Overview

overview

10

Static

static

10

LockBit-main.zip

windows11-ltsc_2024-x64

10

Resubmissions

27/10/2026, 00:39

261027-azxf4shw2110

06/04/2026, 13:37

260406-qw9j9sas9j10

Analysis

  • user interaction
    yes
  • max time kernel
    264s
  • max time network
    267s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-es
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 00:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LockBit-main.zip
  • Size 292KB
  • Sample261027-azxf4shw21
  • SHA256 707bb3b958fbf4728d8a39b043e8df083e0fce1178dac60c0d984604ec23c881
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionlockbitransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\1nIbnujUk.README.txt

  • lockbit

Ransom Note
  • ~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: B7568014A48684D6D525F3F3722638C4 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
URLs

  • http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

  • http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

  • http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

  • http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

  • http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

  • http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

  • http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

  • http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

  • http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion

  • http://lockbitapt.uz

  • http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly

  • http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly

  • http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly

  • http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly

  • http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly

  • http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly

  • http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly

  • http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly

  • http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

  • http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion

Extracted

Path

  • C:\Users\Admin\Desktop\LockBit-main\config.json

Ransom Note
  • { "bot": { "uid": "00000000000000000000000000000000", "key": "00000000000000000000000000000000" }, "config": { "settings": { "encrypt_mode": "auto", "encrypt_filename": false, "impersonation": true, "skip_hidden_folders": false, "language_check": false, "local_disks": true, "network_shares": true, "kill_processes": true, "kill_services": true, "running_one": true, "print_note": true, "set_wallpaper": true, "set_icons": true, "send_report": false, "self_destruct": true, "kill_defender": true, "wipe_freespace": false, "psexec_netspread": false, "gpo_netspread": true, "gpo_ps_update": true, "shutdown_system": false, "delete_eventlogs": true, "delete_gpo_delay": 1 }, "white_folders": "$recycle.bin;config.msi;$windows.~bt;$windows.~ws;windows;boot;program files;program files (x86);programdata;system volume information;tor browser;windows.old;intel;msocache;perflogs;x64dbg;public;all users;default;microsoft", "white_files": "autorun.inf;boot.ini;bootfont.bin;bootsect.bak;desktop.ini;iconcache.db;ntldr;ntuser.dat;ntuser.dat.log;ntuser.ini;thumbs.db;GDIPFONTCACHEV1.DAT;d3d9caps.dat", "white_extens": "386;adv;ani;bat;bin;cab;cmd;com;cpl;cur;deskthemepack;diagcab;diagcfg;diagpkg;dll;drv;exe;hlp;icl;icns;ico;ics;idx;ldf;lnk;mod;mpa;msc;msp;msstyles;msu;nls;nomedia;ocx;prf;ps1;rom;rtp;scr;shs;spl;sys;theme;themepack;wpx;lock;key;hta;msi;pdb;search-ms", "white_hosts": "WS2019", "kill_processes": "sql;oracle;ocssd;dbsnmp;synctime;agntsvc;isqlplussvc;xfssvccon;mydesktopservice;ocautoupds;encsvc;firefox;tbirdconfig;mydesktopqos;ocomm;dbeng50;sqbcoreservice;excel;infopath;msaccess;mspub;onenote;outlook;powerpnt;steam;thebat;thunderbird;visio;winword;wordpad;notepad;calc;wuauclt;onedrive", "kill_services": "vss;sql;svc$;memtas;mepocs;msexchange;sophos;veeam;backup;GxVss;GxBlr;GxFWD;GxCVD;GxCIMgr", "gate_urls": "https://test.white-datasheet.com/;http://test.white-datasheet.com/", "impers_accounts": "ad.lab:Qwerty!;Administrator:123QWEqwe!@#;Admin2:P@ssw0rd;Administrator:P@ssw0rd;Administrator:Qwerty!;Administrator:123QWEqwe;Administrator:123QWEqweqwe", "note": " ~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: B7568014A48684D6D525F3F3722638C4 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly" } }
URLs

  • http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

  • http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

  • http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

  • http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

  • http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

  • http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

  • http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

  • http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

  • http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion

  • http://lockbitapt.uz

  • http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly

  • http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly

  • http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly

  • http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly

  • http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly

  • http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly

  • http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly

  • http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly

  • http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

  • http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion

Signatures

  • Family: Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Rule to detect Lockbit 3.0 ransomware Windows payload 3 IoCs
  • Renames multiple (631) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
    defense_evasion
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\LockBit-main.zip
    1⤵
      PID:2432
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2876
      • C:\Windows\System32\NOTEPAD.EXE
        "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LockBit-main\Build.bat
        1⤵
        • Modifies registry class
        PID:4740
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1192
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LockBit-main\config.json
          2⤵
          • Modifies registry class
          PID:3400
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4748
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffdcfeec188,0x7ffdcfeec194,0x7ffdcfeec1a0
          2⤵
            PID:1268
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,8546826689618543602,9232973629719880161,524288 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:11
            2⤵
            • System Time Discovery
            PID:2368
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,5587447187909284248,3216747156636060674,262144 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:2
            2⤵
              PID:5788
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,5677813869560145403,7804655324138347254,524288 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:13
              2⤵
                PID:5628
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,9255792489632653832,3857217257759610487,2097152 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
                2⤵
                  PID:1012
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,5857444784515176649,13003072191713984113,2097152 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
                  2⤵
                    PID:2692
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,14248028422590719898,7287086528146191930,2097152 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
                    2⤵
                      PID:3520
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,5592456055639671354,11235498710712793081,2097152 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
                      2⤵
                        PID:4336
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,11563276546931441341,14538322262177919960,524288 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
                        2⤵
                          PID:2336
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,17529437036615794153,9698811636480522285,524288 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
                          2⤵
                            PID:5068
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,15160601174675977511,12242262653001743343,524288 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
                            2⤵
                              PID:3668
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5912,i,9899795819426086791,5033898513113296077,2097152 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
                              2⤵
                                PID:4444
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5448,i,15419091468852733211,16691024961734228891,2097152 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
                                2⤵
                                  PID:4352
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,18442419352414249218,15072906965534622443,524288 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
                                  2⤵
                                    PID:5960
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,18442419352414249218,15072906965534622443,524288 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
                                    2⤵
                                      PID:1740
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,1413597274932085767,8717165298746410843,524288 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
                                      2⤵
                                        PID:4716
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,13782040560221198829,541873670270148217,524288 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
                                        2⤵
                                          PID:1692
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7248,i,18128126744063742795,1354504215715073835,2097152 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
                                          2⤵
                                            PID:4700
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,9816863420736615210,12006257337723436955,524288 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:14
                                            2⤵
                                              PID:6108
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,12546508520684482257,2477654917203493021,524288 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
                                              2⤵
                                                PID:4156
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4664,i,14013279230921574231,4986699588688945875,2097152 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
                                                2⤵
                                                  PID:3808
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7240,i,2273023977695170946,1635147766211040617,2097152 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
                                                  2⤵
                                                    PID:6028
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6940,i,16081529417135520110,5181356746173664532,2097152 --field-trial-handle=2928,i,7699092410675583142,10958574325740595772,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
                                                    2⤵
                                                      PID:5924
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                      2⤵
                                                      • Enumerates system info in registry
                                                      • Modifies registry class
                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:6032
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffdcfeec188,0x7ffdcfeec194,0x7ffdcfeec1a0
                                                        3⤵
                                                          PID:5360
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,7143264695792460641,1498041858730376778,262144 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:2
                                                          3⤵
                                                            PID:4108
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,9845268192004554481,2068570829390111159,524288 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:11
                                                            3⤵
                                                            • System Time Discovery
                                                            PID:4160
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,9293954482755361334,16788992192580288650,524288 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:13
                                                            3⤵
                                                              PID:2984
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,498554129188514664,3898416557447307594,524288 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
                                                              3⤵
                                                                PID:2472
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,498554129188514664,3898416557447307594,524288 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
                                                                3⤵
                                                                  PID:5356
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4876,i,5173650241374756093,9552896845669514336,2097152 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
                                                                  3⤵
                                                                    PID:2580
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,9123559789372019101,18343547894056770789,524288 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
                                                                    3⤵
                                                                      PID:4220
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,14315071508847229683,8019357169980350435,524288 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
                                                                      3⤵
                                                                        PID:860
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5656,i,10221418235128282012,6312792069789279700,2097152 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
                                                                        3⤵
                                                                          PID:3712
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,3505574804782901031,3257777797313765538,524288 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
                                                                          3⤵
                                                                            PID:5096
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,3508936306948892157,129165202579365836,524288 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=1364 /prefetch:14
                                                                            3⤵
                                                                              PID:5452
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1236,i,16085342229673198521,3443710068336107949,524288 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
                                                                              3⤵
                                                                                PID:1644
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6248,i,5032322770286360474,6329638448263045743,2097152 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
                                                                                3⤵
                                                                                  PID:5988
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6400,i,8592805937436582495,451536604013265971,2097152 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
                                                                                  3⤵
                                                                                    PID:2904
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4300,i,5897864312248049485,8052352801416251606,2097152 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
                                                                                    3⤵
                                                                                      PID:4204
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,4097463666699150537,8315768086223867069,524288 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
                                                                                      3⤵
                                                                                        PID:3148
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6300,i,14316939304335109336,13814871395198602056,2097152 --field-trial-handle=2632,i,10216883805745780654,18160194667492497855,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
                                                                                        3⤵
                                                                                          PID:1620
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                          3⤵
                                                                                          • Enumerates system info in registry
                                                                                          • Modifies registry class
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                          PID:1124
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffdcfeec188,0x7ffdcfeec194,0x7ffdcfeec1a0
                                                                                            4⤵
                                                                                              PID:5564
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,14654653434376201028,10402171816703787401,524288 --field-trial-handle=2284,i,13582092685444135270,11636483383483014626,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
                                                                                              4⤵
                                                                                              • System Time Discovery
                                                                                              PID:3680
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,17522895699744741458,16910971825473637620,262144 --field-trial-handle=2284,i,13582092685444135270,11636483383483014626,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
                                                                                              4⤵
                                                                                                PID:1264
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,15320117248903095497,2847590804469930475,524288 --field-trial-handle=2284,i,13582092685444135270,11636483383483014626,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
                                                                                                4⤵
                                                                                                  PID:2340
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,4552898113426118619,3862571153813154643,524288 --field-trial-handle=2284,i,13582092685444135270,11636483383483014626,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:1012
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,4552898113426118619,3862571153813154643,524288 --field-trial-handle=2284,i,13582092685444135270,11636483383483014626,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:5752
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4932,i,11059311374174365037,13826471285871933921,2097152 --field-trial-handle=2284,i,13582092685444135270,11636483383483014626,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
                                                                                                      4⤵
                                                                                                        PID:4604
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,5981630209755121177,6554367712061472822,524288 --field-trial-handle=2284,i,13582092685444135270,11636483383483014626,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
                                                                                                        4⤵
                                                                                                          PID:5736
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,4204975590465646179,7651832210510666575,524288 --field-trial-handle=2284,i,13582092685444135270,11636483383483014626,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
                                                                                                          4⤵
                                                                                                            PID:5700
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5692,i,8933045200383577738,3018614156477277600,2097152 --field-trial-handle=2284,i,13582092685444135270,11636483383483014626,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
                                                                                                            4⤵
                                                                                                              PID:240
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,5853338770473779482,1866064535115619089,524288 --field-trial-handle=2284,i,13582092685444135270,11636483383483014626,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
                                                                                                              4⤵
                                                                                                                PID:3504
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,2918090886140287560,6999823952972093082,524288 --field-trial-handle=2284,i,13582092685444135270,11636483383483014626,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
                                                                                                                4⤵
                                                                                                                  PID:2732
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,3189620167097733920,882754563425937513,524288 --field-trial-handle=2284,i,13582092685444135270,11636483383483014626,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
                                                                                                                  4⤵
                                                                                                                    PID:3124
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                              1⤵
                                                                                                                PID:712
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                1⤵
                                                                                                                  PID:5132
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                  1⤵
                                                                                                                    PID:704
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                    1⤵
                                                                                                                      PID:3268
                                                                                                                    • C:\Windows\system32\OpenWith.exe
                                                                                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                      1⤵
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:2844
                                                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LockBit-main\README.md
                                                                                                                        2⤵
                                                                                                                        • Modifies registry class
                                                                                                                        PID:3636
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                      1⤵
                                                                                                                        PID:5224
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                        1⤵
                                                                                                                          PID:4428
                                                                                                                        • C:\Users\Admin\Desktop\LockBit-main\keygen.exe
                                                                                                                          "C:\Users\Admin\Desktop\LockBit-main\keygen.exe"
                                                                                                                          1⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:5104
                                                                                                                        • C:\Users\Admin\Desktop\LockBit-main\builder.exe
                                                                                                                          "C:\Users\Admin\Desktop\LockBit-main\builder.exe"
                                                                                                                          1⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:2752
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\LockBit-main\Build.bat" "
                                                                                                                          1⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:1436
                                                                                                                          • C:\Users\Admin\Desktop\LockBit-main\keygen.exe
                                                                                                                            keygen -path Build -pubkey pub.key -privkey priv.key
                                                                                                                            2⤵
                                                                                                                              PID:1612
                                                                                                                            • C:\Users\Admin\Desktop\LockBit-main\builder.exe
                                                                                                                              builder -type dec -privkey Build\priv.key -config config.json -ofile Build\LB3Decryptor.exe
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3424
                                                                                                                            • C:\Users\Admin\Desktop\LockBit-main\builder.exe
                                                                                                                              builder -type enc -exe -pubkey Build\pub.key -config config.json -ofile Build\LB3.exe
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4412
                                                                                                                            • C:\Users\Admin\Desktop\LockBit-main\builder.exe
                                                                                                                              builder -type enc -exe -pass -pubkey Build\pub.key -config config.json -ofile Build\LB3_pass.exe
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4644
                                                                                                                            • C:\Users\Admin\Desktop\LockBit-main\builder.exe
                                                                                                                              builder -type enc -dll -pubkey Build\pub.key -config config.json -ofile Build\LB3_Rundll32.dll
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2940
                                                                                                                            • C:\Users\Admin\Desktop\LockBit-main\builder.exe
                                                                                                                              builder -type enc -dll -pass -pubkey Build\pub.key -config config.json -ofile Build\LB3_Rundll32_pass.dll
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:5380
                                                                                                                            • C:\Users\Admin\Desktop\LockBit-main\builder.exe
                                                                                                                              builder -type enc -ref -pubkey Build\pub.key -config config.json -ofile Build\LB3_ReflectiveDll_DllMain.dll
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3488
                                                                                                                          • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LockBit-main\Build\Password_exe.txt
                                                                                                                            1⤵
                                                                                                                            • Modifies registry class
                                                                                                                            PID:708
                                                                                                                          • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LockBit-main\Build\DECRYPTION_ID.txt
                                                                                                                            1⤵
                                                                                                                            • Modifies registry class
                                                                                                                            PID:4288
                                                                                                                          • C:\Users\Admin\Desktop\LockBit-main\Build\LB3.exe
                                                                                                                            "C:\Users\Admin\Desktop\LockBit-main\Build\LB3.exe"
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops desktop.ini file(s)
                                                                                                                            • Enumerates connected drives
                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious behavior: RenamesItself
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:1152
                                                                                                                          • C:\Users\Admin\Desktop\LockBit-main\Build\LB3.exe
                                                                                                                            "C:\Users\Admin\Desktop\LockBit-main\Build\LB3.exe"
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:8740
                                                                                                                            • C:\ProgramData\6285.tmp
                                                                                                                              "C:\ProgramData\6285.tmp"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:8808
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6285.tmp >> NUL
                                                                                                                                3⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:9532
                                                                                                                          • C:\Windows\system32\OpenWith.exe
                                                                                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                            1⤵
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:8308
                                                                                                                          • C:\Users\Admin\Desktop\LockBit-main\Build\LB3_pass.exe
                                                                                                                            "C:\Users\Admin\Desktop\LockBit-main\Build\LB3_pass.exe"
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:6028
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 6028 -s 308
                                                                                                                              2⤵
                                                                                                                              • Program crash
                                                                                                                              PID:7176
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 6028 -ip 6028
                                                                                                                            1⤵
                                                                                                                              PID:1308
                                                                                                                            • C:\Users\Admin\Desktop\LockBit-main\Build\LB3Decryptor.exe
                                                                                                                              "C:\Users\Admin\Desktop\LockBit-main\Build\LB3Decryptor.exe"
                                                                                                                              1⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Sets desktop wallpaper using registry
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Modifies Control Panel
                                                                                                                              • Modifies registry class
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious behavior: RenamesItself
                                                                                                                              PID:7212

                                                                                                                            Network

                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                  Reconnaissance

                                                                                                                                  Resource Development

                                                                                                                                  Initial Access

                                                                                                                                  Execution

                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                  1
                                                                                                                                  T1059

                                                                                                                                  Windows Command Shell

                                                                                                                                  1
                                                                                                                                  T1059.003

                                                                                                                                  Persistence

                                                                                                                                  Privilege Escalation

                                                                                                                                  Defense Evasion

                                                                                                                                  Debugger Evasion

                                                                                                                                  1
                                                                                                                                  T1622

                                                                                                                                  Indicator Removal

                                                                                                                                  1
                                                                                                                                  T1070

                                                                                                                                  File Deletion

                                                                                                                                  1
                                                                                                                                  T1070.004

                                                                                                                                  Modify Registry

                                                                                                                                  1
                                                                                                                                  T1112

                                                                                                                                  Credential Access

                                                                                                                                  Credentials from Password Stores

                                                                                                                                  1
                                                                                                                                  T1555

                                                                                                                                  Credentials from Web Browsers

                                                                                                                                  1
                                                                                                                                  T1555.003

                                                                                                                                  Unsecured Credentials

                                                                                                                                  1
                                                                                                                                  T1552

                                                                                                                                  Credentials In Files

                                                                                                                                  1
                                                                                                                                  T1552.001

                                                                                                                                  Discovery

                                                                                                                                  Browser Information Discovery

                                                                                                                                  1
                                                                                                                                  T1217

                                                                                                                                  Debugger Evasion

                                                                                                                                  1
                                                                                                                                  T1622

                                                                                                                                  Peripheral Device Discovery

                                                                                                                                  1
                                                                                                                                  T1120

                                                                                                                                  Query Registry

                                                                                                                                  2
                                                                                                                                  T1012

                                                                                                                                  System Information Discovery

                                                                                                                                  3
                                                                                                                                  T1082

                                                                                                                                  System Location Discovery

                                                                                                                                  1
                                                                                                                                  T1614

                                                                                                                                  System Language Discovery

                                                                                                                                  1
                                                                                                                                  T1614.001

                                                                                                                                  System Network Configuration Discovery

                                                                                                                                  1
                                                                                                                                  T1016

                                                                                                                                  System Time Discovery

                                                                                                                                  1
                                                                                                                                  T1124

                                                                                                                                  Lateral Movement

                                                                                                                                  Collection

                                                                                                                                  Data from Local System

                                                                                                                                  1
                                                                                                                                  T1005

                                                                                                                                  Command and Control

                                                                                                                                  Exfiltration

                                                                                                                                  Impact

                                                                                                                                  Defacement

                                                                                                                                  1
                                                                                                                                  T1491

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  BBBBBBBBBBB
                                                                                                                                  • Path C:\$Recycle.Bin\S-1-5-21-560646293-820748483-2532804640-1000\BBBBBBBBBBB
                                                                                                                                  • Size 129B
                                                                                                                                  • SHA256 d39a27b9c515c74ce0e3055c65e3d002ade3bbc01be89a0728732c7ed54b1d48
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  1nIbnujUk.README.txt
                                                                                                                                  • Path C:\1nIbnujUk.README.txt
                                                                                                                                  • Size 6KB
                                                                                                                                  • SHA256 b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  1c51465d-1c95-4b6c-8857-f863b7849d6b.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c51465d-1c95-4b6c-8857-f863b7849d6b.tmp
                                                                                                                                  • Size 37KB
                                                                                                                                  • SHA256 e47f7d6e5960b3ab5bc41243bc977be4c8d41ec380c6f54bec31874bdd71bd29
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  217c0f4c-50c3-41c0-a5c7-c61d459511a5.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\217c0f4c-50c3-41c0-a5c7-c61d459511a5.tmp
                                                                                                                                  • Size 43KB
                                                                                                                                  • SHA256 570de88a79c13e73be3c113dcf82586aba26fbf3186a75de994171c150074958
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  40c7e539-d928-4c03-8d18-663a95b78c8e.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\40c7e539-d928-4c03-8d18-663a95b78c8e.tmp
                                                                                                                                  • Size 48KB
                                                                                                                                  • SHA256 882a6260c82c5d7d686b0ed1ea73b2ffcc7012c98a67ba11fefef71b184248c4
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  64d56480-19ce-497e-aab2-1a6db38a005a.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\64d56480-19ce-497e-aab2-1a6db38a005a.tmp
                                                                                                                                  • Size 34KB
                                                                                                                                  • SHA256 9ab92a561f8d3dfddf1b9a61ceb122139e7062176e7a5002eb78b5f3aaf2db80
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  8200a580-7a76-44af-9e98-28d72b526fdb.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8200a580-7a76-44af-9e98-28d72b526fdb.tmp
                                                                                                                                  • Size 34KB
                                                                                                                                  • SHA256 ff3bd846221006654e92266ba2ac8ec0d585b14edf7bc4c47f5a29a7d599b824
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  97a9de14-8644-4862-8c57-c760469554b9.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\97a9de14-8644-4862-8c57-c760469554b9.tmp
                                                                                                                                  • Size 39KB
                                                                                                                                  • SHA256 79561ba899f062a6311cb8c374ce05f32edb1f95ce6f18c9226d29960bcc1f67
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  blocklist
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                  • Size 105KB
                                                                                                                                  • SHA256 c232ec974e0782cd13a8942d319d172253ded086c99dd896db4bd09ec5006e8d
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  settings.dat
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                  • Size 280B
                                                                                                                                  • SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  settings.dat
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                  • Size 280B
                                                                                                                                  • SHA256 951964aa771b180b28740b27d7eff0f630dd8b4a0a73846486babbc13bcf3b30
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  settings.dat
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                  • Size 280B
                                                                                                                                  • SHA256 0ad885c7dd6e8011221561efe5ae3499b6627f63ecef195eb479449e1075a606
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  settings.dat
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                  • Size 280B
                                                                                                                                  • SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  settings.dat
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                  • Size 280B
                                                                                                                                  • SHA256 636aea6eccf7ac82535ca079229f0cf18f9ca60aa70e8f82fe2e8ae24829f97f
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  07475fce-ad88-4d13-95f0-857038949d57.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07475fce-ad88-4d13-95f0-857038949d57.tmp
                                                                                                                                  • Size 17KB
                                                                                                                                  • SHA256 3bf8ee0861fd078d03b7d3261449f8cf0c0ddb6801e7a14ba9f7d5816f25e5fc
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  19a19f53-99ae-4e18-9ca9-c38d3071adc9.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19a19f53-99ae-4e18-9ca9-c38d3071adc9.tmp
                                                                                                                                  • Size 14KB
                                                                                                                                  • SHA256 07693d8bfa8b451410f342a8917f2a4421504274b57d50d6bba5c22a09a270ec
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  41da7121-7496-42ab-9c93-dca9c1166423.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41da7121-7496-42ab-9c93-dca9c1166423.tmp
                                                                                                                                  • Size 29KB
                                                                                                                                  • SHA256 bc79bbc02aaf9ab94255555b243b9b76e0d6839e0470e19b9b1d0a89ef956db1
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  5a9cb88d-2272-4dd2-a0b3-7e1896910e65.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a9cb88d-2272-4dd2-a0b3-7e1896910e65.tmp
                                                                                                                                  • Size 12KB
                                                                                                                                  • SHA256 56cbf5ba97ed7181a33d7a07ff81c9df991e4f09b2eb0871f1192d3a813bad91
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  70bcd268-8120-4c46-a044-8115717edbf3.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70bcd268-8120-4c46-a044-8115717edbf3.tmp
                                                                                                                                  • Size 15KB
                                                                                                                                  • SHA256 73667e64e74809a0a571e417deeffc8059498e8d86c31fef6e44e7e3b1d5491b
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  856c1bb3-8f55-43dd-9443-1e94ac461317.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\856c1bb3-8f55-43dd-9443-1e94ac461317.tmp
                                                                                                                                  • Size 15KB
                                                                                                                                  • SHA256 30fcc88b0ac22dce3fc9a76acea3386300d08291955a841f89e7067ea52b579e
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  8a4ec26f-9576-45d8-a898-ba7a4d3e5a18.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a4ec26f-9576-45d8-a898-ba7a4d3e5a18.tmp
                                                                                                                                  • Size 70KB
                                                                                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  8d24a15e-3984-4c9b-94de-a0a9d886ad70.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d24a15e-3984-4c9b-94de-a0a9d886ad70.tmp
                                                                                                                                  • Size 17KB
                                                                                                                                  • SHA256 bc41a1b67ef234132ae78d69deb2a7c7c9c83ea297278d09b3d3791e39602302
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  BookmarkMergedSurfaceOrdering
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                  • Size 6B
                                                                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  BrowsingTopicsState
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                                  • Size 414B
                                                                                                                                  • SHA256 23dffe19c2465a93b6665217e09da4aac39058bf177b3279d366d90fa82149c9
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  data_0
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
                                                                                                                                  • Size 44KB
                                                                                                                                  • SHA256 046d61cf6706616e12e99a1988e0bee8406f58938587a3b7794a7aea5c4f0900
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  data_1
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
                                                                                                                                  • Size 264KB
                                                                                                                                  • SHA256 c8eba5af9cc3b294f4746d253a5a8da54b4c2a9a92cc2b0f14322011eb7aba57
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  data_2
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
                                                                                                                                  • Size 1.0MB
                                                                                                                                  • SHA256 aa508b3f8a8aff7d659aae9e9a76518d45e1a3532ad95aed91d847b646e33722
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  data_3
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
                                                                                                                                  • Size 8.0MB
                                                                                                                                  • SHA256 1336cf9549d8d67e05953e41e4bce62a5af569eddb004296aea2cec7c646e273
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  f_000055
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
                                                                                                                                  • Size 120KB
                                                                                                                                  • SHA256 ad58ca73f2b8f132ed15ee724e1731cbd7510af65eea7ef3c93e5ac2a5ca3541
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  f_000057
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
                                                                                                                                  • Size 31KB
                                                                                                                                  • SHA256 a258dcaa34219a6253250fd12bd905eb92d8faf13288b909af829d53945a8e86
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  f_000058
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058
                                                                                                                                  • Size 101KB
                                                                                                                                  • SHA256 ce8b5b974c2a6468f5130e3c3d7ca9e0d7097a14e52d0858cbcb918ef5754088
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  f_00005b
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
                                                                                                                                  • Size 240KB
                                                                                                                                  • SHA256 b56ada64ba1ae6589055623c7b2f41dc13ff422e6b4d26b15aee8dcd7e84c6c8
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  f_00005e
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
                                                                                                                                  • Size 36KB
                                                                                                                                  • SHA256 587d759e0bef559fad4ccf0ee6bedd2eec6e5ed728f4a617d81de910d05aa648
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  f_00005f
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
                                                                                                                                  • Size 20KB
                                                                                                                                  • SHA256 3aacbcd81ad6ae1761ea657e53aa6ac03e279cb47cfc2fbd6524bde7cce68b17
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  f_000060
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
                                                                                                                                  • Size 16KB
                                                                                                                                  • SHA256 e6f8deeeb0e0a44e1325dd17247f28ec491018b57e301ad28e8c736c1ec8561e
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  f_00006c
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
                                                                                                                                  • Size 39KB
                                                                                                                                  • SHA256 a3a6b80605e30311dcb005105df72e46ccfafc0e376efcfa142e602017868fad
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  temp-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                  • Size 3KB
                                                                                                                                  • SHA256 09c9e9090f3e98e8d333a2667ca0441c9bb975afaf5d2c348badb13000ad7373
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  temp-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                  • Size 3KB
                                                                                                                                  • SHA256 9352d82f5464fe9fd427c67a575ca45a8d12a7a0c3da633a1f1129c698cd2910
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  temp-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                  • Size 4KB
                                                                                                                                  • SHA256 eac0e1714731707587e713a7ac7bfb68ebefef509a3f548cdbbb74a05211eb3d
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  temp-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                  • Size 4KB
                                                                                                                                  • SHA256 aeaee2f306fe2501e17215918a692b3b88d530f2a3396e56c48cd1a41ef36e54
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  the-real-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                  • Size 3KB
                                                                                                                                  • SHA256 1bed4c2cbc2286be4b62746cc11b464b8326439f745519d4c613097e0f25d9b9
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  the-real-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                  • Size 2KB
                                                                                                                                  • SHA256 3bae172afea96ad31c30779ea7be1508ec09e1abc9a14769f1f9060318e6ffd1
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  data_1
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
                                                                                                                                  • Size 264KB
                                                                                                                                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                  Submit Download

                                                                                                                                  db106fbe-7c49-4733-b657-ae4a42f1a7ae.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\db106fbe-7c49-4733-b657-ae4a42f1a7ae.tmp
                                                                                                                                  • Size 2B
                                                                                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  LOG
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
                                                                                                                                  • Size 346B
                                                                                                                                  • SHA256 b148cae3c764e7efe2184751724b4e09d63b31e4e970b61e8b0c02cfc54ff5ea
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  000003.log
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
                                                                                                                                  • Size 399B
                                                                                                                                  • SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  LOG
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
                                                                                                                                  • Size 322B
                                                                                                                                  • SHA256 dfccabbc3878dc3ba55b74ca903a9209003a7c6783a72ce111c64b1380e4382c
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  dasherSettingSchema.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                                                                                  • Size 854B
                                                                                                                                  • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  computed_hashes.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
                                                                                                                                  • Size 429B
                                                                                                                                  • SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  verified_contents.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
                                                                                                                                  • Size 1KB
                                                                                                                                  • SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  content_new.js
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content_new.js
                                                                                                                                  • Size 10KB
                                                                                                                                  • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  000003.log
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
                                                                                                                                  • Size 7KB
                                                                                                                                  • SHA256 911720edeae9ce090eae8f1ac8d8b7caf1ccc7836cc018ff240558344671958b
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  LOG
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
                                                                                                                                  • Size 331B
                                                                                                                                  • SHA256 fd5dc8a419145cd7c1805f9085219d0ed985ce699b6b30d9cefa3050d437ab44
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  479cf6e5-853b-4153-85c4-8af1ff6663a6.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\479cf6e5-853b-4153-85c4-8af1ff6663a6.tmp
                                                                                                                                  • Size 40B
                                                                                                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  6f0cd070-2de8-4bf9-a3ff-6ee0f590444a.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6f0cd070-2de8-4bf9-a3ff-6ee0f590444a.tmp
                                                                                                                                  • Size 10KB
                                                                                                                                  • SHA256 48542dec4fac0a3aea9fdeb8a7aa05487d83bb8edb90f76e0ff3433bb0d38828
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  907ced4b-7393-4d22-b48a-ef82f0742aad.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\907ced4b-7393-4d22-b48a-ef82f0742aad.tmp
                                                                                                                                  • Size 2KB
                                                                                                                                  • SHA256 f7e715de2a71e129691f9ec6d7bc5fc0012970d1576971f25c7f59b2b2bb907e
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  Cookies
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
                                                                                                                                  • Size 28KB
                                                                                                                                  • SHA256 1f615195227bf0fa9192076ae51b7b8b1debc31d87926d3751c5c4fc6ac8cf82
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  TransportSecurity
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                                                                                  • Size 690B
                                                                                                                                  • SHA256 787ab700875f9cc278dda4db911b481dbbdbeeb9f84a356d25ce4cf419181ca8
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  eabdfc34-5b9c-4892-951f-ca22378fe3d7.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\eabdfc34-5b9c-4892-951f-ca22378fe3d7.tmp
                                                                                                                                  • Size 2B
                                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  faf14b41-faf7-4a5f-ba9d-9dfb6e413b70.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\faf14b41-faf7-4a5f-ba9d-9dfb6e413b70.tmp
                                                                                                                                  • Size 3KB
                                                                                                                                  • SHA256 79cc6d5154ece98327ff188b08610feb59afd7202c36131bdae31ca1dc45a2eb
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  temp-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1cc81b5a-5922-452a-9098-070212ec8728\index-dir\temp-index
                                                                                                                                  • Size 72B
                                                                                                                                  • SHA256 d342282d45bbaa92b89388cc65c0ad376156e39c771fcc5d7ceeef0a7a9e4a41
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  temp-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1cc81b5a-5922-452a-9098-070212ec8728\index-dir\temp-index
                                                                                                                                  • Size 72B
                                                                                                                                  • SHA256 853cbb298ee19472d4e128a24d2e8a53382f8a863dacbcad54cf00d69cf7c0f6
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  the-real-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1cc81b5a-5922-452a-9098-070212ec8728\index-dir\the-real-index
                                                                                                                                  • Size 48B
                                                                                                                                  • SHA256 dbd87628265999e0827f6a11c3cc2c707fe0887ad187f91ea52e7a93bb1b88bf
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  temp-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3688c1f9-c316-442a-b4db-5b2981d8d921\index-dir\temp-index
                                                                                                                                  • Size 96B
                                                                                                                                  • SHA256 6c6a9a28ad4ba50954ae16b7193dc4ec48fedf3533354b35208f0f7af15bf115
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  the-real-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3688c1f9-c316-442a-b4db-5b2981d8d921\index-dir\the-real-index
                                                                                                                                  • Size 96B
                                                                                                                                  • SHA256 da49653d5406dd88692d193f1e4f56d3095f4770a373c8807ce743532ae6d37b
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  temp-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\49d7a5b9-58e2-4688-b35a-511606f2b34e\index-dir\temp-index
                                                                                                                                  • Size 72B
                                                                                                                                  • SHA256 1af811c9e28af3e7723ae155827169ceb0d1fb7fb1cf812ebed4f8eef9089309
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  temp-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\49d7a5b9-58e2-4688-b35a-511606f2b34e\index-dir\temp-index
                                                                                                                                  • Size 72B
                                                                                                                                  • SHA256 f30c46749c1736c2b15e24e810ac9d9b8f98e4edd7d5e4ff470ebf50e48e0edd
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  the-real-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\49d7a5b9-58e2-4688-b35a-511606f2b34e\index-dir\the-real-index
                                                                                                                                  • Size 48B
                                                                                                                                  • SHA256 44d177cb54bc5998aab3822300c3043cf70f317dd67eb4385d21a49243ba82b3
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  temp-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\66f92cbe-1f15-410e-aa47-6499f2bf00e6\index-dir\temp-index
                                                                                                                                  • Size 240B
                                                                                                                                  • SHA256 f4f168ee595b3c85a9f1ff9acd96232f532f98431acfed8454d7e8ef10ff3f13
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  the-real-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\66f92cbe-1f15-410e-aa47-6499f2bf00e6\index-dir\the-real-index
                                                                                                                                  • Size 240B
                                                                                                                                  • SHA256 6f49e30b069827b54de29bf078e97424d9a7871be0846be90833f27d6d69d160
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  temp-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d95f7af0-620c-4d67-a78d-520757536993\index-dir\temp-index
                                                                                                                                  • Size 2KB
                                                                                                                                  • SHA256 1250631ebb0884eb1cdae0fa654d9347edc07bbe788a6acc1d088fc4df9a7545
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  the-real-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d95f7af0-620c-4d67-a78d-520757536993\index-dir\the-real-index
                                                                                                                                  • Size 48B
                                                                                                                                  • SHA256 d6188f2f6675ea3a2117cb7518e0f97aab468cbbc65743141f0990c4fd04df43
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  index.txt.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                                                  • Size 161B
                                                                                                                                  • SHA256 893ed8a15d21e19798a796e206d66bc87474f30e6706c66ca9186a1d40e3ac70
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  index.txt.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                                                  • Size 394B
                                                                                                                                  • SHA256 8365b0effebe739d52363df49e720ea19f3f14bf1bdd30bb9edca4005095c6c4
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  index.txt.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                                                  • Size 386B
                                                                                                                                  • SHA256 8494fed1103f2e3678ef720a88fdbc094b2edb90ba383875d6c31f4870be99ce
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  index.txt.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                                                  • Size 492B
                                                                                                                                  • SHA256 41593d96a7d20ee782c643401f5904dd327117755b4a9d6c895fd57725a03947
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  index.txt.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                                                  • Size 259B
                                                                                                                                  • SHA256 14a6b2183290f0dd5365c80043bdad03842ab94b727d804221f97228c7cc6b68
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  index.txt.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                                                  • Size 399B
                                                                                                                                  • SHA256 eb99407c99a8c631c0e1ebb1e0e9e044ef9a02dcd4c335720d168bb4650152b5
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  index.txt.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                                                  • Size 281B
                                                                                                                                  • SHA256 5b086f9586b2f150e2eac7882c1e4499e6811bf3ab2702ec069cc4616c135186
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  index.txt.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                                                  • Size 394B
                                                                                                                                  • SHA256 f57ea51d23ab07c47373f094ff4edf9bd9bc1f302fc5fad186be902dae34e41c
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  000003.log
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
                                                                                                                                  • Size 5KB
                                                                                                                                  • SHA256 468c0dc19affa41e8781dca72a199d2557439d41d04655a06f6e877d7a50186b
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  LOG
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
                                                                                                                                  • Size 338B
                                                                                                                                  • SHA256 59adb17b21c6287cd843830ff40cf0db1e2e139b1980e56e78c368577d96cd45
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  temp-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
                                                                                                                                  • Size 72B
                                                                                                                                  • SHA256 dc5b5fd95f422eeb322803708be92e7d6b560668b5687a55fc910095c26fbfef
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  the-real-index
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                  • Size 48B
                                                                                                                                  • SHA256 78ab801d019a28c8f07a7e7bc0c0d5b053db66e1c19d7c5812afccfe86a9ef8a
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  000003.log
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
                                                                                                                                  • Size 112B
                                                                                                                                  • SHA256 eccef004611e7ce931362614a5012c38288d931750b3fdfef8179105b13ccbb2
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  LOG
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
                                                                                                                                  • Size 350B
                                                                                                                                  • SHA256 2fa09fbc98d64929708328a0a01067e146b81704fd110f0a9148bdb1fc28df1c
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  000003.log
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
                                                                                                                                  • Size 175B
                                                                                                                                  • SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  LOG
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
                                                                                                                                  • Size 323B
                                                                                                                                  • SHA256 cfe8342d0d0805fffadba69f467f24ed0923a1cb76423cca063cf22b84a8fd0c
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  sync_diagnostic.log
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                  • Size 4KB
                                                                                                                                  • SHA256 3cbf134849a379f65668e9a3e4c21068b1ef2a84458fd062994914b7099d5dd1
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  sync_diagnostic.log
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                  • Size 5KB
                                                                                                                                  • SHA256 4369437a6e1fc5511e58fe4725a338ac2ec88769b9b20a5a1398c4389cc135c3
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  Web Data
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
                                                                                                                                  • Size 256KB
                                                                                                                                  • SHA256 ac3d0c76ef48431604997975b7295008354f26955f8800c32ad4226a8397a48e
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  WebAssistDatabase
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
                                                                                                                                  • Size 14KB
                                                                                                                                  • SHA256 09e772cbcf94099dd6fe57b94a1b434924de3c2eae2af80122a3435b9b766537
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  c334c01b-2f96-4a20-b083-d5c7b399ae3c.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c334c01b-2f96-4a20-b083-d5c7b399ae3c.tmp
                                                                                                                                  • Size 14KB
                                                                                                                                  • SHA256 bfb401e0509d8ce9a0fd594f11b6599c80cb35e11144b4d7c72433d5bc6f92fe
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  90c48048-67f7-4dde-a959-2aad19a08093.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\90c48048-67f7-4dde-a959-2aad19a08093.tmp
                                                                                                                                  • Size 22KB
                                                                                                                                  • SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  OperationConfig
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                  • Size 3KB
                                                                                                                                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  data_1
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
                                                                                                                                  • Size 264KB
                                                                                                                                  • SHA256 fdb5882c6c90834b0656dc0d4da035274fdcd846e87c7147cf6bf9d400fa1268
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  data_1
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
                                                                                                                                  • Size 264KB
                                                                                                                                  • SHA256 519e577195461535086b18c36ac2536f872e44a8a77f5469d137d6d92d92d630
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  Last Version
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                                                                                  • Size 14B
                                                                                                                                  • SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  campaign_history
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
                                                                                                                                  • Size 20KB
                                                                                                                                  • SHA256 16616a66ac90071c2905cded4553925e457b88e31bf676b00b7bf8709d9524dd
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  RevisitationBloomfilter
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                  • Size 392B
                                                                                                                                  • SHA256 b25291caadd58d850e96f62bc6be0b53ceead9fc500d5697b02108883ff31e24
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  data_1
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                                                                                  • Size 264KB
                                                                                                                                  • SHA256 af0f630448b37fd68abd7c4c1fdf0e244dd48a9b5c1cb2f0838e3e8e977b5995
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  Variations
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
                                                                                                                                  • Size 86B
                                                                                                                                  • SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  b204c553-c1db-4427-9cf8-c121b67fbe4b.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b204c553-c1db-4427-9cf8-c121b67fbe4b.tmp
                                                                                                                                  • Size 38KB
                                                                                                                                  • SHA256 e8ae79fe9fcde140cdf29b8133e1a71bc26775c2d7e0e19ba7a8b95ddb0755f9
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  c3a9b0d4-bae4-4cbf-ad34-c10cc5e1189a.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c3a9b0d4-bae4-4cbf-ad34-c10cc5e1189a.tmp
                                                                                                                                  • Size 45KB
                                                                                                                                  • SHA256 b2d4b9168cd246e1589124d648566b3479a7eb8242a09d4b533d26eebf2bf9d6
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                                  • Size 158KB
                                                                                                                                  • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  aaff00bd-d2ca-41bd-92ac-7b3a6d5e6277.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aaff00bd-d2ca-41bd-92ac-7b3a6d5e6277.tmp
                                                                                                                                  • Size 13B
                                                                                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  metadata.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                  • Size 132B
                                                                                                                                  • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  f00cc4e4-9b82-463c-bec0-f3eca820218e.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f00cc4e4-9b82-463c-bec0-f3eca820218e.tmp
                                                                                                                                  • Size 392B
                                                                                                                                  • SHA256 33cb58e5e4a27aa36181ae2c21956685df9e69c303815a6f68a7be758c180c9c
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  f31a2867-de9b-4373-9b84-fdaffb4263cb.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f31a2867-de9b-4373-9b84-fdaffb4263cb.tmp
                                                                                                                                  • Size 34KB
                                                                                                                                  • SHA256 14959edbb75e487f9f27cdf69d4c3fde3444c247a6f20b2512075c8b86ed17c1
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  214376eb-8663-4191-96e8-9a0460c51254.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\214376eb-8663-4191-96e8-9a0460c51254.tmp
                                                                                                                                  • Size 10KB
                                                                                                                                  • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  c7566f05-77a1-4f9b-a85e-63043b423521.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c7566f05-77a1-4f9b-a85e-63043b423521.tmp
                                                                                                                                  • Size 1B
                                                                                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  messages.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4748_2145588168\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                                                                  • Size 711B
                                                                                                                                  • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  content.js
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4748_413535707\CRX_INSTALL\content.js
                                                                                                                                  • Size 9KB
                                                                                                                                  • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  compatibility.ini
                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\7vpys50q.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\compatibility.ini
                                                                                                                                  • Size 198B
                                                                                                                                  • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  favicons.sqlite-shm
                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\favicons.sqlite-shm
                                                                                                                                  • Size 32KB
                                                                                                                                  • SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                  Submit Download

                                                                                                                                  1657114595AmcateirvtiSty.sqlite
                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
                                                                                                                                  • Size 48KB
                                                                                                                                  • SHA256 c9198e4d2613f90a0fe243837217c0260234e44e984e2d89fdfe9335942035b1
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  CCCCCCC
                                                                                                                                  • Path C:\Users\Admin\Desktop\LockBit-main\Build\CCCCCCC
                                                                                                                                  • Size 153KB
                                                                                                                                  • SHA256 d77f506f4e2fba2d2d295d4c20c2cd04d8de1d3802c18965a15a31931db47276
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  README.md
                                                                                                                                  • Path C:\Users\Admin\Desktop\LockBit-main\README.md
                                                                                                                                  • Size 4KB
                                                                                                                                  • SHA256 64312260bf9f040c92ece170d05250526f138f059760b8a5b9023d6d38e71db1
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  config.json
                                                                                                                                  • Path C:\Users\Admin\Desktop\LockBit-main\config.json
                                                                                                                                  • Size 8KB
                                                                                                                                  • SHA256 d121f4293160e0a39cbb184c032cd45baf1372db00cd33afb0e166ac0a60ac4c
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  AssertPing.wm.1nIbnujUk
                                                                                                                                  • Path C:\Users\Admin\Downloads\AssertPing.wm.1nIbnujUk
                                                                                                                                  • Size 156KB
                                                                                                                                  • SHA256 32e8e8c3fbea5f8cb81b3dec1fd4ae1703caa529e13b471bc62c687a916b60f7
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  DebugConfirm.3gp.1nIbnujUk
                                                                                                                                  • Path C:\Users\Admin\Downloads\DebugConfirm.3gp.1nIbnujUk
                                                                                                                                  • Size 320KB
                                                                                                                                  • SHA256 ca0a708a441ddf0b4a54dff2f72d26261c996aeb4a80cca231ea6542b38a84bd
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  DebugImport.midi.1nIbnujUk
                                                                                                                                  • Path C:\Users\Admin\Downloads\DebugImport.midi.1nIbnujUk
                                                                                                                                  • Size 351KB
                                                                                                                                  • SHA256 ea5f9cd456876c904c477708d62fb6bd3141b2455569600707ca8f03d30d3e5c
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  BBBBBBBBBBB
                                                                                                                                  • Path F:\$RECYCLE.BIN\S-1-5-21-560646293-820748483-2532804640-1000\BBBBBBBBBBB
                                                                                                                                  • Size 129B
                                                                                                                                  • SHA256 48a920a3b87216fed2d1f612b22a9ffd788b5c5c5ed78ccf9ca4a5d85490c74a
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  memory/6028-3684-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/6028-3683-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                  Download