blackmatter | hxxps://github[.]com/Tennessene/LockBit

Analysis

user interaction
yes
max time kernel
430s
max time network
428s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Tennessene/LockBit
Sample260925-wx9vbage82

Score

10^/10

defense_evasion discovery execution blackmatter lockbit ransomware spyware stealer

Malware Config

Extracted

Family

blackmatter

Version

25.239

Extracted

Path

C:\cMT04i8Mp.README.txt

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: B7568014A48684D6D525F3F3722638C4 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

Emails

URLs

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html

Signatures

Family: BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
ransomware blackmatter
Family: Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000700000002442b-471.dat	family_lockbit
behavioral1/files/0x00080000000242bc-1214.dat	family_lockbit
behavioral1/memory/5236-5301-0x0000000000400000-0x0000000000429000-memory.dmp	family_lockbit
behavioral1/memory/5236-5302-0x0000000000400000-0x0000000000429000-memory.dmp	family_lockbit

Renames multiple (982) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	74F5.tmp

Executes dropped EXE 11 IoCs

pid	Process
5052	keygen.exe
5948	builder.exe
4912	builder.exe
5940	builder.exe
5996	builder.exe
5404	builder.exe
1064	builder.exe
4484	LB3.exe
5144	74F5.tmp
5236	LB3_pass.exe
7240	LB3Decryptor.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-939655444-3071939294-1401108526-1000\desktop.ini	LB3.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-939655444-3071939294-1401108526-1000\desktop.ini	LB3.exe

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	LB3.exe
	\??\F:\	LB3.exe
	\??\Z:\	LB3.exe
	\??\F:\	LB3Decryptor.exe
	\??\Z:\	LB3Decryptor.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\PP09q8vqrxpb9l2cecect5htv7.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPd5cp2pb74ny_0f8p_3z490_6b.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PPgntvi6_pknsesk7iovr5gttk.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\cMT04i8Mp.bmp"	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\cMT04i8Mp.bmp"	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\WallPaper	LB3Decryptor.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5144	74F5.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3008	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7208	5236	WerFault.exe	182

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	LB3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	LB3.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LB3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LB3Decryptor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74F5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LB3_pass.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4416	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\WallpaperStyle = "10"	LB3.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop	LB3Decryptor.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop	LB3.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cMT04i8Mp\ = "cMT04i8Mp"	LB3.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000a75a660dff41dd0198c3764f0a42dd01cbef7dc21a4ddd0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "4"	msedge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CMT04I8MP\DEFAULTICON	LB3Decryptor.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CMT04I8MP	LB3Decryptor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cMT04i8Mp\DefaultIcon	LB3.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\.CMT04I8MP	LB3Decryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cMT04i8Mp	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{9B14F244-65FA-42C7-A65C-37DB9EF61FE7}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cMT04i8Mp\DefaultIcon\ = "C:\\ProgramData\\cMT04i8Mp.ico"	LB3.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cMT04i8Mp	LB3.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4324	ONENOTE.EXE
4324	ONENOTE.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5332	msedge.exe
5332	msedge.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe
4484	LB3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5692	7zG.exe
Token: 35	5692	7zG.exe
Token: SeSecurityPrivilege	5692	7zG.exe
Token: SeSecurityPrivilege	5692	7zG.exe
Token: SeRestorePrivilege	5572	7zG.exe
Token: 35	5572	7zG.exe
Token: SeSecurityPrivilege	5572	7zG.exe
Token: SeSecurityPrivilege	5572	7zG.exe
Token: SeAssignPrimaryTokenPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeDebugPrivilege	4484	LB3.exe
Token: 36	4484	LB3.exe
Token: SeImpersonatePrivilege	4484	LB3.exe
Token: SeIncBasePriorityPrivilege	4484	LB3.exe
Token: SeIncreaseQuotaPrivilege	4484	LB3.exe
Token: 33	4484	LB3.exe
Token: SeManageVolumePrivilege	4484	LB3.exe
Token: SeProfSingleProcessPrivilege	4484	LB3.exe
Token: SeRestorePrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeSystemProfilePrivilege	4484	LB3.exe
Token: SeTakeOwnershipPrivilege	4484	LB3.exe
Token: SeShutdownPrivilege	4484	LB3.exe
Token: SeDebugPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeBackupPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe
Token: SeSecurityPrivilege	4484	LB3.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
5692	7zG.exe
5572	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
8164	OpenWith.exe
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
4324	ONENOTE.EXE
7240	LB3Decryptor.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 4436	1420	msedge.exe	86
PID 1420 wrote to memory of 4416	1420	msedge.exe	87
PID 1420 wrote to memory of 3780	1420	msedge.exe	90
PID 1420 wrote to memory of 3780	1420	msedge.exe	90
PID 1420 wrote to memory of 1028	1420	msedge.exe	92
PID 1420 wrote to memory of 2504	1420	msedge.exe	91
PID 1420 wrote to memory of 1028	1420	msedge.exe	92
PID 1420 wrote to memory of 1028	1420	msedge.exe	92
PID 1420 wrote to memory of 1136	1420	msedge.exe	88
PID 1420 wrote to memory of 2504	1420	msedge.exe	91
PID 1420 wrote to memory of 2504	1420	msedge.exe	91
PID 1420 wrote to memory of 1136	1420	msedge.exe	88
PID 1420 wrote to memory of 1136	1420	msedge.exe	88
PID 1420 wrote to memory of 716	1420	msedge.exe	93
PID 1420 wrote to memory of 716	1420	msedge.exe	93
PID 1420 wrote to memory of 716	1420	msedge.exe	93
PID 1420 wrote to memory of 1236	1420	msedge.exe	94
PID 1420 wrote to memory of 1236	1420	msedge.exe	94
PID 1420 wrote to memory of 1236	1420	msedge.exe	94
PID 1420 wrote to memory of 5040	1420	msedge.exe	98
PID 1420 wrote to memory of 5040	1420	msedge.exe	98
PID 1420 wrote to memory of 5112	1420	msedge.exe	99
PID 1420 wrote to memory of 5112	1420	msedge.exe	99
PID 1420 wrote to memory of 4900	1420	msedge.exe	105
PID 1420 wrote to memory of 824	1420	msedge.exe	109
PID 1420 wrote to memory of 824	1420	msedge.exe	109
PID 1420 wrote to memory of 4892	1420	msedge.exe	110
PID 1420 wrote to memory of 4892	1420	msedge.exe	110
PID 1420 wrote to memory of 4892	1420	msedge.exe	110
PID 1420 wrote to memory of 4248	1420	msedge.exe	111
PID 1420 wrote to memory of 5900	1420	msedge.exe	120
PID 1420 wrote to memory of 5908	1420	msedge.exe	121
PID 1420 wrote to memory of 5916	1420	msedge.exe	122
PID 1420 wrote to memory of 5804	1420	msedge.exe	132
PID 1420 wrote to memory of 5804	1420	msedge.exe	132
PID 1420 wrote to memory of 5332	1420	msedge.exe	136
PID 1420 wrote to memory of 5736	1420	msedge.exe	138
PID 1420 wrote to memory of 5736	1420	msedge.exe	138
PID 1420 wrote to memory of 5660	1420	msedge.exe	139
PID 1420 wrote to memory of 5660	1420	msedge.exe	139
PID 1420 wrote to memory of 5660	1420	msedge.exe	139
PID 1420 wrote to memory of 908	1420	msedge.exe	140
PID 1420 wrote to memory of 908	1420	msedge.exe	140
PID 1420 wrote to memory of 908	1420	msedge.exe	140
PID 1420 wrote to memory of 5920	1420	msedge.exe	141
PID 1420 wrote to memory of 5920	1420	msedge.exe	141
PID 1420 wrote to memory of 808	1420	msedge.exe	142
PID 1420 wrote to memory of 5544	1420	msedge.exe	144
PID 1420 wrote to memory of 5544	1420	msedge.exe	144
PID 1420 wrote to memory of 1508	1420	msedge.exe	145
PID 1420 wrote to memory of 1508	1420	msedge.exe	145
PID 1420 wrote to memory of 2364	1420	msedge.exe	146
PID 1420 wrote to memory of 2364	1420	msedge.exe	146
PID 1420 wrote to memory of 5284	1420	msedge.exe	147
PID 1420 wrote to memory of 5284	1420	msedge.exe	147
PID 1420 wrote to memory of 5284	1420	msedge.exe	147
PID 1420 wrote to memory of 5500	1420	msedge.exe	148
PID 1420 wrote to memory of 5500	1420	msedge.exe	148
PID 1420 wrote to memory of 5500	1420	msedge.exe	148
PID 1420 wrote to memory of 3796	1420	msedge.exe	150
PID 1420 wrote to memory of 3796	1420	msedge.exe	150
PID 1420 wrote to memory of 3796	1420	msedge.exe	150
PID 3008 wrote to memory of 5052	3008	cmd.exe	154
PID 3008 wrote to memory of 5948	3008	cmd.exe	155

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Tennessene/LockBit
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff90580c188,0x7ff90580c194,0x7ff90580c1a0
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,17595361618270227773,16494999372860440918,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,10606684484629252620,3296445407461895063,262144 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,4383878949177512325,1779493919550186311,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3340,i,13850609993292573657,5792979820263157851,2097152 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3344,i,8891129308678083752,3359525198519626335,2097152 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,18412391005990110468,9819824874853907378,2097152 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,12235687169993482101,14209402161989742219,2097152 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:2
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,9395569912914574463,1029827762153971917,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,2090869760007830520,15439830247413510639,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,11368477967887492389,4897930540775696951,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,11368477967887492389,4897930540775696951,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,9908601223257487546,1066175879199047323,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6428,i,11855630583527375335,8824607093981934807,2097152 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,1237568984974143517,2921384571548301830,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,12773596470583858939,16712606770339373665,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,9217297476688765714,4873819466623169223,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,1412314440332174550,13829167198195459636,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,263763782619754757,15442262574484957030,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4812,i,3466393225011288866,18351189455784603286,262144 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3180,i,3679663587477625100,6977296242506400423,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4660,i,1786617804706020172,6578329122867236241,2097152 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6332,i,7433281868975067397,16825043261318902212,2097152 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,10186085352292791485,18147439495914868486,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,16436160268724210586,2847882940465356286,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,2787431094999487651,6305026982430265694,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,808556587238336648,12841018521943628352,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,14593927888491893865,1049992767926545719,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5032,i,7063181345122336851,13682661349372976778,2097152 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5360,i,8695925472376267948,18049403014904796605,2097152 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7292,i,17689665959672944977,11676636102994088947,2097152 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7200,i,16695163803754014383,10001366945947908256,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,16526843276260451037,12360041899544582436,524288 --field-trial-handle=2020,i,17954769276609608083,5267916962226441394,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:8
  2⤵
  PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3188

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5564

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\LockBit-main\" -spe -an -ai#7zMap28034:86:7zEvent14787
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5692

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\LockBit-main\info.txt
1⤵
PID:5776

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap32106:72:7zEvent5330 -ad -saa -- "C:\Users\Admin\Downloads\Lockbit 3"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Lockbit 3\Build.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\Downloads\Lockbit 3\keygen.exe
  keygen -path Build -pubkey pub.key -privkey priv.key
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5052
- C:\Users\Admin\Downloads\Lockbit 3\builder.exe
  builder -type dec -privkey Build\priv.key -config config.json -ofile Build\LB3Decryptor.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5948
- C:\Users\Admin\Downloads\Lockbit 3\builder.exe
  builder -type enc -exe -pubkey Build\pub.key -config config.json -ofile Build\LB3.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4912
- C:\Users\Admin\Downloads\Lockbit 3\builder.exe
  builder -type enc -exe -pass -pubkey Build\pub.key -config config.json -ofile Build\LB3_pass.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5940
- C:\Users\Admin\Downloads\Lockbit 3\builder.exe
  builder -type enc -dll -pubkey Build\pub.key -config config.json -ofile Build\LB3_Rundll32.dll
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5996
- C:\Users\Admin\Downloads\Lockbit 3\builder.exe
  builder -type enc -dll -pass -pubkey Build\pub.key -config config.json -ofile Build\LB3_Rundll32_pass.dll
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5404
- C:\Users\Admin\Downloads\Lockbit 3\builder.exe
  builder -type enc -ref -pubkey Build\pub.key -config config.json -ofile Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1064

C:\Users\Admin\Downloads\Lockbit 3\Build\LB3.exe
"C:\Users\Admin\Downloads\Lockbit 3\Build\LB3.exe"
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:6408
- C:\ProgramData\74F5.tmp
  "C:\ProgramData\74F5.tmp"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:5144
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\74F5.tmp >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3552

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Lockbit 3\Build\cMT04i8Mp.README.txt
1⤵
PID:2776

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
PID:5748
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{7D3BCE1C-EA3E-43D3-9DE1-EFC0847D8307}.xps" 134348342882270000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4324

C:\Users\Admin\Downloads\Lockbit 3\Build\LB3_pass.exe
"C:\Users\Admin\Downloads\Lockbit 3\Build\LB3_pass.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 264
  2⤵
  - Program crash
  PID:7208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5236 -ip 5236
1⤵
PID:7184

C:\Users\Admin\Downloads\Lockbit 3\Build\LB3Decryptor.exe
"C:\Users\Admin\Downloads\Lockbit 3\Build\LB3Decryptor.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

DDDDDDDDDDD

Path C:\$Recycle.Bin\S-1-5-21-939655444-3071939294-1401108526-1000\DDDDDDDDDDD
Size 129B
SHA256 c4e36a6bd8fc5bac7bb7779b236c4b9c93a7f101ca8eaa0b12f4dc75d0a02fbc
MD5 2af54a4ee42fc43255d388852d0b349b
SHA1 722a1dc1c4a1cc66ebf488010350dac2e525b9eb
SHA512 7b94357873128b409b3ca57d26ed20d2ff8d21b80eb9af3ea79adcc52f833cb83cd2b62681e8a843196c099b2345ee1cec79769a965786981a2a39d39eb6b578
TLSH
T129B02BCC0CC6B7F014B807827D7A00D01D84003100B094604119C84041A01C3A92C6F3
MD5 SHA1 SHA512 TLSH

Submit Download

DDDDDDDDDDD

Path C:\$Recycle.Bin\S-1-5-21-939655444-3071939294-1401108526-1000\DDDDDDDDDDD
Size 4KB
SHA256 f4962a9491ad271c5f7865c1b5e30a8e006683b0db01c7a8eca06b22b4ec6ce4
MD5 67f45a1400682ae7b9a391d217b8fb76
SHA1 9bb32b336f6e053320df767576b558c26ef6987c
SHA512 efe90671d2d6619106ff3df1fd0abe7cf0968370d052b5eb494cc2c05d9223fcef3c8abce2e87c42d1545c2c1fa5909ede0311b1f6e8b6be9b872e3263f32191
SSDEEP 96:5TgNr9DIm+1K0H+KbeZyF6aS8fuE2p+QhrfseskrUlUfvWwSz/4:u19p0lbeoGE04kUWWwQ/4
TLSH
T1C5817E9C43E26A9D0B7BCDB6685E68C06A1C122D19411CABEC4C9F0382EB1F808744EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FFFFFFFFFFF

Path C:\$Recycle.Bin\S-1-5-21-939655444-3071939294-1401108526-1000\FFFFFFFFFFF
Size 124B
SHA256 fa6bdd7e5c8e19512ac49d3b88528b9dcd01c71209f1c26c4be773e87f4939b9
MD5 ebb61b18f752142c79123796b3088f87
SHA1 2d4b4a7535fbcc6458dd2f91ca28a6668b631cd5
SHA512 e13d51a4e15a28d715e1ca3c7603cf8c873d7db1d77a4b08fad3c892e32a90358c2d35d257fab0ba7136882dccfa73a1aa7cd57c54ece88e3c95e53f7f030c64
TLSH
T126B02B101A044040D9019F27EE30747C418AC31A694F180040082111804E083001A3C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 146B
SHA256 017768d1695d3f67af3caaf4591edb0c280f444a3b54a6298bb86f4546409173
MD5 959310042e802cd2bb29190a6331ce15
SHA1 716ecbdb7ce7d12922cc42f8260c588ff8a09d23
SHA512 3d8506f1623c8f8ee5643185a493bb191b90baa236b7ceaa007c6f60a9964c197b7fd3a681b67977d953cac38bb94a86ced4940ce7a872f98f3345c66fe937ae
TLSH
T150C02BA846D5D71FB308E88F133A5B0C8384338FD6C87A0F0300C9C87481484A782B91
MD5 SHA1 SHA512 TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 70KB
SHA256 483db2092c66391c9b1048327cc8ae5a392fd0cc9802f30a2a2094ec55f7e0d1
MD5 6a8a48918cb681f434aa2088125962a1
SHA1 1deb63168dc64fb8d3ed940e1b76e655a5c52828
SHA512 08ff814485eddc3293c2b3aca3462f4a5f0e2f22a51eb13590e2e9203744a250f395627ce4a890e956d193bf7dad9f243267e9dfa0406a7396dab6c9a88ea080
SSDEEP 1536:joqOysWm5M1Ew3A56Tm67CPFgkG6pT11HyC3TIpZJueYO9/hKnRmQdeDqsKldRL:FsWmy1EmAgm6FkGWTqCeY4/hvQYDq3dR
TLSH
T1326312E785750C26B1D12DF09294ADC629A75904A3F1310BEA85FD7B253D0F3EA23727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 416KB
SHA256 c5c78d605032266ac4d831673f8f9d0323a47194155b0534b737ced2d78333e1
MD5 b0e065464f811470ea6d4c064c4e4cb0
SHA1 96043c799a46e1d51d91294b5f6865f2a9a17de0
SHA512 d0cd9520ba734504f87e48da9cc94b18ca5728bc188537f47a566fc7bcf91081d8819df97c3c018bd11459da40dc0231610c3d7077b115f8c621ec2c62937e87
SSDEEP 12288:gFsJTkrWpiA70rHTngUuX5Z3IGHrpbW9w:gmJDoAQrH7M7IEq9w
TLSH
T1B99423E5247A1E5B0BCE3743B9421D87628772C30F9613C85723E55E9AF24A0EF524ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 208460aeb6595163c6b834df0aa2943b3756baa22d57cb0bc34863cc4d91ef53
MD5 31d5e24a14441ffac78c6382a691f85f
SHA1 af1a7787b4f2454e02b289c8f76cf29174691364
SHA512 17ff127d2f09ed744ee4180a975a268b2b76482b18a8f5f3cd03fa67ade102f9f4b2500c1163fc93d986c8f7c61886c070e149c8554f44f5b68b1051e6b28a21
SSDEEP 96:jnxRUmaUA+TwfoUgciBxQimBqjYox+oJc/:j7DaN+ELgcYCimBCYoDc/
TLSH
T167C14DABE47298F2FB9537309DC925467DFF594C1CFB1EB11AA3D1388902766C98804C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 71c8cc25e79758235e2f6602ab0bd467606f064b976127363e314705ba4f33f4
MD5 e7b3af44793e59cdd4b2e8231599e4c4
SHA1 dfdba03e881e79f392178b3e5f2673c7547c5625
SHA512 74e90161361d801ed555cdb4bcb618acd4befc1490492fd685c25503abd5884a7857861cafb80d4d05307fd33d8f1ce3ae2874e2d6a09d471ceeb725112ff6d4
SSDEEP 96:B3vtyoAmBZca737TC7kSvGM6unouBn34OqqFm8Xem0rYHGsxPVzYH1kpSoMKJtyt:B3cVa7LckS66oE3kk3kYmTHute
TLSH
T14BD10BA7D0A159F5FB4937709DC91945BDFF260D9CFB2E722A5BC4385A023A2C4C858C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 7cd54ea00ea6b1a61a1f99f79c741c580ca7e500be8a2c55b438b885fe177b3b
MD5 732b51e490d529eb9547659c62d5ea98
SHA1 9ad651d14f1a8f188c6f946af8f639638db97caf
SHA512 d5e1fa858ed62dc966dd0061873c563563eb3008c667cb020e6febc7e3609da50a2b3d1a465efc91badaa59613b8f5e36225ebd89308ac7a9b0b4f8349d66f06
SSDEEP 96:nnxRUmaUA+TwfoUgciBxQimBqjYQx+oJc1:n7DaN+ELgcYCimBCYQDc1
TLSH
T100C14DABE4B258F1FB9537309DC925467DFF584C1CFB5EB15AA3D0388902766CA8804C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b60c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b60c.TMP
Size 3KB
SHA256 68b8bd9c63c9e5727d6b50bea7ce156ca8dd0cdb4d4339a498471ae67ff8aef8
MD5 2fe6925586ddf248e897226e97dff96e
SHA1 b533ec0b7cdb36d085d62339bebc82e77c5e0c71
SHA512 8f7b94cf07f3932df48eedd88821d68ec35bd1b7ccefcb0ad86276322bfefc5aa18b90414db0999d7074f4a943bb4179b688cc201cdf811f540c84ce672929df
TLSH
T1BB6140BA21729C96FF994570DDC9124BB9BC948015DF5FD65FA6C0385C0233B5ADC04C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8852d1177fb2a178f748784e3bb9782d61d05bf0fd146fa06ca9d065f7e3ae2e
MD5 6fb9aa77000a3d789f4625035afaab37
SHA1 8804e7672e5aae39e59201731be033612f8c106f
SHA512 bd8c37a66471b1d88b5659114c0544fca627f18166aee6f8640d56151b554bbd10fcf88c4720cdb1e499832ade3a35194cc0eca2f4987811330541e90e68d3b3
TLSH
T1EA8188F783A2856DDA0195F0AA18AE1BCF280112436C3C6989E07E57E3F2871E141B9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 43e3000cd80151ba5efd84e2de3e431df3a9a0eb0a024ffa8b93c92ebebee401
MD5 917988509cd23365463899c3012e6dab
SHA1 b3295fdd0f6c9fc07ed22b4914eb7e3cf0d5debf
SHA512 53e64830036096706e1b08ccc709cb9ab5500b2a533b6ba5a2aedc8f59fdba7a7c76116fff5d24952a531af53659acf5db53553b9d13352fc2588980ea22c3e8
TLSH
T1FB416BF787E1956D9A0259F0AA18EE2BCF2C0511831C786989E4BE57D3F3872E101B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 46e19aa1df75f83241e5721745d123781ebaee37a3ef2855d4703eb22ebcc584
MD5 0b16b8bb2f912ebb243e635b0d9a2ded
SHA1 f8726475757283f49030658840561da0a35facdc
SHA512 d46ce43c90c6f73341bf8486e6cb112c398e196934b2746b54711f838a8b68f230a57980c46ea9320de2879bc04207629c60bc527c2348e0fbc9a68b8b490daa
TLSH
T1985176F787E1956DDA0256F0AA18EE2BCE6C0511831C786989E4BE17D3E3871E102B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bab498bcfaf54e01ba96d3495a1910ab00368bbc2145b99c40aa0b16689c8472
MD5 f063f984edf5adc24619f7203b21d5ae
SHA1 38adc8cfb5c036b77a3f51528dc028bf7499e289
SHA512 445687ad920d2334e78270dab79e0c134bd8bea060d14153504300558a248db84ef0fb920995d8aebdd4dea5d6b6d42592c4bd1c68b9c2f18748a21ba1d187b1
TLSH
T130416BF787E1956D9A0259F0AA18EE2BCF2C0511831C786989E4BE57D3F3871E101B5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 477c4775deb8706576e2e4a7e6bcc077fc890025ce5bc329ffa631509f67ca42
MD5 215f9dc6b015d83397e70d863727fbf1
SHA1 a02dfc143d54af8eb6e4792f95f73f9fe35acfb4
SHA512 fd022f6916a1bb49a963c9ab26213d34df4d40305bbcec0ffb3963d6ffb6f6456272770aee2f5827b99d64e8122817805bbc2b311add9206a65851a9f4395b2e
TLSH
T12BD02317176D3075955C1FD54077BC5FC37740305482FDD550E0E459093586C055754E
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5aff70.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5aff70.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b2bf46bae5b1604346f7c1ed0e205fb16867295e176b96c0282762157b50f811
MD5 76cc03058a4c6e2b65720571b0ddfbaa
SHA1 a3ca7ac61dcf1b72687f370d7de7a13a0be57a38
SHA512 bc64ba9481451340bf47bdc33a4c5b15cbcc9a329ea685f39109b5b5b29ca36675b50e570fae4d32edfbd7e32c48a8f9dd6cf37332614f3d8fdb237a8cb15a50
SSDEEP 192:sxZUxRZne/fesz0tGIdp9/FHW6+WNYTH/YapBO2IgrJ:sxZUxne/fesz0hbHbs/v9
TLSH
T1D222C8566E38A97B8CCBD21DBA55BF53E6F91032A5D01E48EAFC861C04E76DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ee0d7f3aebdc1dee2e31c1a9d73ede970407ac66a11329a9685af0d92315b458
MD5 2a5d211c321156504a6c6910553f064c
SHA1 73b968eb96ed4c05a29c617313999aa7d9536a64
SHA512 27541b9c8068f9604e4cab0474a4ab10de2d5667ac43d03dea2b7140502e828dc20dbb2f9a43ee7e89c4ca3f6df6605a8dfcdeec60a11e97a12ae9dd5cfe419d
SSDEEP 192:sxZUxRZne/fesNo0tGIdp9/FHW6+WNYTH/YapCO2Ig5hJ:sxZUxne/fesS0hbHbs/IV
TLSH
T1C432B65A6D38657B8CCBE21DBA557F53E6F91032A4D05F48EAFC862C04E66DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fcaaf5ead0607efbcc38c324c5f89119730a2c7a57b06c58d77926ae6596e8f9
MD5 3e4b3d0111e84ae08ce91fb5e3c8f29c
SHA1 509851db1dbb5ff3f2428463fc8ceb33b803af6d
SHA512 249ab1ad59cdf1cba295e62714be704a7cd281777a53a392e9788cd767a057ce73efe25fcd56dc55bef49d09d6e2353d76b0bf99e82cb7f89e11c296d561dfaf
SSDEEP 192:sxZUxRZne/fesNomtGQRldpvyFL7HW6+WNgz0THquNJXoW/RYapD1Z2Ig5bJ:sxZUxne/fesSmFP2HbjphBZNir
TLSH
T1A952B75A6938697B8CDBD119FA15BF62E2F9503394D05F48E6FC8A1C04E2BDD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 475d9c9ff5b9fd92c9bdb401a13294b3f495110542cd2fa708f68fb0efe7551d
MD5 118fc46e72191d83a66140f65d152689
SHA1 7d0906506e979793e1c0abb936613bf0372ed511
SHA512 af6199b3090f09d18bc5d731e2d6be29466ebc62235aac8299c7d2364b45fbbd69258f3e3adf76ebac679f47c1af241ebfd0736333d20274186aa0701b062b51
SSDEEP 384:sxZUxne/fesSV66s8qMpRiYnazAW8pZS15posJWeT+F5r2HbjphBZNCr:sAne/fQV4Mnc7WeT+F5aHb32
TLSH
T1CBD20809A824C87B9EC39D29A83D7E33E9AC506255C5CFDA56ECCA1C01DD1FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f352e222a7f068492676f1f19a4fab3f9a217f292d13e742fe8e5cf6e2afcf5f
MD5 b5df31dac0326ea70e314761c97c73ad
SHA1 f7f238d36cd55018070c55cc9208d3823b7937a5
SHA512 1200a0df8d120dd337c72ff955d9df9a527a9f5fffb2cdb0cd0c7b2abdbc3de06ec9b83f9dce4ca117228a3c7e9f3df717df26edb5022a1eae813ae7d7142fd0
SSDEEP 192:sxZUxRZne/fesNomtGmR9dpvyFL7HW6+WNgz0THquNJXoW/RYapDlZ2Ig5bJ:sxZUxne/fesSm5r2HbjphBZNyr
TLSH
T14E52B65A6928697B8CDBD119FA15BF62E2F9103394D05F48E6FC8A1C04E67DD630380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5424a4b124a66cd49dc91aa2ce66411838c8a4ad8c8afeca4a80fe6e02a7f81d
MD5 84b8f447137ef50f32965f07108cd84d
SHA1 c47751bc88262525bb0c0a691fea2c6b55155e15
SHA512 bc0bed0510ef0f5b7712643b0c321bf0b970cad6d5abeb19c4ccc21c8627ce2e5b9e9880fb863e4a22f356947efd7578d8dea38073ce94da64012a2ac276d744
SSDEEP 192:sxZUxRZne/fesNomtGIdp9/FHW6+WNYTH/Yap9O2Ig5bJ:sxZUxne/fesSmhbHbs/Pr
TLSH
T11932B55A6D38697B9CCBE209BA557F53E2F91032A4D05F48EAFC862C04E76DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 ceee18aeda52d779ab9227b730b5ddb101365e259b7d7afe7cc1a2b7e71a46fa
MD5 b50b132cafeb1393dc5d54927671c533
SHA1 b572ba76fb90f16a59654ceb274a16526222ffb9
SHA512 d23b5bed0d0dcb77f955823861c6f248ce2580d2895f3b8c61b4b2d5694b0140cb62fd25d08364b6bee33366be532b4ac86fcf45d5e78df98c82013830c4f123
SSDEEP 384:sxZUx5e/fesSV66s8qMpRiYnazAW8pZS15posJWeT+F5r2HbjphBZNCr:sA5e/fQV4Mnc7WeT+F5aHb32
TLSH
T1CFD20809A824C87B9EC39D29A83D7E33E9AC506255C5CFDA56ECCA1C01DD1FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9b4c2a22b1202fda4397b2df2493ebf929a340bf387cb9dd6aa236004ef8149b
MD5 0d814425e553f5e229768618180aa56f
SHA1 7fb92992dc67cedbf6f904cfac7baf36a4178c61
SHA512 c794cf730f5013ca707bc5481e3f9b9a55bd5b02c0298d97da2694f59bea2c5fd3277192ecc49ff0c3b4ff9f6c9da4a9f12926a80ffabdf4b1806900cd6bba67
SSDEEP 768:jlWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Yro4EfejmRu:jlWPcLKWvKeEeu1jaClLiF7j4EWjmRu
TLSH
T1BEC2EA2F644CCB7E4FC01A9DDC5A6FA77E9802C79A648D4047FE954C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5aae39ec-79b0-4eff-b5b6-8d9559be1957\index-dir\the-real-index
Size 960B
SHA256 6cec8e8a78efb046fd6cafe54391d3f6ef17da6eda70f2a993fe1b23cab98c88
MD5 3cadbb91a0cf311d0f79fb656a6eb9b2
SHA1 bc2b6c1ecd7c29bd8e15b0011c9fb5b64133ba05
SHA512 4969092ac19ed71abc905fa8db183ea2ea4520bcb56d58c06fd5a47dc763a34a27273f5578358fb7a29159ccf18dbf928a45dfcf522c4804611731699ea5af09
TLSH
T10F1144860C534B97EDD40274257C6D45A27102DC1394BA4FE2BEE026CCE6740BD82AB8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5aae39ec-79b0-4eff-b5b6-8d9559be1957\index-dir\the-real-index
Size 3KB
SHA256 6813e165f2d4dfb39245b56efe7b68c80f59332d46bc7733922f79e315ee6d37
MD5 6023495dd4d4b2f09c0df0a5bb5df6b3
SHA1 a8cc79c433d97c281a7164a9bca912bed36255d1
SHA512 6baa79ba5c0fa4b3bfae27fe93174f4ed28c8f9e31990dcde314f261a6af61568e0198c500d87f78068fb41a6147607ba8d9e6747942fd5adf79b3b7f3370e65
TLSH
T1B551B50E5D475B2ADCECA6B004F2040637787AEC66881E2B60FE9535F8C7739699C66C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c6430.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5aae39ec-79b0-4eff-b5b6-8d9559be1957\index-dir\the-real-index~RFe5c6430.TMP
Size 960B
SHA256 633010d78b6b10b50b8d1a4a8a78e4a5f9fe2d1ece3be930ca6275bc87b2da2f
MD5 8770b8ba26fcbe0da3acd32eac16dc25
SHA1 1f466d7efc41e4a7cfecde438cd7c46cd541b2ad
SHA512 3c4fd876c23c9f642f2137772420d0a65d3a9604af7e9b6b0529a3a5e076808d5941355ea676ae71c4eb9c976d67241616e112b53d837b5f4a8708b5beda6a3e
TLSH
T19D1123E601538B57FC4403B59AAC6946227690045358774FB3EBE11ACC92B846DC3FF0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5934407ea97ca4af163db84aca4fcf4742f0c4970b726f147e009b3f7bfb9ee3
MD5 00a440511e4463e24749efbbb8bfe0fd
SHA1 f57f27fd576612f66e4509b887f79f2574fadb7c
SHA512 77c9bdf5d378a7dd170039188a6b47b66c380fe4df4e9f238229109f774207778329d6b37efc5505800c889a0e62c35fa4eb1c5ef0ba439cea4e82b7aeeced5b
TLSH
T13FE0C0B72DF70824EEAFC3D504B014B04001B424CD9CACCF512AD1C360B13603146C31
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 8871ef9fe02e85f6c9848e0cf779eca46e66608f43cca9516d63e221b6fe92e7
MD5 d4503c3c3d12a00371eae521cd0fbed5
SHA1 5b01a435191b0ee714a9fb70d311b484d965704b
SHA512 e2d21269bf3d785ef5c2c2ed75f5f0e6b9c715629c4f094c666984908849ca00a09c82f1b76ac673020f6a955c825806396101fbe1d78be3eb82d1a74fcd05b8
TLSH
T144A002119ABFD401C8014675A065635233594CED1106175284DCE099CCF218B71C1153
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cdde4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5cdde4.TMP
Size 48B
SHA256 a8b633dc6d5fb590da04d50f695082628eec0dc0f6f6d3411e3ae5ee8c7ff567
MD5 46da5b36b68f992d8b9cf73adf7b1137
SHA1 df5e7283a36150ccb9827e6e0fe42a58ef428527
SHA512 8314d789db0168ffa981e43281b8e8e62dbff699ebb358173fb1517e5dc740003ab460f5a1d30bc4b1a90c5174dc25b43fbf80f654a816f53ea4cde993a725b2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 4232a07564a6915dd0c838b252aa346a8afc4430c94385bc9efd32f95adbe33f
MD5 4c8f67bd8edf4e705c8cab633f33b24c
SHA1 42e5f57ef70df70fb38b9521bac2522ae4b6587e
SHA512 df240ac6842ac38850ad7a7b4dc58eebb88c48c96621e9d11b70c6b28fd27e7ed89c38dda2ba43614e60c75ab97ab507bac540f3e1be228ae614f0932b30fb25
TLSH
T163216D6271B606013E7D350E83E6C51A434331A5309CF92B776C00D63DE6E155EF8BC9
MD5 SHA1 SHA512 TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 d6a9eb5fd0ca4eb8d676482b0c216c1ee02b2358345ace414d406c87e0e78317
MD5 80c422f0c18c4a98cecb4cfc9ffa801f
SHA1 0a8a5a122290adf49518b62179e077856ceee53b
SHA512 646d9679032c679280939a8cadfede5dbdb5ff39fe084de753ba4b9ad95822280e16137c8fd6b70345f065ec8cee5d78848827c86b4cb6f6e2e1e30453bc4cf5
TLSH
T1811145C1B3F954D57F4D7541D34A590362A13F99214DED31131E98F06F48C2A0B9FB65
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594462.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594462.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2aec217930ee68ee4b3524ab4e5a8e0a6b99206927e52467290f8bb77e007926
MD5 3cb28cf371c9bc33c4c3fde8c4482ff1
SHA1 d42df2255c8385ee71e9211fa8c248ec53a43412
SHA512 22bb920a45160f86cb2bdf7925a04dee356fb3f86a28d21a81e2af719581eeea40969a3bbf9715944920999288dbd7843e97ac4eb92673eb454f54671ae88348
SSDEEP 384:DiF6ZcILhsNb8TUNTUlIRST8U13s82zIGmUkOA+PWeiHvtgOIwZOyoEoG:uF49qwgBUe8ALkOAEWeiPXsg1
TLSH
T14CC229F648EB887AE9AE4743E77E2D034EBCC067B4849650B3D8560CCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7a88a11ca3bf7e9205e5bf5a5b2824ce1d751c5c0245d7de1ff52fbe88af0a75
MD5 674c130f9b8e0e4d7a1fae72872b102e
SHA1 e75665b82b1f64ebf793e62e9080ebe75a6054f5
SHA512 d79e76b45a907fef746a66903d65b0824507fbe604a8d928eb3468b2208d37e377c1ab6c2dd40f6c2a10735b54109a7104699852ef566460999a7882e7150a9f
SSDEEP 384:AZcIDsNvPXU1su7zIGmUkOA+PWKiHvtgOIwZOyoEoG:+DSUjPLkOAEWKiPXsg1
TLSH
T156829D3A9D7C9CB76DFB9544F9473A134EB88027E6C5AB90D0ED6B0D05DE298230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 175560876f24af83dfd4494f82bb094141ce81b97bf5c9888b2a0735a44b761a
MD5 564988130d074e464ff3432b79075702
SHA1 38ec58d4ad172516206526cce92b79caeab43055
SHA512 ec5836e509e04e6fe35c147722e880c31020a968a944abbe6ca988fbc5d4b8a4be4694321d624b92cf6cd042ad7b4a942011603983a6f85e3c5c4afc391ee70b
SSDEEP 384:DiF2ZcILdsNR8TUNTUlIlSXU1sb7zIGmUkOA+PWt7iHvtgOIwZOyoEoG:uFkRUwgyUWPLkOAEWt7iPXsg1
TLSH
T1A8C22AF649EB887AD9AE4B43E73E2D138EBCC067B5849650B3D8560DCC961BFD306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 49c5e25c0bab041f99fabbcbfdef7bd4ccfb443757a5548364f76381d6692eec
MD5 658522b09b9ce2b52d84d53a5a8600a5
SHA1 59577af741d447d071384dcdbe5677257700ebe3
SHA512 76465f14b01bbbeaa4dec91b764f1d09500812368e83f2b2747cf78c3c40d1d84afc4a2ff79979d5f136d3d0877ff5d845aa8e98f66ed2eacbfca12b7b6914b5
SSDEEP 192:aONx6IE7QmiUyhyTPuIGmUkOA+kC7sq5U6:aONx6Dt/PuIGmUkOA+RsSU6
TLSH
T1AB020935AC78BCAB8EF36E48F4473B239EA5112BE5956F94D9D81B1D00DB34C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1e375ea6d54f1703e3f172e8aa919e5e0dc2160729920b469ad8e89817a5c112
MD5 3f6b7c82616a3853a28d8284752b08f4
SHA1 dd0099b55d748fbd9a91115cedf7c2dafc32f742
SHA512 61f18b28c8891d2bd04ffdb8b99c98588086f6bf1c0ab8c7c95a7172557264f3b94f155d27cf1c722ad39621add342e6e77d92de6d9f4b4e5212cbbe14b7b082
SSDEEP 384:DiFPZcILysN+8TUNTUlIlSXU16F7zIGmUkOA+PWsiHvtgOIwZOyoEoG:uFHuZwgyUCPLkOAEWsiPXsg1
TLSH
T1C0C22AF649EB8876D9AE5743E73E2D138EBCC067B484A650B3D8560DCC961BFD30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 01cf5c892a36a79bca1f8216ff89c28c60e8e89c3da9377da5bcf10df7a1702b
MD5 10a9bd2bb4208e08fd6f9471296d4e34
SHA1 f8a1a61348632a475d8c4a37d4226df808e063fb
SHA512 39d3e3c2f923213a65efa746be9bda777b082d6f16c6975397df705bd3abe21e35ac1770cc867d25e6bad0776fb8cfdfd441cb529a866e03f8cd3f68d69a273f
SSDEEP 384:DiFoZcILgsNb8TUNTUlIRST8U1Fs82zIGmUkOA+PW7iHvtgOIwZOyoEoG:uFWUqwgBUU8ALkOAEW7iPXsg1
TLSH
T17BC229F649EB887AE9AE4743E73E2D034EBCC067B4849650B3D8560DCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a5e38590da7ffb711a203477426d2c0c201f2d633db4946105e58e676064b899
MD5 5de3853e2a8254f16fb32791d83d1da7
SHA1 e441c4b0cf5f7533e05f9cfbee8dc9c464ad0749
SHA512 69092a51a689f02d6645b753879f39df366638a069b95c595d1367a61fd6cbb1cff805e8d15986b1e048aa12f29f41b85c50f397130d3c918b186bf67b7d6da0
SSDEEP 384:MZcIhsNvbXU1Cu7zIGmUkOA+PWKiHvtgOIwZOyoEoG:ahWUZPLkOAEWKiPXsg1
TLSH
T1EB829D3A9D789CB76DFB9544F5473A134EB88037E6C5AB90D0ED6B0D04DE298230B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1b3ba98a0b2159a5b37bc6ab682fa46f47e116fa52888f345a7ca999af13d442
MD5 1acdc2abe90e391661a00640b54dc84b
SHA1 ac81d830b158665907d7a192d96462d33d6e404d
SHA512 782ba3b20a5d5c3d74881f55bd29811d217b0d571ff1e02025e89f8c187174e8ca86f590ffb5f2ff68407fa50dfe05a0b774d7cbcdb4b4aa5f517a027833af74
SSDEEP 384:7ZcIDsNvSXU1su7zIGmUkOA+PWKiHvtgOIwZOyoEoG:jD/UjPLkOAEWKiPXsg1
TLSH
T1F3829D3A9D7C9CB75DFB9544F5473A134EB88027E6C5AB90D0ED6B0D04DE298230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 42b4d98d9564319e39c15076be8730dca471aff0ec50526398b39bfd1fe85415
MD5 7edeb706e3607f232d4dfc5ec516c33b
SHA1 c48af178220282459838651644aec02c55268ec1
SHA512 8418dcc5b5ee3ffae229411e14135dca3a193b19bc4243eb357fec9f7b29f9a122bf9b1d05fb8c3e99989aa5295b6d7728121abe121ce92f2e06c127c7519bd6
SSDEEP 192:aON66IEkQmiUywyTZuIGmUkOA+PW527HE/w5vU6:aON66D0kZuIGmUkOA+PWmHHvU6
TLSH
T1E7123A36AD78AC7B4EA36984F44739239DA44127EA85BF90E1DC2B0C01EF25C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 eeb61f96b8404d5962206c387dbc8adafa82d041a9f4202ace2129f2871b0c82
MD5 be7193bda4917fe9d470f47c2994fb86
SHA1 54a0ddae813bd43432ba9e082bf1896898995bd3
SHA512 03c9823021d44f7d7c5cff9821fea12c2d6fde5cba653b79fdc1383cecdc4386a83dd429541879c298831486b717739afb22b2c05345031f3a9052520d93ed06
TLSH
T186E00206D30041B9C038033510C757201AD5841101B202495B1402557C233212F30FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5c7314.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5c7314.TMP
Size 392B
SHA256 3712d795822358db70d5dbf05f87bab698e81a1ed337525b56cf7f28804dc8ce
MD5 75e125bae835c996bdb70ba74a7c2aa8
SHA1 a4e72a043f1bdfc74e0abc3748f2b2cd5f456141
SHA512 306c50d4ee11668664aa61c719cb3c9e4469a5785e9e160c9eb7bb18578acfb8641ca88d521c009abf0d220d6a0e18298d7a42a70f9ce63fd96c55d29a83a744
MD5 SHA1 SHA512

Submit Download

e536bbf9-f6f8-407d-8a9c-a075a50ded20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e536bbf9-f6f8-407d-8a9c-a075a50ded20.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8b0cf83e7f81b0b38fc023afe13decca144183d91d2ccc842f638eeba33f365f
MD5 4dd61107498d79c191a0f7883e2bee6e
SHA1 f3116bed8fe0c01bd3e48d1c04a4095d5e2a13c7
SHA512 22b2faf5490e0dca29cb7459b82663600b506d4e99a085b6038cc8645cf8d6eb0a10208b3dc3ab99b57e777e700d1f83ad7e006fe1b94e9acb63eb3dc28e233d
TLSH
T18A416A98AAE91058B3B37E5AABF3786E047BBD732E06D49D00100D4F0667A40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 5aaa72f685f318b450656eb4ff7bbdf1ba58056f56540a8143af37d046bcb722
MD5 9673342307be0e9cc1e4c0d2ba0d7ec1
SHA1 4dfab68d661593d80ab210adb29943251d555818
SHA512 148086ed1dd21976d5500f741345291c15783a5116b6aa499d2da0e34869ff9187e5cd10b6e6007ba867a44a2ba0ab66d136d3b579febcab7c8ffc6241b6ec07
SSDEEP 192:pCU4FioC9evZB4Glhdb5SJL3W3k6eGid65Wr+deP7Vqf72PP9EamOUXx:QFQovZOGlhd1oHnGidUQoCPGamOs
TLSH
T1AB43A396B448D606ED0D1C769FE6D6EC6331BE16CE6A031338C2B77F89BB0C04E55645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}
Size 36KB
SHA256 813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
MD5 8aaad0f4eb7d3c65f81c6e6b496ba889
SHA1 231237a501b9433c292991e4ec200b25c1589050
SHA512 1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62
SSDEEP 768:XmmmmmmmmmmmmmmmmmmmmmydiXjPJdKQ7ai3ZigbmY9//JD9UZ99tS0FVGn4YEbR:fig1Z
TLSH
T1B7F2DF61F616A589F74B58B159ACCCA080D63C7D8EF0051CF2EBB71E42B336205A9E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc
Size 36KB
SHA256 fdf01d2265452465fcbed01f1fdd994d8cbb41a40bbb1988166604c5450ead47
MD5 eab75a01498a0489b0c35e8b7d0036e5
SHA1 fd80fe2630e0443d1a1cef2bdb21257f3a162f86
SHA512 2ec6c4f34dcf00b6588b536f15e3fe4d98a0b663c8d2a2df06aa7cface88e072e2c2b1b9aaf4dc5a17b29023a85297f1a007ff60b5d6d0c65d1546bf0e12dd45
SSDEEP 384:wPa3Nt+jJBEiqnYcnXYGiExSUGrEoikM2vVetvNSvnazbqJ:taJmiqFnXH+UGYoikR4ayzbq
TLSH
T1F1F2AE777B8D0C8AE7202DB8AC16416EE114DEFA845D7927248CFD5E27E64EF2900DB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134336129508011967.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129508011967.txt
Size 59KB
SHA256 453116e1cc81d853732492743626b177045a25e200a632f4b5580abf4e29fb94
MD5 162e978c0a47f62572cbaefb631f50e5
SHA1 c59d96872a57ab656076c62d3c932260588b118b
SHA512 ee673762d6c3d078495f27e11e81bd746c357cd20731c5d107f04aeb066069d1ce515523ccf0e091a132525755cd5a0ca3878d0d7e634ffa623cca9f3e7c68a4
SSDEEP 384:H/Zk/Ey/eX/NV/CzS/1o/Yd/eAe//6/PYK/mY/8j/nDn6QwY3/GH/le/gk/bc/8Z:mRe9N/riI12
TLSH
T1A343B3A53291CBF3317966A0BCD9E425E13926B1E0E88F4161FA9613FC5ADDC62313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134336138734704433.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336138734704433.txt
Size 67KB
SHA256 5b96e799804a17711369816f8262b4d41f7f7a3b2860f79c8129944115a6948a
MD5 da0a2ba90194b91b221697c46d50a11c
SHA1 4556cff89a56849b149c82708e44b4189d4ce5a8
SHA512 457ffb8213cfa7a4ca22c66e595ebc71d581144aa2ceaf38a50f521b0f1dd55901eebcd41d8eeecd862d35f9e5f14ee574d889abcad9819d2eb869a5bdd8a943
SSDEEP 384:DL/aNU/gT2/Hl/MI/Zk/Ey/eX/MA/NV/CzS/1o/Yd/eAe//r/tM/D3/6k/pe/tZT:fqRI1Q
TLSH
T1D963A4A53281CBF3313966A0BCD9E525F13926B1E0A88F4561FA9613FC5ADDC62313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\settings.dat
Size 8KB
SHA256 7fbb3e503ed8a4a8e5d5fab601883cbb31d2e06d6b598460e570fb7a763ee555
MD5 a8308d2f3dde0745e8b678bf69a2ecd0
SHA1 c0ee6155b9b6913c69678f323e2eabfd377c479a
SHA512 9a86d28d40efc655390fea3b78396415ea1b915a1a0ec49bd67073825cfea1a8d94723277186e791614804a5ea2c12f97ac31fad2bf0d91e8e035bde2d026893
SSDEEP 24:6E1+/r4WlVnQlDuUbwB7d82/+wB7svTnl/wZPo:TMJlVM87d37J
TLSH
T181F16D02B240E3D3D9732A30CCA6D2C437B2FE586E12470739D933EE19F27658E5198A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

245da1a5-f80d-4e55-8208-84522efa1978.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir404_1622892399\245da1a5-f80d-4e55-8208-84522efa1978.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5E73C02F-3240-4C30-9791-EDF44F46C3D8}

Path C:\Users\Admin\AppData\Local\Temp\{5E73C02F-3240-4C30-9791-EDF44F46C3D8}
Size 4KB
SHA256 a9adacb686748980014836a8b364245588cc31efdac60e0c7bf85a75db51d2ad
MD5 6715c17564be34d09e5e64fc881aea98
SHA1 439887142fb68bfb5482559659b214652e169d97
SHA512 1af823bb0e2b31db6f0c1fdd9bc18fb6eb87df0c5b8c8d8cc841b21825545981e75faa5e6679132c25384bfcc2ef2a872104746c97dd6942770ff2e5d7d450f5
SSDEEP 6:Ra26DltYyfB3h1RRXUnfYBxcOatJXVFKArwRrtRujlw//0lweI/w5RrHRujd:RabDbYyf9/UfYH/+ssWf/00
TLSH
T1D3A1DFA87B9DC194C0240C393E51CAEFCE623D899C0111C3B9CC33AF2832F402808220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQWC1Y3HBQKGAMRUAYTK.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SQWC1Y3HBQKGAMRUAYTK.temp
Size 3KB
SHA256 5f948f9581883fbfa74a72ab814502cd5cced78b799b693f4a9a8a4317b12b33
MD5 df756750788ef7a8db827dd26dc72e53
SHA1 2931774dfed71099f30bbc4106d2ebc1cad7d314
SHA512 6d0fc12ec6217b25345b60d66e101e3f3f2101b122709d9f7ab0821fb949abb7b5952335f2e5477f46ae7135052325d42c50882257b8be2e49475b5f4ab01d16
TLSH
T137819F00ABEA0A9AF3F79EB254727B11AB7BF90596145B4E018442091C72B04967EFF7
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 7985e4ed3c360c00c81407b3d66ad63dc19ed7e6384cb4bdc7db72f58c3db90e
MD5 5b9becd77433af32448af62eb4914c3c
SHA1 f19163731a6dccfce12d464926327a086c51a83d
SHA512 226253df0b339ef8d8dff791640a72767546a2c43c47aed43140a30cdee69215bfb47ecba340edf3fafb815b86dae0f547c252f33fcd1a5bf0cde689dec73075
TLSH
T1CD81BF00ABE60A9AF3F79EB294B27B11AB7BF90596145B4D018042091C72B04967EFF7
MD5 SHA1 SHA512 TLSH

Submit Download

2823318777ntouromlalnodry--naod.sqlite-shm

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm
Size 32KB
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA512 d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
SSDEEP 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Open Notebook.onetoc2

Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
Size 4KB
SHA256 27d0b08d2c5ac25fde536d0899e82c80a01259365c1aa37775eccbf435ad6c0d
MD5 425235daf15ac21594a2654b5d93acb7
SHA1 033f374b0b998e36201b8635b26bafb656bbd204
SHA512 00ee4fc8f88be55189eec8077f0805942aeb91530b8afda1b77bd5f1edb4f476d742e4afc16904d17f2461f65f87b56661f473346af241d67dfa79178c8a1caf
SSDEEP 12:RabDbYyfHj/UvjlEHssW6/0JMuS97FdYOEIxA/L:YbPYyfHYKssWJMuq74O1Aj
TLSH
T14BA1FFADBB58C188C0549C383E53C7BF8F62BC069C050287BA98332F2C39A942924630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockBit-main.zip.crdownload

Path C:\Users\Admin\Downloads\LockBit-main.zip.crdownload
Size 292KB
SHA256 707bb3b958fbf4728d8a39b043e8df083e0fce1178dac60c0d984604ec23c881
MD5 68309717a780fd8b4d1a1680874d3e12
SHA1 4cfe4f5bbd98fa7e966184e647910d675cdbda43
SHA512 e16de0338b1e1487803d37da66d16bc2f2644138615cbce648ae355f088912a04d1ce128a44797ff8c4dfc53c998058432052746c98c687670e4100194013149
SSDEEP 6144:n42LBVCsV+PkMeW9zTiY/NaQmHst5ySPzmcfIMwmafvR:n4EzwkMeWgY1NmyESPB1/aXR
TLSH
T1CF54230B4E35C9CDFB6CABB3556898E49DB7CAF3BC4B1D49F05193B0A25E9082602E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.md

Path C:\Users\Admin\Downloads\LockBit-main\README.md
Size 4KB
SHA256 64312260bf9f040c92ece170d05250526f138f059760b8a5b9023d6d38e71db1
MD5 dc8d96087e0094c3cc793b3445bef8de
SHA1 8bf22f847b778daeccf43468516e775bcda2802c
SHA512 f939d6a2b9a957a5c0c45beda2e0103a84bc907e2fef0b747c91144b23c5663de388d3076fced1a5a696bb45e7314fd86f19f8fdd668d0d1aac3947290276c2e
SSDEEP 96:IWz58QWqTMNWLWqN+LloWRWKWl2xRTWQ2Wbl6LTkP0W2WCePW1z0WXh0CjViC8AS:IWz58QWqWWLWqqyWRWKWMtWxWb4S0Wxt
TLSH
T1A181B51FB3191772079642D6755A23EAFB2BE49D3363CA2D586DC00C338586C833A6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lockbit 3.7z

Path C:\Users\Admin\Downloads\Lockbit 3.7z
Size 144KB
SHA256 f104e1f06b09c0822f015579208f4184a6645c48e4ec1a3efcfa65e118bd8862
MD5 0373526c3cf309a3fddd066dd25744ed
SHA1 21a5ae67249c0f957bcdb87bfcc58ce9e7f7c3f3
SHA512 dfc4a97996aab740cac0507db0ae3c0a5101f1f4ed19c9da14f2a987d87f600401ab9d6f2d1008b16483e13af4397e6f7dcb24dca2cc5e142ddba8118e33f36c
SSDEEP 3072:NLU9VfE0ebOHK1qc4TjykrMAuAlxQ7vy6uR8D7ptV+f:RU9VUQVTjnuJ7KR6tY
TLSH
T1EAE312DFD25E18A2D1CEC8086B2A69DEDE16FD13109D9F2F70C72D29F63C5C01915A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Build.bat

Path C:\Users\Admin\Downloads\Lockbit 3\Build.bat
Size 1KB
SHA256 95df1d82137315708931f1fc3411e891cd42d1cab413d4380b479788729248ed
MD5 b8f24efd1d30aac9d360db90c8717aee
SHA1 7d31372560f81ea24db57bb18d56143251a8b266
SHA512 14ebf7905f15983593164d1c093bb99d098daf3963f1b7a913c1a9763acb950075a0d2cceab3558cce3e7269c2a2d5dacc2b3c6c55807b0b6bda6bfad62dd032
TLSH
T1E9212872E045293740AD8C41E9F9DBD0AF776AD78642044ED12AA23D5722061637E6AF
MD5 SHA1 SHA512 TLSH

Submit Download

EEEEEEE

Path C:\Users\Admin\Downloads\Lockbit 3\Build\EEEEEEE
Size 153KB
SHA256 bbbe62cfc161c0977d8299fdaf8460ea40f42b2374abf49b93525e49c3c17e4d
MD5 d562911ca18d924255f87655aacd686a
SHA1 abdb7fbfcc1c974f1f7f47113be33b121372d483
SHA512 37f0582e18a2f6f22a4bf21a46cd161a9577702ff6c46bdc536262ab33493679bb66e6cc4d85aac8ddec99c2b516e2e07eb22d63bd1665b1d107e01a9e479e9d
SSDEEP 3072:uVfpVNPdFJ1yxmktVfpVNPdFJ1yxmktVfpVNPdp:mVFFEmeVFFEmeVFp
TLSH
T1C9E30276728F01E9419A7145372D8384A6208FE14EF5594AA8817CC3FB2DDB76A60CEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LB3.exe

Path C:\Users\Admin\Downloads\Lockbit 3\Build\LB3.exe
Size 153KB
SHA256 71e1465016d4ba984a7e47cea9d92a8ab640fcbf0189d8498733bf3c3df66f37
MD5 6f6b8d5c45dcec6a746008762e8580e1
SHA1 1d398fc379f669c598a39c18fc63c9ed5c5e8d4e
SHA512 1154b6519b43ef2348e9e6718d620c929462e4b906098f32f440c826168de5e6bdce9cad3c0a367991f60e6b7e649d454e2596eaa2af9e4d3ed102cd794e6f2b
SSDEEP 1536:6zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDHfJkaW2oZeIo3JIOIYQmsndQkf:JqJogYkcSNm9V7DHVWWIoaCQomN6QT
TLSH
T117E37C21F15ED073D86718F12726B17DB3EA4D2C1AA97807EAE50F48BCA19232F4591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

priv.key

Path C:\Users\Admin\Downloads\Lockbit 3\Build\priv.key
Size 344B
SHA256 a55d7975f7bdef9a9acb82efc95da830757a69d9e10b0632af5579f57928ecea
MD5 ac4cdb5ae3a159ec8c225412e5509b72
SHA1 a84b70d4ab8cec1bfba86662c4c1faa46490acb3
SHA512 68eb61e3bbf31ed7079a0e0db2ae4f21cc7ca28eba1bebb85431f00d758a553d8ab1101a3edc3cf9619898363698a3f5470e6bb53c6cb3f29b4860bba7eedf81
TLSH
T1E3E0205C78A939130D64BEF56D51754034A6C31D274A445A4930EAEDBB54198AB12DC1
MD5 SHA1 SHA512 TLSH

Submit Download

pub.key

Path C:\Users\Admin\Downloads\Lockbit 3\Build\pub.key
Size 344B
SHA256 9efbcd59422e60895e6cdc1e093c56ebc5fcd483e70dcb7e07feb026c4864e82
MD5 e434754bf22ab39c24858b0ebdf07c38
SHA1 8703e404cd240cc4560304e7933e1ca387b65d92
SHA512 f9810261ccaf1ec34afd73e90f2fcb10c347b0a4936961cf5c298f4e7c74454a13085290045ca156687d722fa6d3f6e5e909918539acdb2ee2fc8b3ecc1e55d1
TLSH
T1A9E0223550AC4D020884FEE108A011816C3AC32F404B01048A30B9E88B88048EA50991
MD5 SHA1 SHA512 TLSH

Submit Download

builder.exe

Path C:\Users\Admin\Downloads\Lockbit 3\builder.exe
Size 469KB
SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
MD5 c2bc344f6dde0573ea9acdfb6698bf4c
SHA1 d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
SHA512 d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0
SSDEEP 12288:CzVXpdg/1MB94JD7RfaVT1hG98P67PNV3giFH6J1VjR3L6dpbQrQyEpInmwuRUfB:CzxjgdRpBq1hG98P67PNV3giFH6J1Vjn
TLSH
T10EA48D11B225D073D07714F67B6BB129B3AF4D3C0A796803EAD41F0938B59A3AF11A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\Downloads\Lockbit 3\config.json
Size 8KB
SHA256 d121f4293160e0a39cbb184c032cd45baf1372db00cd33afb0e166ac0a60ac4c
MD5 de177fa08e9b2eaa378760afd53be6b2
SHA1 a18050f9e5f2412955df4b868ffb866209d2b84a
SHA512 44f4e745013eaa7d95486c91457c23fd9694f859920766f0139cf5ca9c84ff6c82d59be9675dd1a0c7b3216464c85cf732dbbdb0e641a5e47cbbf1830f4a0a8c
SSDEEP 192:4m26pOWU6ig4HJmLDHqlexR4LjIuoIyig4H8mLDHU:4ba5U6ApmZ+IoyAcm0
TLSH
T17902B26CDE3D2C3985C07C81ABDBBDA3E2B7619744C41A09B858C62D4F0DF1B61A67E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

info.txt

Path C:\Users\Admin\Downloads\Lockbit 3\info.txt
Size 61B
SHA256 ff6cbe9eb74173474478687bf6d296f4c143b94e783a2b169c09f69f724efffc
MD5 5c7fd82e86bb28a6ff4b66ec357cc3aa
SHA1 068a61d5d944a337f6313b4555156ee5ea222766
SHA512 8bfce35ae43a8ce55d414d77a833746faa77ebe7314ecffcd86e13dbb02f34e00f934956c703aeea8bc97295163f09cecbf90c005930c4a2274f5a73c40f3270
TLSH
T1D1A00221EAD1005B2630D5527C42116C35DD569A1A5D92524490991A520E53D5D546C6
MD5 SHA1 SHA512 TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\Downloads\Lockbit 3\keygen.exe
Size 31KB
SHA256 ea6d4dedd8c85e4a6bb60408a0dc1d56def1f4ad4f069c730dc5431b1c23da37
MD5 71c3b2f765b04d0b7ea0328f6ce0c4e2
SHA1 bf8ecb6519f16a4838ceb0a49097bcc3ef30f3c4
SHA512 1923db134d7cee25389a07e4d48894dde7ee8f70d008cd890dd34a03b2741a54ec1555e6821755e5af8eae377ef5005e3f9afceb4681059bc1880276e9bcf035
SSDEEP 768:A6+T41GjHbdWCWDwDD01riWpJxKpAQJs/3JGIDLQ5:b+U+hHIBpJxixgQ
TLSH
T1A2E2F6439695B8B7D47693B2322BC6FD8DF10D16026F667B0B3FF8701932C429B24699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cMT04i8Mp.README.txt

Path C:\cMT04i8Mp.README.txt
Size 6KB
SHA256 b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
MD5 dd746ace17e44ace00885b91400f11d5
SHA1 4a0302d2dca400598f396e4230fdae71779cbeaa
SHA512 8ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1
SSDEEP 192:uWo127U5RbnfuoHVMemUMHGU+d8EQv8lfziY9B8N27U5RbnfuoHVMmmUMHl:ZoUSnYxlAiYscSpYF
TLSH
T113D1C4ACAA7FA82844D06CD17FFB9CE3D3E700D561C8020A7890C62D472EF56E192798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DDDDDDDDDDD

Path F:\$RECYCLE.BIN\S-1-5-21-939655444-3071939294-1401108526-1000\DDDDDDDDDDD
Size 129B
SHA256 e8ee94d4b492a266e15484d8450a823324a9f477d5fbe084062ff12189089dc3
MD5 ad9312bf7ea093b2ab96e30a1527dd45
SHA1 cfaffad2f1221fe1238f04039869a5ebb4c584b9
SHA512 58bb0468ed60e4b94832e488499080965d7dba4dfa08306cc024256af9083847177accdab31295f41faa92e4c45aee8c8660b3f112ff54949e3f2cd9c7ab3c7d
TLSH
T196B02222AE830A300A2E8A3C080A2FE222A23332BA00083F000830828C200AC8B20808
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4324-5240-0x00007FF8E1730000-0x00007FF8E1740000-memory.dmp

Download

memory/4324-5274-0x00007FF8DF4F0000-0x00007FF8DF500000-memory.dmp

Download

memory/4324-5246-0x00007FF8DF4F0000-0x00007FF8DF500000-memory.dmp

Download

memory/4324-5242-0x00007FF8E1730000-0x00007FF8E1740000-memory.dmp

Download

memory/4324-5243-0x00007FF8E1730000-0x00007FF8E1740000-memory.dmp

Download

memory/4324-5241-0x00007FF8E1730000-0x00007FF8E1740000-memory.dmp

Download

memory/4324-5239-0x00007FF8E1730000-0x00007FF8E1740000-memory.dmp

Download

memory/5236-5302-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5236-5301-0x0000000000400000-0x0000000000429000-memory.dmp

Download