa6210f402dbf019d6d8fece4aa1c5ff557856a6407c8db06bc5b2f601b70210071a8c14bcb768d513ebc3337fe7dc64bff351292146a66d8eac6d42efe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
a7d1701142cca705f833d70023ef4e1e

SHA1
1b76853132abfcddb4fefac42bf9df5d013c9815

SHA256
6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

SHA512
806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
32a343478aee973ec889ef38dcb3eaf3

SHA1
4bc74c9818c556166d51b2d2d8cea09aa435fb10

SHA256
f7cf7b718bc3785ecf8f679d63ed3fe05b4ea5aa90b4675ad0ddfe0da4de344b

SHA512
d8b9feefdd3af65b418517ea47e764f4ccc5f6b89b886ac0bf7630e47292e5cea478e1cf05796a72f8590ff768eb4b25ce1daf026f117155887fc9d1054c8c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71c56052fe2bc1e845b075d44300aa5a

SHA1
bab5eaca28b0de833c74745f8df2542fcedcd867

SHA256
5f5c8b07e86a0bcfc83a5060dd7f0c5d07a0885011706c8e7c839169a74f6015

SHA512
a3cfb6fc0c891b998a0868bb7fea7c620f447613a643254613c1b3464e41260790d9309213b987a4297cf380cb83437f20ccea7528367539109a4e93324a5679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2a60be00cdeb012b0aae07a0eb67d52

SHA1
68a77e983aecc12316e6824ef94eba9e08fffaf1

SHA256
118cd3b67ea1ff5d645c2042a51e65f17b7abb4db8623c8f6abab09718b20bd9

SHA512
54db4539feead403f2af8b0089a3e065fb9eb514b05a9b5c7d603a5cf805c899f3741764001259185b77b0c3900b17cb35c8dbea7af02cb3a76c6ddf9327c87d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82487a948d7cea767c4e7b0c5d71ebef

SHA1
776913e8d6fe2a3b74c795cbef9bafd2cef97072

SHA256
ad1363780ee9942de00a6b39be5e85b0083abde7c26dd98b61788517685a6710

SHA512
d240bd5df80c8208f4124243e72c21dfc8d3f6d7f3991bce476e1596eb58fcc757cd6db94ea79dc56c0a9d7ab271fcb928a9f04b7b011f401d812ceec8bcb19b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5b6e0f8d24a51852d79147c7683a4583

SHA1
f3498eeec718025293fe101c1f30bbb1d155ad37

SHA256
8fc603c3a1de2750bd552bfd5d8d41a9cef73403910273681ac7d9ddc68c0d38

SHA512
d800532e39c32228ac69c570092838a8a9553aeb0c3906710af883bc6c91d0b090139189f492c3a9bb6ce9e361c98fb9446d56ad88fb7e41234795fdc1dd7962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a3e046dcc6bd60addc6e7071ef16baa

SHA1
6a7339e4b6f22df7ba4d20584c5349e13930e5d3

SHA256
436e6b2d76a40c2aa90f7ec68cb83a0a0087c2c6d6dae040fc690eff981a1bdc

SHA512
dd56fca000dd17c7a9abf71fdc545b2a8b4742fdfeade578db315ccff9e953c6700f3906181c5fe26ac3734cdc3eb5d88cc336c2d780c39f499879432a50b90a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59c039.TMP

Filesize
874B

MD5
ab7384194dff6ecafd695c9a3f6095fa

SHA1
462debd67cb5d6603a1beda2239656c9eeb34446

SHA256
143004c8d566b609d2f9d08e00a2228164dcad2846cfcfff183baa8de1c194d3

SHA512
3628170d82edb4d1cef15d6456132ece45e72265ce3a86618b0393a80726f4640a9e416eb6dc076f4f90a9d68d33434addebdff5f0ee47520639b79cc3b3c82a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d381b6408888d93229cae1b440b4907e

SHA1
5e2bd54163cb90375a852bf80f60ae9272207588

SHA256
03239df67453ddd7b75d9454a01b958d56bc5ae64dcd331fdef7e2801cb2abf5

SHA512
0164cc5686d5ad4a98ecf15307896c06a99445fbf322d26b3d24bc058ed5c1e17d00d17f0b6c16f3d26b686ab89ece34c911f7326126814842d7e6b6f43938a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1493c8319d88cb7e132d30fc227ecfdf

SHA1
0131fcf1f1184856690555b6ba576b873e243c44

SHA256
45608f80f2e9f634e3b4dc7677911ef4531bb56eaa9e74a66b11511735227c52

SHA512
6234af8e234c57374cf48900eecac42afacd330c838cb2b5513c9d007287365f5b2f88ddeb5542b59ba59ff30a3f628e04c5e90f23bc7a5f95e1d8a5fcbf0f81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
47ae665f577561c4a5373d6a86873954

SHA1
a8a088f4d8d45adfc0d07800dc87ce4f6a05a27f

SHA256
3a018bf481064caf518acf46823a0db191f9a8940231b8ad70d0b2c3f5e16853

SHA512
f6636fd63cbc84d987c17835949884a2100dc65705fef5fb5008f508e6e7e56412d8ecc714e06daa3e667d0b1733419a52b26e00d807e6ead75541da90e000ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cbef55cac6c6c3d9990bcdc902c26bf0

SHA1
5ef21d55624ea9ff0b00ac03bf9d3b016a00bf3d

SHA256
095ec02d72cc1b7d090aff8585caaeea5fb6446e07506a0def80ffaa871bc9e0

SHA512
885505ff698319a128a0a4ddf8be5da023ecf9056cdb17179dd3b7b480226afcfe18d33d10b9b57ff70af77ea6ba40550cb4aaf6349224a99c16aaa9e5f99421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
23b1c8e2c0479fd9a62d59ca2de71027

SHA1
2160d6892980ccbcd5537079fcdacda69f268c3b

SHA256
c7613ac4b50c37527bfe2256df6003744298898f957389421b09777b3b68a74a

SHA512
30f8ceaaa8f5a85d4ecc3b2afd17c454158c37780c52a974b11b4b97373a6ff2e51d936b8cd05b13902d2911d41bd739c57b1c66ea70eb4c0a13446dd2356409

Download Submit
C:\Users\Admin\AppData\Local\Temp\.ses

Filesize
279B

MD5
90853291fe432b9e14f04b6f972c3de6

SHA1
bbe1788f6291e924bf1ba614204198b012b84a51

SHA256
d2106ead758590b6c3cf88f23bc3a489aad8f046515903a9fe094bc7acbb40e4

SHA512
df64520bea99fe0a97089e27386ceae03ed221bcbbecc5bf59d80b299ce2df57159c8e461182fbfb78b06e03b3ca38ddb65eefdf96620698e062b4ac9881e22d

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

Filesize
4KB

MD5
01433fc4d928b3c0112bfeefcb1f3aef

SHA1
9097db6fea7d7ca69c5bb1e09dce43bc1835815b

SHA256
79518351ec08fbcf61f7644c4057a6a45a2989d852a6bd66dab62a0d95b6d7ca

SHA512
00679584ce1b83704077c371d5c91e81c8dc185171d91a6fab3e9b8340201f56dc32a7f3bc2d7e6873587a7fa0a952c14c1c2deba33a6dd7ffe6ec2671bb74cf

Download Submit
C:\Users\Admin\Downloads\DDDDDDDDDDDDD

Filesize
148KB

MD5
4f7a07719d49e49288d9f0137a2eaf91

SHA1
8c5f05253ee05ad446c540a00f795b6439d82a85

SHA256
f06d2e44f1133bf3fde847b5163a4205ec702420e8f386920f51defd996186a7

SHA512
f7d74bf8494196a11a1e8862a9e2b415b23c0422d0b5706d2c6a3f63d5eb545c6667a700876d4030ba40e350cadffdec1ff8ace481edefc3552a9c680461dc6e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 519187.crdownload

Filesize
148KB

MD5
475f6e42f0cb53fc60fa80022826489f

SHA1
b1dc8069d4d667af8cc8cbff950dc7a67a129cc8

SHA256
5fee867e93f672a561fedf8bb2d8525ab4a9146a51f922c88d34eb5c2d60561d

SHA512
04663b3c60b26fcde8e1b30c061242ec0356b467d62b17128a4c72608e71425f43f540a41a60ba5c88b8a50f3a78bb5fcdddeea68589ac83806b24e22ecd9335

Download Submit
C:\utZMwPnzM.README.txt

Filesize
2KB

MD5
d9e1661bc09300cad8aa8d795b9ce0b3

SHA1
1676ba84687a2d7b27f73f3a37500317ba0d30a4

SHA256
e2fa3f74d96324cd7dd0d611843e8102e897a8d65beac9d9491e8c42a7ada8bd

SHA512
9fdaa9b0f68c19eba772fcb5b2ceaf371a0b78435a296765c3dbcdc5890218523d5844708473a685cf12ec559163fc3c87928b12e46bfda92faf2c5fc2d57f7f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-849517464-2021344836-54366720-1000\DDDDDDDDDDD

Filesize
129B

MD5
252ef9cbc82f530ee1d120cdcb364939

SHA1
93b1275353dab843ec399999f2108d918847fd57

SHA256
9e9fdd16fda3aebf18c9891c49d52a79362aee7231f560bf92ae97d7997696e6

SHA512
d5883b4c3cd78048c9adc41d400c17b3cbdf47a586af8c715ba3500985a5d9ea9e988fb7fb985920f06f7b041c2a47538aa8e330b26a3ac04db334b3cf8c355c

Download Submit
memory/5660-2543-0x00007FFD6AF30000-0x00007FFD6AF40000-memory.dmp

Filesize
64KB

Download
memory/5660-2512-0x00007FFD68E20000-0x00007FFD68E30000-memory.dmp

Filesize
64KB

Download
memory/5660-2475-0x00007FFD6AF30000-0x00007FFD6AF40000-memory.dmp

Filesize
64KB

Download
memory/5660-2476-0x00007FFD6AF30000-0x00007FFD6AF40000-memory.dmp

Filesize
64KB

Download
memory/5660-2478-0x00007FFD6AF30000-0x00007FFD6AF40000-memory.dmp

Filesize
64KB

Download
memory/5660-2544-0x00007FFD6AF30000-0x00007FFD6AF40000-memory.dmp

Filesize
64KB

Download
memory/5660-2546-0x00007FFD6AF30000-0x00007FFD6AF40000-memory.dmp

Filesize
64KB

Download
memory/5660-2545-0x00007FFD6AF30000-0x00007FFD6AF40000-memory.dmp

Filesize
64KB

Download
memory/5660-2474-0x00007FFD6AF30000-0x00007FFD6AF40000-memory.dmp

Filesize
64KB

Download
memory/5660-2477-0x00007FFD6AF30000-0x00007FFD6AF40000-memory.dmp

Filesize
64KB

Download
memory/5660-2483-0x00007FFD68E20000-0x00007FFD68E30000-memory.dmp

Filesize
64KB

Download