lockbit | 7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82

Resubmissions

25/09/2026, 03:23

260925-dxwnkssyas

25/09/2026, 03:19

260925-dvl2cssxfy10

19/09/2026, 17:46

260919-wcpnmstgqe10

Analysis

user interaction
yes
max time kernel
3s
max time network
35s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/09/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe
Size 693KB
Sample260925-dvl2cssxfy
SHA256 7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82
MD5 95daa771a28eaed76eb01e1e8f403f7c
SHA1 cdd5717fd3bfd375c1c34237c24073e92ad6dccc
SHA512 cb7258f8c7d5e77be30df63f73a16667be839a51613509012a41d90cd8456400c237c681d1cdae10213b83e2e2315760c2f4acee02e55f1430c0e90bc69eb35c
SSDEEP 12288:q/tJbVY7R6CCJ5RqRhoS2KMPKZb8VEtiWYbn8wBNsavTduK14UqMs5+p6uaYwsjE:q/XuwyZAVEEhbnNBNgfUjs5+8RsXsx
TLSH
T1D0E4D0ADFD4A8960D553F5BCBE1EB49153017AB80F39A2B7740925E10E738D83AB13C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion lockbit ransomware

Malware Config

Extracted

Path

C:\Program Files\ReadMeForDecrypt.txt

lockbit

Ransom Note

~~~ You have been attacked by LockBit 5.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~ >>>>> You must pay us. Tor Browser link where the stolen infortmation will be published: http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion >>>>> What is the guarantee that we won't scam you? We are the oldest extortion gang on the planet and nothing is more important to us than our reputation. We are not a politically motivated group and want nothing but financial rewards for our work. If we defraud even one client, other clients will not pay us. In 5 years, not a single client has been left dissatisfied after making a deal with us. If you pay the ransom, we will fulfill all the terms we agreed upon during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators' salaries. You can get more information about us on wikipedia https://en.wikipedia.org/wiki/LockBit >>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die. >>>>> When buying bitcoin, do not tell anyone the true purpose of the purchase. Some brokers, especially in the US, do not allow you to buy bitcoin to pay ransom. Communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for Donald Trump to win the election, buying bitcoin to participate in ICO and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. Also you can use adequate cryptocurrency brokers who do not ask questions for what you buy cryptocurrency. >>>>> After buying cryptocurrency from a broker, store the cryptocurrency on a cold wallet, such as https://electrum.org/ or any other cold cryptocurrency wallet, more details on https://bitcoin.org By paying the ransom from your personal cold cryptocurrency wallet, you will avoid any problems from regulators, police and brokers. >>>>> Don't be afraid of any legal consequences, you were very scared, that's why you followed all our instructions, it's not your fault if you are very scared. Not a single company that paid us has had issues. Any excuses are just for insurance company to not pay on their obligation. >>>>> You need to contact us via TOR sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from us. If you need a unique ID for correspondence with us that no one will know about, ask it in the chat, we will generate a secret chat for you and give you ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser link for chat with us: http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Your personal identifier to communicate with us ID: BBE99C44EB6B40680B3582BA65C81523 <<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Advertising: Want a lamborghini, a ferrari and lots of titty girls? Sign up and start your pentester billionaire journey in 5 minutes with us. http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion After registration, you will receive the most flawless and reliable tools for encrypting almost all operating systems on the planet and a platform for negotiating with attacked companies. Version: ChuongDong v1.01 | x64

URLs

http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion
http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion
http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion

Signatures

Family: Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3804	7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	defrag.exe
File opened (read-only)	\??\W:	defrag.exe
File opened (read-only)	\??\Y:	defrag.exe
File opened (read-only)	\??\B:	defrag.exe
File opened (read-only)	\??\N:	defrag.exe
File opened (read-only)	\??\M:	defrag.exe
File opened (read-only)	\??\E:	defrag.exe
File opened (read-only)	\??\P:	defrag.exe
File opened (read-only)	\??\D:	defrag.exe
File opened (read-only)	\??\G:	defrag.exe
File opened (read-only)	\??\Z:	defrag.exe
File opened (read-only)	\??\F:	defrag.exe
File opened (read-only)	\??\T:	defrag.exe
File opened (read-only)	\??\I:	defrag.exe
File opened (read-only)	\??\H:	defrag.exe
File opened (read-only)	\??\K:	defrag.exe
File opened (read-only)	\??\X:	defrag.exe
File opened (read-only)	\??\V:	defrag.exe
File opened (read-only)	\??\Q:	defrag.exe
File opened (read-only)	\??\R:	defrag.exe
File opened (read-only)	\??\U:	defrag.exe
File opened (read-only)	\??\O:	defrag.exe
File opened (read-only)	\??\A:	defrag.exe
File opened (read-only)	\??\S:	defrag.exe
File opened (read-only)	\??\J:	defrag.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3804 set thread context of 2388	3804	7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe	85

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3804	7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	defrag.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 2388	3804	7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe	85
PID 3804 wrote to memory of 2388	3804	7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe	85
PID 3804 wrote to memory of 2388	3804	7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe	85
PID 3804 wrote to memory of 2388	3804	7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe	85
PID 3804 wrote to memory of 2388	3804	7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe	85
PID 3804 wrote to memory of 2388	3804	7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe	85
PID 3804 wrote to memory of 2388	3804	7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe	85

C:\Users\Admin\AppData\Local\Temp\7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe
"C:\Users\Admin\AppData\Local\Temp\7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82.exe"
1⤵
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\system32\defrag.exe
  C:\Windows\system32\defrag.exe
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- - C:\Windows\system32\defrag.exe
    "C:\Windows\system32\defrag.exe"
    3⤵
    PID:320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4584
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:5448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

da.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\da.pak.DATA
Size 897KB
SHA256 fa508bd03a61b57c616c95bcd768efd6019556bf70cc69c27df19b890495b250
MD5 8fb1f79809be8d365bc54277b8f7f344
SHA1 7668bcb7858e179a321cfeb4329eabce9afbbe37
SHA512 d921071e6ca72b5f46c9d1be2050919d5cbf44a4b07b47edb2ce893b15bf1c66a54c3c6d65a26bf25786936ef716313a6aa14eab00bc95e175d55a2f2055fc6f
SSDEEP 24576:lkqS0XrTUoAUNlPlDG2C+HGvFUIG563828Nx8:yb0bLAoPM7fd65ZlNx8
TLSH
T11C15335A853E75FA78AAA017083F9B8415F40BDC490ADD181CFEEE6322565C03AFD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\es-419.pak.DATA
Size 1.1MB
SHA256 7e7a9216cb7c5d777e959d05601f4431bf318eb5d521a8e8c4a772c74ae509e3
MD5 698e8612d6c980d0ee9d8aa01de9c5c5
SHA1 9bb1eaab9aa043ab1dbf92e92d4add8c24b9091d
SHA512 e82c108cad37cce2fef304b5559d2c60d5ed1e3a79f982fdcce833db25e9887ccfd38d67cd71a1a6fb32ec287afb7fd28af91b505901602e11b5a2bbd7bc2627
SSDEEP 24576:CVM/32cgy9EaaU8OjWWg8kOpY8r1tILHyEGZEGYOM8qWt:Cqx19E/wjBVDdZBZbVt
TLSH
T11135333BC346E99F3FE366FBA763F2495AC62442144212441B6CBA10ACF797E436D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\es.pak.DATA
Size 1.0MB
SHA256 206fcc8f7aa5739bffac73631f8c99e0ffc3538f63b0b910d4600bd37e6a9007
MD5 c4e9c42b1ec7dee721d455e82c6bf219
SHA1 76cee3112aaa435acef66b78c712d59527f59b0b
SHA512 9f64a716a02780b77368e3410c41fb2b2467ad086d03e4ad8a6f67e9700fea3304b1960892a6ed68cea4cd6dc2efae84ddc7da2fdf817af325088302215a3010
SSDEEP 24576:niMbPDggLyu6M79AqrS2pJm4ZJvemuj5C6N1uUxrWBTExDWu0z:iMPDggLReq/PmGJe/55WBTWyz
TLSH
T1BF3533B4313FC7581A906F0C51F18A1BA4D802649B94CA6F9942A743F6FF2C59FE126F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\et.pak.DATA
Size 990KB
SHA256 9b0cbc990b363f0e4caafe18041491400178b02eb93bf873a76c352191551622
MD5 13e52821db14dfca25e60d44ee766e81
SHA1 ccc671bbd45de51a5c7c42ea3ef8fea5c3e5979d
SHA512 6ec8a60bc2825afbbee62c916e4d4b9e18e4432a191386af4979efddc40f549f029415d149598e39a73c7742b6aff7e2c5965797da366e1c499c04001af988bd
SSDEEP 24576:Bm31uxDf3aI8RbFb7tsrSJwObJQq1t3q3zoAcXTrJk8o:YKfqI8RN+W9hta3zzcD95o
TLSH
T16A25334A6447C4D3BE85176C7EC294E1ED05BCA84A7BAB3AE448CE6DF137B650207C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eu.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\eu.pak.DATA
Size 1.0MB
SHA256 c63348d33fe31bab1ffb7b75e5e9a78ffbe8a7761dc6bfa8d398be464072f73b
MD5 a66ee6cf4d05e2fbdf5ce0563e31d593
SHA1 e3edfc9bfcaf5f1f9d88625475f82693123fd8a2
SHA512 1eed0e6152af0b4d4b9eb5eb0cdccfb7495988bc2b404979e8a1738453e2be6a39f3004f05cb41f9aef313218e37c9138e67a775ec25ea523af4ec12c4ab82eb
SSDEEP 24576:vWBNRJ9wVnVRvMTg4zXQ7z41+SH0QfUozRu4F0IUXL+m:vWBNRJ9whMTBWh33oTHU7f
TLSH
T16F2533C56045563F9193BD82E3B18BF89B8632778ACCCC07DA67731A6A3B1B914D305A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr-CA.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\fr-CA.pak.DATA
Size 891KB
SHA256 7e46b37a6f42eac16546f98227afdaa589ad79b244ab3038a461a99f86a7ffcc
MD5 27a7e62b7820ff020b63fb70c63a6a67
SHA1 6bdd819066199cccd76fc147f71e9a0fabc824fa
SHA512 fc5bcce811130fcd9020254ed569446f73052fe250553cf56e4bcd363ac37a47c0ffbd5f175d3e87470ef92db836112e619df104328896259f686a1247271bfe
SSDEEP 24576:4sVgYfp1afh2pFfimh53npSEsd4zwi7D4EH/CPmfXxA6:4sVbfckcwnpDzwi7k+ZA6
TLSH
T16F15333E351BCDA499AB0F47046D9ED00D5C0E47572FDF99B0A6DCA25BA30523EE94D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\gu.pak.DATA
Size 1.0MB
SHA256 b16bfa225993b60a52c58da873ae460cad643756fd170ff028a4dd6eba2a56ad
MD5 f718147ac995cd57fb14bc1dfe78d203
SHA1 801f3728fd32fd7c1c82df7a997f8cfb51edbc16
SHA512 53eb9bbdfd41e776d11100ce3498d26fc71d5d6240b37f7b67aa571e05c772ccaadf03b3ad5abb0e56802fd10906d6f2e3bf86e3cc643a5313a2e7492a8223da
SSDEEP 24576:yrPkZJxgHKx9ha1VV6MBdsEja2Y4iADkCoYWY:yrPkZJxOKxzK641D/oFY
TLSH
T1EE3533B486FC664C17FCD21B03FE931EAA8F7EBAD85E988038B5590002F194957907F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\hi.pak.DATA
Size 1.0MB
SHA256 02e7bb07c14b2c7c2ab906a4270c6405fff0871e1745dc55fee5a2498a70027a
MD5 36865dd80c5e9ac2972da71b622b21f2
SHA1 988a3c5cde1a35985746a047c34d2176e6825bf4
SHA512 1278a2764cecbe167c6765d5be85ea09ba3bb28dc0ebfcb76af1720dd2b7c4dbbfd7a9b93adda63e194ae5fff053c6a3a13b4fe9fc8f9c574be8b35dada90d72
SSDEEP 24576:c+/vLVsDdBDFSF12iCyiDYESPTaWhH4X2KRd1JpP6VvNv5vg:xhsDdBDFSX2TY+R2KRXJOFg
TLSH
T1673533B93B3D00D6B3BF7A66DCA93D95C7EB07C16CDD07A3D301980A62A7A609445C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\hr.pak.DATA
Size 891KB
SHA256 114d6534eafde41fc5b890a271150cf593f8f5d11e4e831a978080ffaca950fa
MD5 1dd6b947d482e8d89516e06a4e403843
SHA1 ea6514cfe7b1b3fadb02da7f0edf25f2cd8d0adb
SHA512 3a65b29027a4d66f494f033a9058aafbf8981cede42e0fc2f450f8f4a6930c48796d6b99c902bb9b97ddf9a18c67b4360622a4447861e5241ff97d65d2469d01
SSDEEP 12288:1JuqbErHhl8HGY0dWdnly9qljvltF0V4RzfguqtwAZ+b8IkznFGufHiFVwmPtpQT:bErk3Y8vlL0V4RzfycHAJaXjkgQ
TLSH
T1BD1533C65C7D1642734E3262D5EBB904B5E369A3B14E0A8B92F7448D05F2633B9E3C72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\hu.pak.DATA
Size 1.0MB
SHA256 1175a4cb5e52f0f8d1f3d09dc3538d912da31f3b46729da5a68f204a8335c623
MD5 1ce4e1ec8b9fb0ae665ea9e39f754e3e
SHA1 49c96ae19e5837c90e0b43ddc90d1ed2f7485ccc
SHA512 ee010e3b708471684a9ac8488f14129b24cf8b3bbe79a70044fe806f756427e55a56801a20efc64d39e8f598e961fdbdcfa42e84dc4631a10d622b58fecd1c20
SSDEEP 24576:6atA03IDlZGv7h6FC1SebKvDtjJa/MtL4TJhY0FL/ok:6aCrRojhxke0DhCMtLocY8k
TLSH
T1353533480D90BF0ECFB699B50BDC4C05908E7D40D429E259A3DEC7B55E091B6C2ABB7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lb.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\lb.pak.DATA
Size 1.0MB
SHA256 0c71c5fa3fd01add269345237e8572247eef3b74176969b5467965a7026200d1
MD5 5712f37b6913484cc79b9b6900ed98b4
SHA1 cb85e26572045260d223c0a59816a7950e3bed7d
SHA512 2300b2d595bc81f52e97b67f0aadd080fd06083d66b8dcc37911cb2cfdcc1488855291780552be100423f352dffb3a30253a2734bea60ca6837800c0431e8889
SSDEEP 24576:Pb47L8gAUdcDS1wklJXGjVef0FRaLDZzWa4eseKu2j+Jt6j5Yz0H0ZRqBtEnvd:GLFdcqwkWjVeUwLtzj4452CJMjqpZRqa
TLSH
T1E135336D6B5BC18E3AF53A5B1B9F91DF531E3910D8DAB04BB4388065CCC2084457AEEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

or.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\or.pak.DATA
Size 1.0MB
SHA256 6abe58d7b32f64c253bc0525d5675ceb1a347965a5526220170438a7d4b21e15
MD5 9d201ee77ef3d1812abc735660679b0e
SHA1 edba8abe18dcea37d8f34b55db6b875facfc7e47
SHA512 94f9516704ef6dfb65dc308837f4ce3a57971d442db701ac31029bc9be7f2bf20efc6d52b758a635e22113935df6c002e1abaad8106733a5fbb35f35cea09648
SSDEEP 24576:9cxbF+mA+ajAhAZ0Ly9hNU1mANY5nulHjNqabUy7SaZACdzUXKtm:9Kp+mNa7Z0LgN7ANY5uJj4abUy/ZjdOd
TLSH
T16A3533DA4DD35497AE47A73E75BAC084974123714F9B0F82002A3BF8ABC4E7D4629D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr-Latn-RS.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\sr-Latn-RS.pak.DATA
Size 906KB
SHA256 977fc96a62ec83b81687462711694239e8bf6a9c191e8be9e6839c32bd4c0541
MD5 45664437468abc0fcfe0f2eef29d9fe2
SHA1 57ddf03115fcf9ba0af6437f4d1867ae9868d837
SHA512 29ac8d7d15b6cbddff750c61f5405f344427220ed3d161cc1ea5298cabf007d1a8f2727c4f0b9dce7d1d5daecc2998c42c2e17d2f832271abb506384d429a5dd
SSDEEP 24576:0ar8wezfzkd8GCXqA17kjdVXXzh3gVrFzyZ1E:0aderzfGCXqA1sX1gxEZ1E
TLSH
T13F153331FC34E32E33CC256B1929198ABF5B7912CF507847596A43E16F426B4A60ED1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\icudtl.dat.DATA
Size 1.0MB
SHA256 a49e28275f423ab89cc70315f78df019267914f7fc899338b283c686f1409952
MD5 91ca2c7a26b9e7d28128b7a2dbd61736
SHA1 845e9b667cfbfe82ec6413c64a0b99707ef704de
SHA512 bbe980cf5c27ede7d64c72d6e500bb636c7bfde0a36061a3b01efcd60462987504337a4feada3f7a41121b7d060a827924759eebc00b6fa9214a1b3d52486081
SSDEEP 24576:qkxeDrtOFQZpguWm99ncIb0Unqt5Oyo+5H5G+jVatUbgu:pxeD5OFQ59tcIPeJoaHlVtbb
TLSH
T14935330CA12BA1F08AC434B5732ED676C7B9D1C72012AAA5479B05EA47F3D5F10D9AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeWebView.dat.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\EdgeWebView.dat.DATA
Size 8KB
SHA256 8db39517b737972a51d5c26801dcd042f312ad8d99f61c0cc69098dc6fc620d3
MD5 fc60d2ebccddf922bf9fffa0fa31f25a
SHA1 9b59d24ba3b5ddfab342c04494e3600b00f232d1
SHA512 bd14319f0129e5cd934b1823505fc3e340d592db5a1e515863e34885c95f6f4ae8dece4a978cf89b7bc642e197fae2563d2148039848edbafbb18155f9b4962a
SSDEEP 192:0Hf40MRda9L3ORUn70yJMzkI70KMYmRTJhlKGPgvHrzfQFe:cNz8mn71JMz57LMrRVhlKWa
TLSH
T133029F16CA31592124DB485D34267ECC366861E5B6F8CB53B97A7CB20FA44FB2148E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\bg.pak.DATA
Size 1.0MB
SHA256 7cdc96b981ddd0fc4263f41bba87e820139189cfde8deb53b463f494d508a1d0
MD5 733bf98e91a724137a4f2defb2996af1
SHA1 f1512caa777333ceca28d59a27d0fa18b94f147e
SHA512 2752f9de16fab053b0499c8b24a4579315a8de163d136d5f2ea7528007e0fbc208c0a11419517d40c36d51bbb966450450650aecaecbc5e6eba869623a74cca7
SSDEEP 24576:2yfdE8yQLwNoFUncp6PS7puMiewkfOE4HP4ZcZ9PG2I/wF+yAF9GKv:20E8yQLwNznI6PS7Dw6O5P4ZmY2I/aAn
TLSH
T1113533E277C537D6C36AD442DBB184D7BF23E5A4480A612DA2CF03A574A703B2D5CB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\el.pak.DATA
Size 928KB
SHA256 dfbb78cb4aba8f1aa29a52a85ef3075f8d44f039fbd52beed4ad9fa53ca86286
MD5 79681e7d6484abceb28773497f7fdcb5
SHA1 780e29d0b56c7ab689fbbda584610f8dca3e9191
SHA512 187652019d5e1a073296244ddcfac11b3d5b65287202c1a98af9bf815d76cbcd86272af65deab4fd20f420324722f357c1448c5a6fe1793cede5cb509de940e4
SSDEEP 24576:sAXsTzdfBms0EGbYaZ3JU3cc9l3nkLwfR/7LRvA3QbMEDXivLgB6oL:sAXW90z1saZ5UMc9l3tp7LppDXiTgBT
TLSH
T17F15333940F5D5EC1631499279B434DEFE7FABD0E88A8A88E23221CB745743DA35DE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\fr.pak.DATA
Size 1.2MB
SHA256 90f3ea64717aa79241ced4762dbc59314b37bd3480dba9369203794e4135af43
MD5 3143035b8d6fddbcc2f15bdc0b4341d8
SHA1 0228331e99c34965b7cf09a2e1716b0b9f158732
SHA512 9688d8ae9aabdb4a6908e983c74b14f1b6f271c427af21cd9381a3fe84105645d3c1eacb89316a539ad5fc3ea104edfdd5e310fec50414e3304519b6babc7b82
SSDEEP 24576:CbD2ETkF0D3ImraYbhTBNt+3BCDrUxCiuL/Ld+TNAP8t4:w2ukGbDSMD4luLOt4
TLSH
T13A453376BD09AA7ED31DD79175DA0CF02E710AE325F72700F994220D94BAEC76E82931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\lv.pak.DATA
Size 1.1MB
SHA256 efa5f5e7f5e2be03a00aba5afd3c476d5b1f4ba2fbaecfd53dc9278a6b4ceb8b
MD5 f536c3a19432eb54b663682043c0f201
SHA1 9ef4e263de5a3bbfe954618405df2733a64f84ec
SHA512 38a3c9e560ac08f1a38dfb8191418257b719c18ab1e4cb7ef859361900a93432d327193dbbb94f1f63bdca3c275663aca07c51a9abffd7cb6d60d2f1063c62fb
SSDEEP 24576:wjFSZLh/vmrIQ7sxndOPy4iIFeLywKDzJ3w9qTWPYGsqesT+kDSCUv:wjMZ5a7sFdOK4iITwKDJw0TW9sqes6ke
TLSH
T1663533C24F9FF9B56C865069AF8335497DF88F410E0E61C64EC57AF030A9EA6C94F44A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\ml.pak.DATA
Size 1.2MB
SHA256 7237284eb559b25c453fb2aa23ed3f40b0623a5cd75eab169a05464571c4a641
MD5 935523f389dafb08bf144a68b4bc8fb6
SHA1 90027b948d6e1d505c735ccf043569b3a541dd63
SHA512 81363605daa84033015547773059c601b43ba8f5ec2371c78bfeb5450c968798ff4ffc97413547303fb7eb639fb0cd20a0d0dd0fe37b89cf29bd3bc82a0f1855
SSDEEP 24576:OO4M0Jzr4ySwPHk0qQvAwW+yBG3u5s7dsjui64r/WjQJXHd2cQVKE7ySMRpEGn+:FK44q8AyWG3u5sqjuinrWuXHd2cQn7f/
TLSH
T18F4533494581FD58821F67CE5C1A116B60A6AD16EAFC8C07ECC9CF1817922BBF7339B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\ms.pak.DATA
Size 1.0MB
SHA256 95faefb05efc076deb548f085aac8389ece44325107761b1ad259bb7a6be90b8
MD5 e2c76956e9742906eec8a0bd924355c1
SHA1 9f05b9503e9fa4b24a1c2e0ebb2d4328367ac558
SHA512 16abee2cc018c4db070e73ea2b9e6d9a6b271ef404060695519eacf8c20df82cef199dcd32f3f83f9fb5e03b063f2687ef255ecbf72661f6c58a49a514b2b6ba
SSDEEP 24576:tjz9kxkRHctUTSPpsrs+9lUMsWCi/Cn5aKhqREdH7kS5hY:daxkR8t7pSs+3U/W7651qCdHI
TLSH
T1FF252320110F387F268AABE55BC14DF6A3D1DD683417A8C10E11FB83A3E1E4A777956E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\sk.pak.DATA
Size 927KB
SHA256 e1307cabe8e26fec9bed810d89cb48b4e16a4da0d8cad9b93c9ddd0a0e93098b
MD5 92800d74bd4be5d639578c815d1376e8
SHA1 627a47dff0f39db8c44497575577d53052f460d4
SHA512 fd0c2d84d8ef98c634fce588f37fff7916fcec79f4aea845193dc31bc65d906c6ca96af5d00b54a9941218d68e38142e563d1c30ae11a8f15d8ecba1659a42af
SSDEEP 24576:LnaxjcPX6uqDGIzsn9N4Lu4hKvL/ll9CzWrNXoW:jaxjJGD9Nx4hKv5l9SW5XN
TLSH
T1CA1533D94CF212FA6C6E6238006733A0AEFFB6D32615845CBAC0DDD1E617912DCDD989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\te.pak.DATA
Size 1.0MB
SHA256 2d50516ca06ec735b6658e1a0bb852404731bd3ef64c9a50842398e4d6d231ec
MD5 fde0505903bb53f9fd69def0abe31409
SHA1 0c4ba0c4225a193a904eadf68cb6a8a1d2832bf4
SHA512 d063c515ec773d38ff4746e0afda67e803eeee4782fa8345023d06a9bab1938354afd2090594766e8cb04ce788b951a520a9a795f18f29690d59840d4b0f9562
SSDEEP 24576:SbJVQ7+3S/wPM69bnmUPJ7z4mLHIMoAl9WgFhw4VRhxpAwMhQMDTGN/vD:0JVE+dbndZ4m7Ie9WArVj221D
TLSH
T1A035334AAF6B01D607365665DE7E39AECE43CD0349FDB27B200AA1F441BDF52620EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe.sig.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\msedge.exe.sig.DATA
Size 1KB
SHA256 54de8bcae41b1591cad8e0ea3bf47b722f3906cb2e63b23facda96384535fafe
MD5 d09c138e9ed10d299b55675204afe0da
SHA1 56758bcf2d4e4434039fc60a01a03f6db124cbb4
SHA512 8abdaf3edc38432934c0cdff57a0d4f31c4b6894278d5221981f1b38c6b827f75360e94f47d5fb962a303a2ec37423bafb3b43525e2b97d84c051874d5774cc3
TLSH
T1EF31185650A9CAA2AE9406C8C3EB57B0527FCFD7CC322A005429DD47304912EAE366C6
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_200_percent.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\msedge_200_percent.pak.DATA
Size 1.1MB
SHA256 38c524cc75b64d7cf169ad8f320b9d42800a5f3337234c6a9ebdd141fbdabbe6
MD5 62854a8285e75cf28e276c2c5cf9b3c0
SHA1 436dc71e7796d570bf437f9f9014be16965ee1d3
SHA512 ff469a0ab5dd27ef9a951ba01ab14190bd57c2361191e9f837f7cc5af9f2a094f5e869f29590e03602b1579f2d08f599a25f36d1cb803bb9f77bc22083548c77
SSDEEP 24576:4TOzuKRarKlogxElAt9jie+0Bj6lxoWxhbw4j96wDPFiuSaWEk9sK:4TcNRarzAt9Wuj6MWxhbw4h6LFEk6K
TLSH
T1EB353390D862E5D25DDAC0166BBD5DC883998B80F45DE321E39BB0D1189BBFE035C87B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\resources.pak.DATA
Size 1.2MB
SHA256 c7627072c7a6e7442a6fe548ceff7f866724b91a556f5f3515d033af89c3e7b2
MD5 1873b99b9762e01eefc47b77ef0b21a6
SHA1 506ff9a4a36542039c99ce5682d8e65a623ca202
SHA512 b87f9652f7c1aa3b739d09e5f033b2a1f86b1872560d18ed5a8ce28b3c5fdf51daa69413827e1151e565c3f3cc17649075f019c6448a585b0b38bbd9524f571d
SSDEEP 24576:3ixFSm26huQ63V5zVQQBpDErIDO1sKQTdWfI2Mz3E5b:Sxhs3xvEr1+0Iz0d
TLSH
T1B54533AF453FF2F7810B2972A4D82F524E66B27DE6A05C725764CC61F801A74E02EB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadMeForDecrypt.txt

Path C:\Program Files\ReadMeForDecrypt.txt
Size 4KB
SHA256 cedf02057d173d279ede3ab770b4785e1a04fe65df461f036182b5d14dfc2ea3
MD5 e54e616ac9d0cad5917e413d714a9c4a
SHA1 81b7d4697995c6c51300fd4c44ce7cde54d4fd91
SHA512 a6fdbddf7c9e57f1b6aa6fd97a0b9e711957ca5df915d254b07234229a929657f5b52b984e0a9e0ab1feebc03f664212d5fb1df0e42dd352a296dca369d2eaa0
SSDEEP 96:m713ouruxnN8TMLdFMWpox5EgABzPnWKwjL7O3:mtouKN8IdOWpowgAl/Q3E
TLSH
T1BA91955F671E127446D11261327F98E5EB2B422C3221C2B92999D03D13BC77E4B3A5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/320-13898-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/2388-62-0x00000197FD250000-0x00000197FD251000-memory.dmp

Download

memory/2388-46-0x00000197FD140000-0x00000197FD141000-memory.dmp

Download

memory/2388-24-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/2388-29-0x00000197FB700000-0x00000197FB701000-memory.dmp

Download

memory/2388-28-0x00000197FB6F0000-0x00000197FB6F1000-memory.dmp

Download

memory/2388-35-0x00000197FB760000-0x00000197FB761000-memory.dmp

Download

memory/2388-37-0x00000197FD0B0000-0x00000197FD0B1000-memory.dmp

Download

memory/2388-42-0x00000197FD100000-0x00000197FD101000-memory.dmp

Download

memory/2388-40-0x00000197FD0E0000-0x00000197FD0E1000-memory.dmp

Download

memory/2388-39-0x00000197FD0D0000-0x00000197FD0D1000-memory.dmp

Download

memory/2388-41-0x00000197FD0F0000-0x00000197FD0F1000-memory.dmp

Download

memory/2388-38-0x00000197FD0C0000-0x00000197FD0C1000-memory.dmp

Download

memory/2388-36-0x00000197FD060000-0x00000197FD061000-memory.dmp

Download

memory/2388-34-0x00000197FB750000-0x00000197FB751000-memory.dmp

Download

memory/2388-33-0x00000197FB740000-0x00000197FB741000-memory.dmp

Download

memory/2388-47-0x00000197FD150000-0x00000197FD151000-memory.dmp

Download

memory/2388-55-0x00000197FD1D0000-0x00000197FD1D1000-memory.dmp

Download

memory/2388-54-0x00000197FD1C0000-0x00000197FD1C1000-memory.dmp

Download

memory/2388-32-0x00000197FB730000-0x00000197FB731000-memory.dmp

Download

memory/2388-64-0x00000197FD270000-0x00000197FD271000-memory.dmp

Download

memory/2388-63-0x00000197FD260000-0x00000197FD261000-memory.dmp

Download

memory/2388-61-0x00000197FD240000-0x00000197FD241000-memory.dmp

Download

memory/2388-60-0x00000197FD230000-0x00000197FD231000-memory.dmp

Download

memory/2388-59-0x00000197FD220000-0x00000197FD221000-memory.dmp

Download

memory/2388-58-0x00000197FD210000-0x00000197FD211000-memory.dmp

Download

memory/2388-57-0x00000197FD200000-0x00000197FD201000-memory.dmp

Download

memory/2388-56-0x00000197FD1F0000-0x00000197FD1F1000-memory.dmp

Download

memory/2388-53-0x00000197FD1B0000-0x00000197FD1B1000-memory.dmp

Download

memory/2388-52-0x00000197FD1A0000-0x00000197FD1A1000-memory.dmp

Download

memory/2388-51-0x00000197FD190000-0x00000197FD191000-memory.dmp

Download

memory/2388-50-0x00000197FD180000-0x00000197FD181000-memory.dmp

Download

memory/2388-49-0x00000197FD170000-0x00000197FD171000-memory.dmp

Download

memory/2388-48-0x00000197FD160000-0x00000197FD161000-memory.dmp

Download

memory/2388-31-0x00000197FB720000-0x00000197FB721000-memory.dmp

Download

memory/2388-45-0x00000197FD130000-0x00000197FD131000-memory.dmp

Download

memory/2388-44-0x00000197FD120000-0x00000197FD121000-memory.dmp

Download

memory/2388-43-0x00000197FD110000-0x00000197FD111000-memory.dmp

Download

memory/2388-30-0x00000197FB710000-0x00000197FB711000-memory.dmp

Download

memory/2388-2133-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/2388-27-0x00000197FB6E0000-0x00000197FB6E1000-memory.dmp

Download

memory/2388-26-0x00000197FB6D0000-0x00000197FB6D1000-memory.dmp

Download

memory/2388-25-0x00000197FB6C0000-0x00000197FB6C1000-memory.dmp

Download

memory/3804-5-0x000002BBAE8C0000-0x000002BBAE8C1000-memory.dmp

Download

memory/3804-17-0x000002BBAEAD0000-0x000002BBAEAD1000-memory.dmp

Download

memory/3804-23-0x00007FF6D2880000-0x00007FF6D2E3D000-memory.dmp

Download

memory/3804-20-0x000002BBAEB00000-0x000002BBAEB01000-memory.dmp

Download

memory/3804-19-0x000002BBAEAF0000-0x000002BBAEAF1000-memory.dmp

Download

memory/3804-18-0x000002BBAEAE0000-0x000002BBAEAE1000-memory.dmp

Download

memory/3804-2-0x000002BBAE890000-0x000002BBAE891000-memory.dmp

Download

memory/3804-16-0x000002BBAEAC0000-0x000002BBAEAC1000-memory.dmp

Download

memory/3804-4-0x000002BBAE8B0000-0x000002BBAE8B1000-memory.dmp

Download

memory/3804-0-0x000002BBAE870000-0x000002BBAE871000-memory.dmp

Download

memory/3804-22-0x000002BBAEB20000-0x000002BBAEB21000-memory.dmp

Download

memory/3804-1-0x000002BBAE880000-0x000002BBAE881000-memory.dmp

Download

memory/3804-9-0x000002BBAE900000-0x000002BBAE901000-memory.dmp

Download

memory/3804-6-0x000002BBAE8D0000-0x000002BBAE8D1000-memory.dmp

Download

memory/3804-7-0x000002BBAE8E0000-0x000002BBAE8E1000-memory.dmp

Download

memory/3804-8-0x000002BBAE8F0000-0x000002BBAE8F1000-memory.dmp

Download

memory/3804-21-0x000002BBAEB10000-0x000002BBAEB11000-memory.dmp

Download

memory/3804-10-0x000002BBAE910000-0x000002BBAE911000-memory.dmp

Download

memory/3804-11-0x000002BBAE920000-0x000002BBAE921000-memory.dmp

Download

memory/3804-13-0x000002BBAEA50000-0x000002BBAEA51000-memory.dmp

Download

memory/3804-14-0x000002BBAEA60000-0x000002BBAEA61000-memory.dmp

Download

memory/3804-15-0x000002BBAEA70000-0x000002BBAEA71000-memory.dmp

Download

memory/3804-12-0x000002BBAEA30000-0x000002BBAEA31000-memory.dmp

Download

memory/3804-3-0x000002BBAE8A0000-0x000002BBAE8A1000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads