Overview
overview
10Static
static
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
7Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
9Ransomware...KB.exe
windows10-ltsc_2021-x64
9Ransomware...KB.ps1
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.msi
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Resubmissions
31/03/2025, 00:22
250331-apdw1ssjs8 1028/03/2025, 22:52
250328-2tfd7avl15 1025/03/2025, 14:57
250325-sb3mbsxxht 10Analysis
-
max time kernel
494s -
max time network
515s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
31/03/2025, 00:22
Static task
static1
Behavioral task
behavioral1
Sample
RansomwareSamples/Avaddon_09_06_2020_1054KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral2
Sample
RansomwareSamples/Avos_18_07_2021_403KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral3
Sample
RansomwareSamples/Babik_04_01_2021_31KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral4
Sample
RansomwareSamples/Babuk_20_04_2021_79KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral5
Sample
RansomwareSamples/BlackKingdom_23_03_2021_12460KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral6
Sample
RansomwareSamples/BlackMatter_02_08_2021_67KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral7
Sample
RansomwareSamples/Conti_22_12_2020_186KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral8
Sample
RansomwareSamples/Cuba_08_03_2021_1130KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral9
Sample
RansomwareSamples/DarkSide_01_05_2021_30KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral10
Sample
RansomwareSamples/DarkSide_16_01_2021_59KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral11
Sample
RansomwareSamples/DarkSide_18_11_2020_17KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral12
Sample
RansomwareSamples/DearCry_13_03_2021_1292KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral13
Sample
RansomwareSamples/Hades_29_03_2021_1909KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral14
Sample
RansomwareSamples/Hive_17_07_2021_808KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral15
Sample
RansomwareSamples/LockBit_14_02_2021_146KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral16
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral17
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral18
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral19
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral20
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral21
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral22
Sample
RansomwareSamples/Phoenix_29_03_2021_1930KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral23
Sample
RansomwareSamples/PwndLocker_04_03_2020_17KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral24
Sample
RansomwareSamples/Pysa_08_04_2021_500KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral25
Sample
RansomwareSamples/REvil_07_04_2021_121KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral26
Sample
RansomwareSamples/REvil_08_04_2021_121KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral27
Sample
RansomwareSamples/Ragnar_11_02_2020_40KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral28
Sample
RansomwareSamples/RansomEXX_14_12_2020_156KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral29
Sample
RansomwareSamples/Ranzy_20_11_2020_138KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral30
Sample
RansomwareSamples/Ryuk_21_03_2021_274KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral31
Sample
RansomwareSamples/Sekhmet_30_03_2020_364KB.msi
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral32
Sample
RansomwareSamples/Sodinokibi_04_07_2019_253KB.exe
Resource
win10ltsc2021-20250314-en
General
-
Target
RansomwareSamples/LockBit_14_02_2021_146KB.exe
-
Size
146KB
-
MD5
69bec32d50744293e85606a5e8f80425
-
SHA1
101b90ac7e0c2a8b570686c13dfa0e161ddd00e0
-
SHA256
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf
-
SHA512
e01f976fcbfa67cfd6e97855d07350a27b67fcc825d4e813ac9d2f4e8f464bb4f8bbbbe58a26bc27e78fa15db0ee5271e8f041dd72f036c11964eb1c591b438f
-
SSDEEP
3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVcH:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMcH
Malware Config
Extracted
C:\Program Files\Restore-My-Files.txt
lockbit
http://lockbit-decryptor.top/?BC76D224712A7481EADA412145DE215D
http://lockbitks2tvnmwk.onion/?BC76D224712A7481EADA412145DE215D
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Clears Windows event logs 1 TTPs 6 IoCs
pid Process 3636 wevtutil.exe 4968 wevtutil.exe 1560 wevtutil.exe 4272 wevtutil.exe 4904 wevtutil.exe 5164 wevtutil.exe -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 8 IoCs
pid Process 1984 bcdedit.exe 1976 bcdedit.exe 2336 bcdedit.exe 5080 bcdedit.exe 3000 bcdedit.exe 2624 bcdedit.exe 4460 bcdedit.exe 1652 bcdedit.exe -
Renames multiple (6003) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 5392 wbadmin.exe 4260 wbadmin.exe 5796 wbadmin.exe 3000 wbadmin.exe -
pid Process 868 wbadmin.exe 4856 wbadmin.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-73851796-4078923053-1419757224-1000\Control Panel\International\Geo\Nation LockBit_14_02_2021_146KB.exe Key value queried \REGISTRY\USER\S-1-5-21-73851796-4078923053-1419757224-1000\Control Panel\International\Geo\Nation LockBit_14_02_2021_146KB.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-73851796-4078923053-1419757224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RansomwareSamples\\LockBit_14_02_2021_146KB.exe\"" LockBit_14_02_2021_146KB.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: LockBit_14_02_2021_146KB.exe File opened (read-only) \??\F: LockBit_14_02_2021_146KB.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File created C:\Program Files\Windows Defender\es-ES\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\svgCheckboxUnselected.svg LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover_2x.png LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main-selector.css LockBit_14_02_2021_146KB.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms LockBit_14_02_2021_146KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\ui-strings.js LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\ui-strings.js LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\manifest.xml LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_radio_selected_18.svg LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\ui-strings.js LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo.png LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\ui-strings.js LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png LockBit_14_02_2021_146KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\compare_poster.jpg LockBit_14_02_2021_146KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\SearchEmail.png LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC LockBit_14_02_2021_146KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ui-strings.js LockBit_14_02_2021_146KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main.css LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png LockBit_14_02_2021_146KB.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MTEXTRA.TTF LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment.png LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\ui-strings.js LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\ui-strings.js LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nothumbnail_34.svg LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007 LockBit_14_02_2021_146KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms LockBit_14_02_2021_146KB.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_checkbox_selected_18.svg LockBit_14_02_2021_146KB.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\Restore-My-Files.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\app-api.js LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\blacklisted.certs LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations.png LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\mpvis.dll.mui LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties LockBit_14_02_2021_146KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\br.gif LockBit_14_02_2021_146KB.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LockBit_14_02_2021_146KB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LockBit_14_02_2021_146KB.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 3 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1764 vssadmin.exe 4336 vssadmin.exe 3904 vssadmin.exe 5272 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 4700 WMIC.exe 4700 WMIC.exe 4700 WMIC.exe 4700 WMIC.exe 4796 WMIC.exe 4796 WMIC.exe 4796 WMIC.exe 4796 WMIC.exe 1252 WMIC.exe 1252 WMIC.exe 1252 WMIC.exe 1252 WMIC.exe 3204 WMIC.exe 3204 WMIC.exe 3204 WMIC.exe 3204 WMIC.exe 780 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 3312 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe 780 LockBit_14_02_2021_146KB.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3312 LockBit_14_02_2021_146KB.exe Token: SeDebugPrivilege 3312 LockBit_14_02_2021_146KB.exe Token: SeTakeOwnershipPrivilege 780 LockBit_14_02_2021_146KB.exe Token: SeDebugPrivilege 780 LockBit_14_02_2021_146KB.exe Token: SeBackupPrivilege 2684 vssvc.exe Token: SeRestorePrivilege 2684 vssvc.exe Token: SeAuditPrivilege 2684 vssvc.exe Token: SeIncreaseQuotaPrivilege 4700 WMIC.exe Token: SeSecurityPrivilege 4700 WMIC.exe Token: SeTakeOwnershipPrivilege 4700 WMIC.exe Token: SeLoadDriverPrivilege 4700 WMIC.exe Token: SeSystemProfilePrivilege 4700 WMIC.exe Token: SeSystemtimePrivilege 4700 WMIC.exe Token: SeProfSingleProcessPrivilege 4700 WMIC.exe Token: SeIncBasePriorityPrivilege 4700 WMIC.exe Token: SeCreatePagefilePrivilege 4700 WMIC.exe Token: SeBackupPrivilege 4700 WMIC.exe Token: SeRestorePrivilege 4700 WMIC.exe Token: SeShutdownPrivilege 4700 WMIC.exe Token: SeDebugPrivilege 4700 WMIC.exe Token: SeSystemEnvironmentPrivilege 4700 WMIC.exe Token: SeRemoteShutdownPrivilege 4700 WMIC.exe Token: SeUndockPrivilege 4700 WMIC.exe Token: SeManageVolumePrivilege 4700 WMIC.exe Token: 33 4700 WMIC.exe Token: 34 4700 WMIC.exe Token: 35 4700 WMIC.exe Token: 36 4700 WMIC.exe Token: SeIncreaseQuotaPrivilege 4796 WMIC.exe Token: SeSecurityPrivilege 4796 WMIC.exe Token: SeTakeOwnershipPrivilege 4796 WMIC.exe Token: SeLoadDriverPrivilege 4796 WMIC.exe Token: SeSystemProfilePrivilege 4796 WMIC.exe Token: SeSystemtimePrivilege 4796 WMIC.exe Token: SeProfSingleProcessPrivilege 4796 WMIC.exe Token: SeIncBasePriorityPrivilege 4796 WMIC.exe Token: SeCreatePagefilePrivilege 4796 WMIC.exe Token: SeBackupPrivilege 4796 WMIC.exe Token: SeRestorePrivilege 4796 WMIC.exe Token: SeShutdownPrivilege 4796 WMIC.exe Token: SeDebugPrivilege 4796 WMIC.exe Token: SeSystemEnvironmentPrivilege 4796 WMIC.exe Token: SeRemoteShutdownPrivilege 4796 WMIC.exe Token: SeUndockPrivilege 4796 WMIC.exe Token: SeManageVolumePrivilege 4796 WMIC.exe Token: 33 4796 WMIC.exe Token: 34 4796 WMIC.exe Token: 35 4796 WMIC.exe Token: 36 4796 WMIC.exe Token: SeIncreaseQuotaPrivilege 4700 WMIC.exe Token: SeSecurityPrivilege 4700 WMIC.exe Token: SeTakeOwnershipPrivilege 4700 WMIC.exe Token: SeLoadDriverPrivilege 4700 WMIC.exe Token: SeSystemProfilePrivilege 4700 WMIC.exe Token: SeSystemtimePrivilege 4700 WMIC.exe Token: SeProfSingleProcessPrivilege 4700 WMIC.exe Token: SeIncBasePriorityPrivilege 4700 WMIC.exe Token: SeCreatePagefilePrivilege 4700 WMIC.exe Token: SeBackupPrivilege 4700 WMIC.exe Token: SeRestorePrivilege 4700 WMIC.exe Token: SeShutdownPrivilege 4700 WMIC.exe Token: SeDebugPrivilege 4700 WMIC.exe Token: SeSystemEnvironmentPrivilege 4700 WMIC.exe Token: SeRemoteShutdownPrivilege 4700 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4924 wrote to memory of 780 4924 cmd.exe 85 PID 4924 wrote to memory of 780 4924 cmd.exe 85 PID 4924 wrote to memory of 780 4924 cmd.exe 85 PID 3312 wrote to memory of 1152 3312 LockBit_14_02_2021_146KB.exe 87 PID 3312 wrote to memory of 1152 3312 LockBit_14_02_2021_146KB.exe 87 PID 780 wrote to memory of 968 780 LockBit_14_02_2021_146KB.exe 89 PID 780 wrote to memory of 968 780 LockBit_14_02_2021_146KB.exe 89 PID 1152 wrote to memory of 4336 1152 cmd.exe 91 PID 1152 wrote to memory of 4336 1152 cmd.exe 91 PID 968 wrote to memory of 1764 968 cmd.exe 92 PID 968 wrote to memory of 1764 968 cmd.exe 92 PID 1152 wrote to memory of 4700 1152 cmd.exe 145 PID 1152 wrote to memory of 4700 1152 cmd.exe 145 PID 968 wrote to memory of 4796 968 cmd.exe 96 PID 968 wrote to memory of 4796 968 cmd.exe 96 PID 968 wrote to memory of 1652 968 cmd.exe 98 PID 968 wrote to memory of 1652 968 cmd.exe 98 PID 1152 wrote to memory of 1984 1152 cmd.exe 99 PID 1152 wrote to memory of 1984 1152 cmd.exe 99 PID 968 wrote to memory of 1976 968 cmd.exe 100 PID 968 wrote to memory of 1976 968 cmd.exe 100 PID 1152 wrote to memory of 2336 1152 cmd.exe 101 PID 1152 wrote to memory of 2336 1152 cmd.exe 101 PID 968 wrote to memory of 4856 968 cmd.exe 102 PID 968 wrote to memory of 4856 968 cmd.exe 102 PID 1152 wrote to memory of 868 1152 cmd.exe 103 PID 1152 wrote to memory of 868 1152 cmd.exe 103 PID 780 wrote to memory of 2892 780 LockBit_14_02_2021_146KB.exe 106 PID 780 wrote to memory of 2892 780 LockBit_14_02_2021_146KB.exe 106 PID 780 wrote to memory of 3040 780 LockBit_14_02_2021_146KB.exe 108 PID 780 wrote to memory of 3040 780 LockBit_14_02_2021_146KB.exe 108 PID 780 wrote to memory of 4940 780 LockBit_14_02_2021_146KB.exe 111 PID 780 wrote to memory of 4940 780 LockBit_14_02_2021_146KB.exe 111 PID 780 wrote to memory of 472 780 LockBit_14_02_2021_146KB.exe 113 PID 780 wrote to memory of 472 780 LockBit_14_02_2021_146KB.exe 113 PID 780 wrote to memory of 3056 780 LockBit_14_02_2021_146KB.exe 116 PID 780 wrote to memory of 3056 780 LockBit_14_02_2021_146KB.exe 116 PID 2892 wrote to memory of 5272 2892 cmd.exe 118 PID 2892 wrote to memory of 5272 2892 cmd.exe 118 PID 3040 wrote to memory of 4460 3040 cmd.exe 119 PID 3040 wrote to memory of 4460 3040 cmd.exe 119 PID 3056 wrote to memory of 5392 3056 cmd.exe 120 PID 3056 wrote to memory of 5392 3056 cmd.exe 120 PID 4940 wrote to memory of 2624 4940 cmd.exe 121 PID 4940 wrote to memory of 2624 4940 cmd.exe 121 PID 472 wrote to memory of 3000 472 cmd.exe 122 PID 472 wrote to memory of 3000 472 cmd.exe 122 PID 780 wrote to memory of 5340 780 LockBit_14_02_2021_146KB.exe 123 PID 780 wrote to memory of 5340 780 LockBit_14_02_2021_146KB.exe 123 PID 5340 wrote to memory of 1252 5340 cmd.exe 125 PID 5340 wrote to memory of 1252 5340 cmd.exe 125 PID 780 wrote to memory of 3020 780 LockBit_14_02_2021_146KB.exe 147 PID 780 wrote to memory of 3020 780 LockBit_14_02_2021_146KB.exe 147 PID 780 wrote to memory of 4792 780 LockBit_14_02_2021_146KB.exe 128 PID 780 wrote to memory of 4792 780 LockBit_14_02_2021_146KB.exe 128 PID 780 wrote to memory of 2512 780 LockBit_14_02_2021_146KB.exe 130 PID 780 wrote to memory of 2512 780 LockBit_14_02_2021_146KB.exe 130 PID 3020 wrote to memory of 3636 3020 cmd.exe 132 PID 3020 wrote to memory of 3636 3020 cmd.exe 132 PID 4792 wrote to memory of 1560 4792 cmd.exe 133 PID 4792 wrote to memory of 1560 4792 cmd.exe 133 PID 2512 wrote to memory of 4968 2512 cmd.exe 134 PID 2512 wrote to memory of 4968 2512 cmd.exe 134 PID 780 wrote to memory of 1852 780 LockBit_14_02_2021_146KB.exe 135 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4336
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4700
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1984
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2336
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exeC:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe2⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:1764
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:1652
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1976
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:4856
-
-
-
C:\Windows\system32\cmd.exe/c vssadmin Delete Shadows /All /Quiet3⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:5272
-
-
-
C:\Windows\system32\cmd.exe/c bcdedit /set {default} recoveryenabled No3⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
PID:4460
-
-
-
C:\Windows\system32\cmd.exe/c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2624
-
-
-
C:\Windows\system32\cmd.exe/c wbadmin DELETE SYSTEMSTATEBACKUP3⤵
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
PID:3000
-
-
-
C:\Windows\system32\cmd.exe/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest3⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest4⤵
- Deletes System State backups
PID:5392
-
-
-
C:\Windows\system32\cmd.exe/c wmic SHADOWCOPY /nointeractive3⤵
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY /nointeractive4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1252
-
-
-
C:\Windows\system32\cmd.exe/c wevtutil cl security3⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\system32\wevtutil.exewevtutil cl security4⤵
- Clears Windows event logs
PID:3636
-
-
-
C:\Windows\system32\cmd.exe/c wevtutil cl system3⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\system32\wevtutil.exewevtutil cl system4⤵
- Clears Windows event logs
PID:1560
-
-
-
C:\Windows\system32\cmd.exe/c wevtutil cl application3⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\system32\wevtutil.exewevtutil cl application4⤵
- Clears Windows event logs
PID:4968
-
-
-
C:\Windows\system32\cmd.exe/c vssadmin Delete Shadows /All /Quiet3⤵PID:1852
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:3904
-
-
-
C:\Windows\system32\cmd.exe/c bcdedit /set {default} recoveryenabled No3⤵PID:5976
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
PID:5080
-
-
-
C:\Windows\system32\cmd.exe/c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵PID:4060
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:3000
-
-
-
C:\Windows\system32\cmd.exe/c wbadmin DELETE SYSTEMSTATEBACKUP3⤵PID:1660
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
- Drops file in Windows directory
PID:5796
-
-
-
C:\Windows\system32\cmd.exe/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest3⤵PID:4700
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest4⤵
- Deletes System State backups
PID:4260
-
-
-
C:\Windows\system32\cmd.exe/c wmic SHADOWCOPY /nointeractive3⤵PID:3020
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY /nointeractive4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3204
-
-
-
C:\Windows\system32\cmd.exe/c wevtutil cl security3⤵PID:4992
-
C:\Windows\system32\wevtutil.exewevtutil cl security4⤵
- Clears Windows event logs
PID:5164
-
-
-
C:\Windows\system32\cmd.exe/c wevtutil cl system3⤵PID:1100
-
C:\Windows\system32\wevtutil.exewevtutil cl system4⤵
- Clears Windows event logs
PID:4272
-
-
-
C:\Windows\system32\cmd.exe/c wevtutil cl application3⤵PID:2040
-
C:\Windows\system32\wevtutil.exewevtutil cl application4⤵
- Clears Windows event logs
PID:4904
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:2312
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4428
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:5472
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
5Clear Windows Event Logs
1File Deletion
4Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5b7b0efadff656f142c8e41c85374c653
SHA1cf02ac7c65e2e2d4aec0f72f21acd7a41684285f
SHA25627105b20c5aece064bf51b4559a52f68ca273a680adb01dcee2318e9a902d058
SHA512bc0c4fbca76adcc537590d6a86c78744ad85f2ca8cbc924cf18cf1b398c0b989a584220e5114c3000ae006844565bf5a5939851a1d7c4b9e01735ba5efa98d97
-
Filesize
4KB
MD5f3f2580f54266959b6fe2d1fbc60cc34
SHA1f628bceee1257cad785f31924a8de2a26e4b9235
SHA256c27d066f45ca16ee8f46a0b3acf637f56efc56cab5959c5ce4afd5bea8aa8ea3
SHA512c83b7712dbf1c2082065b72181f9d4d421252dd786afa126c12b301db9ec82fc3a7ec412a442150c6529cca997d4d7cd6d6c7d6acf6f7180a8ec4801346d7fa6
-
Filesize
4KB
MD5b98665be9a8375ee5c577865ca5bc953
SHA19cd6c27cd47c3189f7e93dd6da63894d0a365a99
SHA2565a78dd5cf876e0a2c4d28153c2969bd48974dec097f1cece677d8743c776e08e
SHA51294a06d738724a1eeb3093ea9f69c24f618d4bd3a561c4a9dd5d10e7aafe56974685aa10a74d3aa1f61bceff5d91f663ff5b7faf90812865fce7d4e3cdd35e8be
-
Filesize
62KB
MD5e0983e28a095c19f117c1f6fe10404f8
SHA1ae1aa6a8773b745d66203c138b89a9c063eb56dc
SHA256acac984295ec52267007d98521c908356ce1e713cf9beabaea5cd0b5cab490c8
SHA5126b09ad99864d0f8a46760e8dbff2613ceb1f0eb4f4e20a1e73cfeff3cc49ebd3243b85b2c6a6ea4656f27316c62005169c376eeee26a75aaa6ea5832ac12a3ae
-
Filesize
4KB
MD53cddf3e08aba4dbff1ac53ad54928f89
SHA12974f65c9819f63411075e41e7d2f24b70c8a536
SHA25683680fc622ae3afad7565a1ea15d35798da68ae03b8630d36b5fee2c1c057466
SHA512076ad459a8b4c24e5446bb50f4baf5bcc5851e4d519c19a956b9309971b8312c6b15fb3fdf95a5f14c414b26d69c233aa521396297fb229cc084cb054876a331
-
Filesize
51KB
MD5edd7660e1d7af5852df225847135740d
SHA1c688795b80beaacc2d043d10f4b5e530a4b439a5
SHA2561715740667446dc64dafe907cff7606a1f098cac36cdb137669155e6ea17af5f
SHA51274e53aefe0705bb3f1827df23685f303ea908d3672d21580053aa0607d4fd371f663f453791745edf7e2400993e7257ad47a86c59a23673edbcc652736b637cb
-
Filesize
4KB
MD5f9d0b3cfe851dfb81656078ff7678b16
SHA1d5b5c20107df2cfbcf5d4f46523e63316f1f2e4a
SHA25681b3e43b330663563cf519e819789cbb3bcdd830098b165557b5ab7557d09bb5
SHA5122e676d85a1ebdfb60ff3a2b106bd36f5a003c76511b8873fe7803c31189565f93d9a6d68470899ef4059431aa89d32254a52f9121db7fae271d65aa4cfe9cd60
-
Filesize
59KB
MD5c22b80a64d771d0aa7cad590b1a0e526
SHA106185470608b8d36cf923fd31596ae855b8e9fbd
SHA256261f6f22745512a9e7fcb612a71dba0c400a748cc755f0dab076770286df9653
SHA5120a5bdc2e6ddfc4b289aeb6e998424e242b8de5b17ca76af7cf19fb9098e1f6a14b9bd5d998edf3d4e7a53268d05942658afc342b2addfc83d26e06f2e4aa8d1f
-
Filesize
4KB
MD547222433c66d4a205d354b7f5e9f2c28
SHA1d030c967011bf607b4b244c2e04cf164b021d617
SHA2562766fbc8e7ebcf4509822ec86a2bc6327de5c4d2d54dc0b5ee4a003001e59957
SHA51267e189fc845c04d2ef7fecb38c41367a53375923ce4bbd7838b19748e10597d2eb12bb7e1581b8fdcfd72ca0e51b98e20ec1be9e35d11d3c0f07810cfd960838
-
Filesize
62KB
MD5535e5663352bdb36b7babae594f38d93
SHA181cf8a0086d539fd2b3571e1da1e301d7747a652
SHA256715ac2d1960fd6be01149709f3397bba58cdef5fde3086dda8ad44924778ec3a
SHA512f752335591cf11d8a1f20b95b63b6230ed363e31a7f19c937be51367b604ec42064b7626a1a67f46074cb287db0c8ac27e7b06dc0d8ce1a502f92ebe8726be51
-
Filesize
4KB
MD50997fdac23455a2c33c1517ba9fe9927
SHA1e05055a8391d7b8412636523aa3f60c9a8c5c923
SHA2569aebed244e6a25c10ff948545dc69d7a1f38097e3c45557b6c4ab3651d7da737
SHA512a7e1cbfe804a3c4452af1bcc5e7f45899a91a05f4942ab37c77f31da79f89b296df91b92a9f6151066b684db7d4fc8b85fa06d543ed7e5a5d5e388748d4a40b0
-
Filesize
59KB
MD53490713ec850a16c4a16014d43c35e3e
SHA19b394802bc2c1cb97105ca09671d2d817ed34cbf
SHA256eb4e821d05279e9616818b8cfeae012ccab60ff97ae33114f8a2225f1408e766
SHA512187b251f74ea907a7ba52a71d7f5eb7b298e9a09e4e12ed447ac43a4ae36c43824077e57f70bea1fe035f4c68d12e6767508b6178eb848bef2386f2721602683
-
Filesize
4KB
MD5ab111e878c3c19cbfaee1c8eef0dd736
SHA15752b32c1b964d6c01869f5835340d821e265853
SHA2563caf6c0eb9068e40b31badc01f613aabf6c6e92ae1e9b9bf155e9e49a2cafda8
SHA512f68ac057ead63653b1d03f5d194fbf0800ee1665f97c506cc489ef8c881f2232d53a2638917166ba7f8753c713a1e7c3117a004d180e4115bbf299411b2886a5
-
Filesize
33KB
MD5ff8524c9b4642c991924d5aa9bc28db7
SHA1497a021d84a055508bf53409dc36098037412de7
SHA2567970b82933588ed7c541584d7c56a4de1dab64f77f86595ef0e257bb03763c25
SHA512a9d5c9cac8b24cb38ab7f63e6a591d0f767f286e13354c05280483d0b23e36ccc5c232f405a08592446d23d247ccaa1742618e8acae98fde8002e629efbb2326
-
Filesize
4KB
MD59175be6ac502e77706a5c9b52e814224
SHA17ffb4d00fa1a72d1579e49d3e189c0edf1f4ef68
SHA2564ddf38e7da8accabcf5d77b0598387f55ccc64d8bd0413d67161484c32b96f25
SHA512762a80886670eb2565c798dcf7e0af63275601d76dd64ad9dab96cb6501d020929f6aef6552840c87353510a4266063c41567a981cc20ed87f11168c2304b044
-
Filesize
57KB
MD5629c0bb7fa9bdc16f6b337d1f246d0d6
SHA1712dadb1e5fb7749efe157576c1090f349f025b4
SHA25678c52bc750946bc1ed7b4a86ae2ffc3f86416a784ca34291c52913f17c694cd8
SHA5121b44319c95d4ffe9ff454c65a0af059afb985bfbcece85b948af898ddc0e7ca80599d7ae5a06fc93d197f9141cb45c99ad78aa315f4f45ce27bb06b94bd6af38
-
Filesize
4KB
MD5e92354a97635b0298ddfe8180d10f25e
SHA1bd0013c2269cc9e5d24b2909939c467606cce88c
SHA256c83eb82d787240e7f09e8d59afe84f60c438d8cfb46072ea32437a5c3b6bdf71
SHA5126eb5bd18248b1e8892bd0b0cc1093bed3c1a59d0772136f3f04a72bc54b1103055fe67f02cadb1d746899e2850cee260d64e79783335bbba898791175be59ab0
-
Filesize
4KB
MD5881261664681479de488df7fda45bbd9
SHA16824fd930a53b5e036a4273caf2ed282e10a56fc
SHA2565c9efb4119bb244e5f3267fa60167d8295a9a3f9e3d8b25b1773cd2300c1400e
SHA51253d52535f1b5934ca18f46b1c9ffbb948052277789d343c24b2b4b7f226ba231de10480acb677d633b8777327981ab0de1f480f6e6412f02a37f3dedc34661b2
-
Filesize
63KB
MD5d32100e0d22888cf5f1c04c5aebd72b9
SHA13603ea60d127d551d7d2df711fe7603967249fe6
SHA256d637bd343e04c6ed49e9164fc65280c41cf9958c80f1b5b78ed7c83d83503bd3
SHA51229b7ac1a246a20441edb6926a4151a65c5d591a467d9f1f5e04911804e46bf0c13d94f8db78bc8ac2133f8d9431ff105a5e6cf569bc407f4cdf0e1637b8bcee7
-
Filesize
4KB
MD5c22d773ffcc19b8d7d7acf0f33ce267a
SHA19a2bb6a1173e9491f85a58b3f5f14e9f5e5d7686
SHA2565c2e0c9eba38fbfd57ee4223759d1b37cd29fbe418f373e9799f4db03ff8aeae
SHA512462106b2308c9089a035c8fb5ba64212ed8333921a16a3f8f469af8c5e1d2be4b41d90959f5a5e3104ff46b11f510a0456d350f656c7c16d543f3a18e321a5cf
-
Filesize
4KB
MD57f35d92e7dd561cb7bbe4afe219cbb04
SHA1cb8793148d7d00ea75fa691924c2c17feee7e1fa
SHA256ac55abe62ae4e036763c9ab8a31e68e762d979b1a1acea6854cbde868f307730
SHA5121471d1bd33d97713ddeff74e05dcd22dfb30feab667dfbde025fadf161d15947634de92d28aa49bc19395a560ef291e1de1d12abe8220a8accaa7dadbc008d69
-
Filesize
6KB
MD5bf573738fb1d7355c9c9b561182e7052
SHA168bc74a7382bb927035a712638e0ffad31d202d7
SHA25629789bdcd94e3ae45534ae75d14775d50cd069af7b56f168f55320a596ece51b
SHA51278526e0de9773c1434c64caa4091bf7586326c0974a34d79508a8e45f71f78f30a475d927d8322d3745d362a95b1326f994156691149a4a9f5bd770a1a34e5aa
-
Filesize
4KB
MD57c39f0567b261bb0b86082edd6126f07
SHA156933b64a31db9afcd959e86d9b049d67ff04c3a
SHA25613b0d21c7f151f961aaebe8c426e90f69a49fc620ca7f1eb7d37e70947ddb826
SHA512a9a681716898bff79a0b1211ed3971e63bc56c92c09dd75fb7320d9cd64853443d594a1fc3b3bb37584d79612704f31f5d703cdd70d2f68b72c28560552e4bdc
-
Filesize
4KB
MD5b2e9145f069ab3079d27a8b3e0b7b64f
SHA18cd33daca5a3139dd6200e2ae0e88036c6b92c17
SHA256d7b18377fb33e84d64da28af8b875a8c60f7ad5a7a9bedecb105ba35ffe931d9
SHA512d4f7562d22d8789cf2d610c897eb1de5c12b5d88b716146207a3a36e7626baad1728519204b621cb3ea7e32109081b8d2731ee74fe456ce17b06d119ea0d4495
-
Filesize
4KB
MD5be86ac0a364d7b6ca52eb34d2a86cd82
SHA13108368c4f41063db2e7125fab789a72764fad83
SHA25640e6f64f16ce213b8ffde46b90330069a1b40f53bc78002b1308cae37666f81b
SHA512d3cd23f16ed20c32f2342f6e9781421988df783276b3ad8a3375bb8f6477855e829b389fdff840fb202b8f816e5af6058f6fdb26421069e889002713185553e0
-
Filesize
55KB
MD5ed41cdaef117ff4eee8f1a49867fed3b
SHA15826653ce78d33eb079475352b3aabc9b4e0d919
SHA256aa967408f116c47609581ecaa8b37e67d7bb975f8ee86b6b0fb9823e625bce35
SHA51285ab7ff40d255601307db0f77674d9be59a1686399506df00ca8f3ba4b2df87cc85b7d5990a2aecdfe805121fae8a8d8fa09b2d5be1a134c93fbd82c652b380f
-
Filesize
4KB
MD53239930e72d6f7665c2069eb00e11072
SHA1f2e36a74ad61a4abfcc825bd3f4b015187e4c7e6
SHA256ef16f5ea9ac4bcd23528946e4b272be693a0186608328e09f3fb5a2670941c79
SHA51229a8877bddc58d13b71f26a89575de3e31227e8c6fa75796d1a98dc870a13e509386893b9393787bc28512fe042648ed2017fc07057bf6b5fbc0724c11e07ad0
-
Filesize
6KB
MD5f304134861b0fa2c072084fee10392d1
SHA120fd6fdd97538067df6dab6d44fb9a78e02385f1
SHA256f96b5bf1cde99c5170b74fc50032739459cef2f91cfd86e51299a5a83c4e4942
SHA512dfb957e927c6edb1dc798de48f5ee59d0948719f602a739d3a3043ac60a6e53968856a403f34674fbc8c55581957fc1833a3e14d81c3b98983ec3785673b8307
-
Filesize
4KB
MD5cdea2fadd61653301d11db2bc7333997
SHA1674593baa700626726bcfc2300587b5e6eaa3ede
SHA256a7a0d00475e185fc4a5aed49dcbf79429813a127da5db7d147642b7496a98641
SHA5122bfc6914a1f3c7bf6c7d7d404821848f58e28c83dacfa6bbf3f4f54852bfed3d9c3521013b79752cc575147a4729d10e349c14eb789d076ded374d9aeac6ccea
-
Filesize
4KB
MD5db2ca78f6a5fb92f6c63c6117b73590d
SHA1928df76a5022be7c9daf1dddd40895c690cee4a6
SHA256cb9830bc46335b666a14f22659436c8dd25136500e6dd7a3a5fb8ea5b949a22d
SHA51250d9b7f373066605e05c47e4b62f6c2592724b9bc42ef2b7bf606f4af1892e8dcedc90a47f2e97dbc8150b4c29d7a192853a48e386cc8ec2c614f2d08ca5a1a2
-
Filesize
4KB
MD5a9daac284b676b2c32658bfe8450e682
SHA1acb7f30574269d693dbee5e1b7ba42ea3a880fe6
SHA25697dfa78536223cd4eeb34042d863fb24cbb43d8e9653e8a484f8c4ec99bb9db5
SHA512092f7956fc899e46305812c83eb7b8ac1e33849336591425ce15ff9c40950f2154fb6092b290f2d286e2528548ad3f88c67808004c3ab429c2d292b4b9b5e018
-
Filesize
63KB
MD5353591f440db1055b6e2c043e8fb2977
SHA12666bb0b623cb55a46d166d748834b3948e35280
SHA2560e65d5fe1d0e82d5464d3cb15dfd75503594c51161017985d16ee7e9ce615ffb
SHA51268a21c570cf0d718666085607d3ee96d009832ba1d97099ac186b690a07dca1792ca5ae7eb70121f2bce8d43ce3ebbbca97f2bebd68d4cc4cb6d111a9a3f9db3
-
Filesize
4KB
MD5058bbc5c308f7e0be49de59dbd8ce09e
SHA1030a7964dda57fecdbe21263f66b81d72c059d94
SHA256aaa95a7810e3e957f4642ed58207051bca8532652c9415163b82f7c1adc45dbe
SHA51263a249622d067669915a0eea26da56e18de5f68972b27ba6deec24dfb42a61ace41dd9b28c139fb1eafa291977af44d73471252744ad5d68af7c853cc7ee4a53
-
Filesize
5KB
MD594d71012cc3d725ae694012e9dd44d96
SHA10c4067cae5d304ef639ad3d150495abf1786936a
SHA25612ed7e963dc2c92133c5c882ac042663943534e08130a5b6fa7c493a141b7232
SHA512c125bfcf73b955c0043b1d80081b390ecf4b7332c2d25800e006b5ad4e5b4884dd8e613e7c5fa0250545e0f1f3d4bca29c6bbd47c058ced0ea18755edd157c31
-
Filesize
6KB
MD552d40feb167a44da9fc23ec6aa8d09ef
SHA1165e9e774d8c3b915994964566a1f952e0f957c2
SHA256496b279334979f2960ecd90dcc2eef0a524f3a1ef4edfb574593fd559f332ba0
SHA51280ac6f633eaa6922ed2df7994469468ded34c1437943b6759cc8259a890576f2b01e1e071f87bdb0f068093ddb315d3d9cd4c207f0bf08f1d57202c37b5f909b
-
Filesize
5KB
MD579891adad63feded837c07e912632f5f
SHA14990c6cc75df578fd692a3cbe51a632ad5127911
SHA256ff30309e7314f9d719accbdd4d20b625fee1c031ffea4d23309ded0bf4e3c2bc
SHA512ae20185f356638b604179b4432aa118cf5d49c5172d589eabb77602bf89d0cc724cdc2ec6b8db50ae96bdde535ba4b246199ca8a6ed4e032a2032b2c9cf7c87e
-
Filesize
4KB
MD5fcb493440e5a0a97d5fd1c30f2c35624
SHA1509d638153f77d7ac2b5ffad8d095cb7b37b8d38
SHA25677d65dac8fcb6543cea025667f0ea43680026bc185335f5f54068f1effc31220
SHA51211bf9759660d1f1e6be57bd39663e7fa22293e929e8b21918a4ab129de03de8a56563383cc8e9e951ec0339e3fa3ba73ed2fb53dd5f3137b435874a810031a24
-
Filesize
4KB
MD58e9804e5776e80c9a0fdc90a6241e39b
SHA1744baa37376fb7346f1e4abc81c548646f556849
SHA25661040d4665e3599bcd9c6d3212178eb2afd9b52d67f11b7a808c17f3da704da8
SHA512ffa605ab5f7dfb485071f3d8da64f72f46d191826380fe846dad0777459a4d0f73405886856154cc5c06d93ab36c4094dd48ea355451bb107168f68ad80336d9
-
Filesize
65KB
MD5fbfbbac46b4036166810356fde364259
SHA1a3eb9091275e9ec61a86189638dfa37bdd21c017
SHA256769bb3f25112d39422d08b8067628534a626e91bdcf7fad8d611fd438eca5319
SHA512dbf2745f6657cb7e104e7ce22b8315f1c754f1c60f579741561799c1643c141684a51deae3ab73b354c5b54ffe430393082be78ea9e635658165e4672dc5df0c
-
Filesize
4KB
MD59ea7af1d5f2a4a462632d98f7d20cf2e
SHA1697e02064075fab4da6ef7f18840d400d7234c23
SHA256f038da91abb3cb5e8d2c879f264dde45d452ee492d6f9f195b91654873449d0b
SHA51245104822078bfae7651285817796c37db2c4241df3c301992f88f34ec78f764b1abbd80f4a69dc23cbac9634594f8e05851f4910166f1a954640762b7eddfdf2
-
Filesize
4KB
MD5895b02fc3602407cb568a0aac571a7c9
SHA10ab5277cc10b331f0a82e9644468afcd34a2a3d3
SHA2566d15500fcb409547539648b719ce418f337756c1fa6800d54ece03b179568dc5
SHA5129e52ff9e69a351820c2f3c4a007ab622bae41d815d3d246407e7f8d8ac0e6299c8de6b43e8d98a529e14fc1361f0d0da08f1eba322007dd0662c52e0a6a27e8f
-
Filesize
6KB
MD5e2ef54c483f8a7540fec444ac22c6d75
SHA1b99b3314b1b37554e0a07ce1dd189731af6e73e5
SHA25664983037af68d376b9b58ba8ae08afd62efc61a6bcb0c0925545b2d7517b10d9
SHA512698f50fe7bfc42150dc6c0289f2fe49d36b192b0e2469476be6b770c823c639cdbfa387ccd3236f2f85e12b57f43079aded67a1c84dfd4d18e419a32b2570f73
-
Filesize
5KB
MD52d2908dc6a9fc5d94b69ebec7448fbdc
SHA12e17f36c00b9be0050aa8c94d91665dc26c95f37
SHA25676b435a30eeebee6f40ecb937e41d8bebf97d7c1afafa36ee91d9870679586d6
SHA5123d827a5e275686d0d79fc382e0a8d4645612fb8d00fad1666989dc6633b404cc59623c6e5dba34292d23eca08c28433dca588a5fb51fc3063b80e8edf3cfc91b
-
Filesize
4KB
MD58aa4866627fb87d0687e5186cf8d0fbd
SHA1c485dab3744bd6cb60d0c3c772ff2e44bcaee5e9
SHA2567f6aad2d0da993612e00456b4f56414708a21a69765d46d382bf2075de802fdd
SHA512967a8e7a06fd73748384cdee7ce1d3b63522965e6d804036b1fd5979c11f29f38bdbee50b2f0d5ebc6fbf1aa28262d48fb939455836cf94552391d30b0d4c1eb
-
Filesize
4KB
MD5acb6f90c15b9f37258b2f2dc57a23bc3
SHA189c7c04866303cb4a6664e1566ccf544ef0c5c79
SHA256701dfcfe36a2eff3f76affb0da2dc8ea2ec2f6cf42a201345da05c3b6f127068
SHA512e60631605918e3a3ddaf1c6c9e6cce345a5b502b3e901ce7ff81675c734d72f7e8689040f9953460ac16fe238b83ad6ad0ea4ee6989967d8534ce428c94e3827
-
Filesize
63KB
MD5be7909289e27cf652df83b9e61657b4c
SHA1f850574e79216740535d5c8316195d377e4eadb0
SHA256a1493cdddf601faa8d117f2e3c09f11df5294f499a838377bb737ecdd55ad360
SHA512132923fcb18b70190a145b57539fcd25128319c6b5b9b52e3c313962c125e95479212b747f776c6bad734f67dc67d5957319fa788c0c75bbde32ba949f632a4e
-
Filesize
4KB
MD53121592a712325a76568045d64b31b70
SHA145005cc33303e6f2e58e66de0d0ebbbdb31234df
SHA2563dfd3f8b7b98c819b06e7477e2ac0fe0233425da6754f3eff71b1a362f21dbf8
SHA512ec757db0e33a9ae1f81a51967a240dfc9a0a940f116f3b3f6a55f5b29ba31681066d7cdd6b107299c4ec52ab21ea8d6cdb440609f85b184856c2dfbe808cc8f2
-
Filesize
4KB
MD5f02c0fe8a061c7aa378f5f2c7b7c3e43
SHA1816d313358490fd35edcb666f2722579c9aff41d
SHA256aa70bcd26b9e837523f10b1a3d3499a00c26a479a547c30f8f9b4d85fb6d2997
SHA512b0c2eb0e6fa22e7ade335d583d0cf282bbf78bd9ed05d00efb5e114598fc476bd8d7dcf5f8ec8eb9cb50e197a4f91305eb4cb2084d7038a71225262ab810b607
-
Filesize
6KB
MD55f3641fdfcab5f8f35824af5c8f0b566
SHA1f8a8816b97a3905661936091170cc716d0fbdee7
SHA256d789793e0e3d5830df05c11280d54539a7bff65f4c5cba9d2ececaf16fcc679a
SHA5123d0926ffe3b4614aef03c4b0264623010738577d3b4d922b7017779d7604fc7359a6fe9bbef9efc5d571ae9cba991484a39144ddb05b0bf2f4520ab6a201020c
-
Filesize
4KB
MD5ded39800fa79e962c4154a05f6119c64
SHA1b91eee3a49443b2aa8004e549c4b07a1670b6069
SHA25682be96464387cb9dd1d8f59563d46085e4158a0933aeba2b2138902f641d0bbd
SHA51279cff2ee0b607b36fa0d7d11044d3f2d8fbc7130531ff28ca552a0846e9c6e0f341a14d7caa45c15f1048192ce1d12503ee7a3bbd4a8aa64f8ac2b68701858b6
-
Filesize
4KB
MD59b7f5f9a472b8690668f2033e7bc3a33
SHA1e9b5fd71d71a54398863c5b12f151c07e3f7fb15
SHA2569de331702464b51a9dae5e715fec2dd2ae3fb53e35f17b8e5d5141bf4db6f7d6
SHA5128d7a5176d5c47af2ba7b57f7781badd3c95d041ea2a6227fd110f78fd0a3add6e77ab8c5fe84969de4314ba323a9f79cddc5b3b89594e993e3a3de28fc23c4b7
-
Filesize
4KB
MD53253e46b703fed233043ecbc63ff2ddf
SHA18550955509dcc7c002d9a7a75daf35a6d469cdd9
SHA2564697555ea3d5ade18a573d7cd69e21370b8da1841b02aa5998171ff124bc033a
SHA512b52e4b3215373ed6d28921758c836d88679cb0597a7e44ef1a4c86abdc77b2e71ad706ed38df229c1c0aaae503dbacddcf9e3052419f002614489624a8439ef5
-
Filesize
41KB
MD5aa60b7aafb422f8e4efb397ee1c8c830
SHA166845284670ca85ef1bdc8ccde4e3d6516978a15
SHA256be3c76aa353c40c0df9218cdd1c90c93df42f27bae2bc2789bf34aef520ca699
SHA512b245fa648658d39595a87a5c24392d38a0ba8d168113f0a3cca3fc13a29887f0955629f562a6fc10352e1ca4e5e959b2ae507382d543a0ca5a8629222ed0963a
-
Filesize
4KB
MD5cd403f0db181f1078be4c6804a3b6ebf
SHA18f639d9986fb90515a8458b12680fa54ac0275f5
SHA256c5c631371cc580a7ee1ff5092a56e5ad1961ca63b6c462d9476a219000134176
SHA512516e1c638845298b3aa11fb1363a2a14c5d523ecf5ae004e29e954d053de4f5708b8a594dac99d2fce8fde7df02453c0b1e97b59b502ae3e74560fb057ea415a
-
Filesize
4KB
MD581b9661c5395710e3b57a9c51c07a38a
SHA1187477e09afdcba7195d1d768f1c5b7727aaa76f
SHA256cd40c0faa2f0c9b80be2148b3a223c80377bb16df0987f972c47b943f20fe2eb
SHA512d67f16ca6bcd68a958146d8d9e2746c16c9f768d9d9b4d44f951e5dfcdbe590f9fffe27bc4e1a4316386b6ce720eb96f348e3b78d41bbe903d923f04cda929f9
-
Filesize
5KB
MD56d13cf4609353386ff626c824cf49da0
SHA1d0e3197470b54baab945fa30d645db02714a9579
SHA256abb3f72513531756a60b111f557a5fdcc7a8594ae0d5aabae26152289bf1f307
SHA5126fa7ad9afab099b855110f13cd1ef7bd52ca41481fe4fbdf247625e8ada7e9dc1c3979e6432a1ccfd748bb6fc618c4e6f3ff45b5502d5cc9ea222fd69a266826
-
Filesize
4KB
MD5237241d3d8fb2a493966346a605ee839
SHA128d9f751b8ef29474e5d0157b2e1ed9f46d42fec
SHA256ce1ddca2c7babdaed64cad5e994570fd7a996c89c4e63e7d09d34e01a0965fbf
SHA5128436fd9077d7f0a50d3112bf1f79ce95d5e3300970da99ceeb71fdaf7ff915541d8b6dd90b4ee61b91471874cd1b7635deaf50e1787a28694f6a149c2f09a26c
-
Filesize
4KB
MD5831d460e6267f09f67d02cf04fdf7485
SHA1624d7be5aa35208d973cce4a61f229740cc3900e
SHA2567d54f66ea0c132e644f3e72c7ebcd396ca83e005e522d083858ba569c1df92bf
SHA512ada4017d10d1cce95d5873da4735bc308358edc4ba1fdbe73ddc84d7f192fb7e2107e7bd897f6838dd48dbe48c7c2ac1d8a7391b4f0b61e16af7a48703028be2
-
Filesize
58KB
MD5c7a5fecbf4a7464a33aa15ed862ca047
SHA1ff440994f3a39dbd8fbf260e6440bc15bf061f6b
SHA256e7a33f2a8f86fe974d4fb935489c0fd25850457a578fbf7985ca7dd4d9e02ab1
SHA512b15f2e7f131d220bc7eac18b08c9b38442624f9534b36f4f1f0010fb8dc4c9c6b0ef0ebea4d0879ac42458778f7ce003a7c81942e06b07274489e2470949bb55
-
Filesize
1KB
MD5ad49c9e7e6cfbfd8af68c07916dec3fb
SHA11b9423c204ca97aa17a222748f1ce4a4ab976522
SHA2562062c18fb5dd37d2d258f0a17ea7e3a8397bcc2bb8e03b00a5dc19c57af606b6
SHA512f71188c14fa42253a1e003b25056f7c8bce01d5afe96322fae8b9e1d915ad818c6be9c633f90bc345307681a2bc087c3b76218661e313a409bf11f56bcb68f43
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\AppxBlockMap.xml
Filesize2KB
MD522623df239bccad9996902a90c7eda16
SHA18332c40ab7dfc222da29c59ec344e7da4d0fae2f
SHA25666ca8b6ca3f405f555001934e9ecb330005105ab5993056d5692d37880d296d0
SHA512e5bcd6b5bbc5237d42f9636807ded468dd14003fac23cf7c787243512c91e36f03a19277c2511ee316857a4469e93d7a0e8e36a4bd28e53312add89b457460e6
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\AppxManifest.xml
Filesize4KB
MD592f0eaccd0682a34044a737dcc690b09
SHA103f98df9bfe98404d2034da47af81753f253bdb1
SHA256c39550bb781ef84b830eed4ee7bf9e320946dbd8878cb93139d0f68769fbd100
SHA5121b86ad22e781c7f9283ebb6d1d2573dd358c15d667a8ccf26475a201fc0c9d13c59088c7b2e2d368b970221d4e1c74d3dc3e30310b566e3acff6fb0aac805821
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\AppxSignature.p7x
Filesize11KB
MD5dba03c90486bc75e7f7c7c2d74b166cd
SHA138ad19e0e8dadce50d95339ea2ed132eec6aeb7b
SHA256557e77f7a97cab1dce3d786c1494d399d05be35f5559ceadba97072e5884eae0
SHA5127d050fddd9629f1a304c827f23747fd3adaff171437e63b68a050797997932c939d19a2d0f0fe44280044ca78f39d7734cabab6b9af290aba8cbe516fdc6ed99
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\Logo.png
Filesize33KB
MD50661e74cf9283be5c989e264dcb652b4
SHA1768ee9180b17887d66607bab27b9eeab13eb2032
SHA256e42521c371177f81d9892f662fe5e387cbf899268f86de38d1bee07a9c357579
SHA5122eca6b1285152e0ceda0309ee4d36b2345d35c85942a26d7e80df460e15ac2dca1fda4c75365b86e2bb48f23ca82e309565ad162a64b31f668858c0378f0e2c2
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\SmallLogo.png
Filesize17KB
MD53eac3e788d07a9d38a9e777939ec024f
SHA1698c4c9919264c28594f76b6938680db27d4e4c5
SHA2567816b6851a51924de3976c69d584e63c8e4da3beda01822b46e6d9a149677d55
SHA5127586aaa6ec8152d1362bca8c2a1c6cfc88110088133bbf7356043455e1ff3951e070eb865cdd39939b7b116ade4cc93501dc080f534f85c57e8993d44c233574