Analysis
-
max time kernel
114s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-09-2022 00:08
Static task
static1
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10v2004-20220812-en
Errors
General
-
Target
LB3.exe
-
Size
153KB
-
MD5
b0191df32cfca1acbdc891cc45ac3170
-
SHA1
282d92b9ead63ddf4f508eaed736e9f6fe000fe9
-
SHA256
96803a7ef46835e00bf118a5e1503f69d1192c2a0209d6657429728d2d8f4995
-
SHA512
0c6b14457fb9d2ab993cc151bff6598b4c3af344e189468fb21c4488104fa0e48dab59bf1a3698ce3ed1956721de43a177442e5b08657adfb91e44e80daabd99
-
SSDEEP
1536:BzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDUlAZfbSRX8jTucJyad353RsuJq:6qJogYkcSNm9V7DORsjqNadd6uJjjWT
Malware Config
Extracted
C:\x5zMder8a.README.txt
598954663666452@exploit.im
365473292355268@thesecure.biz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
474.tmppid process 1268 474.tmp -
Modifies extensions of user files 18 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
LB3.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ConnectPublish.raw.x5zMder8a LB3.exe File renamed C:\Users\Admin\Pictures\HideRestore.tif => C:\Users\Admin\Pictures\HideRestore.tif.x5zMder8a LB3.exe File opened for modification C:\Users\Admin\Pictures\MergeResolve.tiff.x5zMder8a LB3.exe File renamed C:\Users\Admin\Pictures\SelectStart.raw => C:\Users\Admin\Pictures\SelectStart.raw.x5zMder8a LB3.exe File renamed C:\Users\Admin\Pictures\MergeResolve.tiff => C:\Users\Admin\Pictures\MergeResolve.tiff.x5zMder8a LB3.exe File opened for modification C:\Users\Admin\Pictures\ProtectEnter.tiff LB3.exe File opened for modification C:\Users\Admin\Pictures\SelectStart.raw.x5zMder8a LB3.exe File renamed C:\Users\Admin\Pictures\SendExpand.png => C:\Users\Admin\Pictures\SendExpand.png.x5zMder8a LB3.exe File renamed C:\Users\Admin\Pictures\ConnectPublish.raw => C:\Users\Admin\Pictures\ConnectPublish.raw.x5zMder8a LB3.exe File opened for modification C:\Users\Admin\Pictures\MergeResolve.tiff LB3.exe File renamed C:\Users\Admin\Pictures\ProtectEnter.tiff => C:\Users\Admin\Pictures\ProtectEnter.tiff.x5zMder8a LB3.exe File renamed C:\Users\Admin\Pictures\SaveConvertFrom.crw => C:\Users\Admin\Pictures\SaveConvertFrom.crw.x5zMder8a LB3.exe File opened for modification C:\Users\Admin\Pictures\SaveConvertFrom.crw.x5zMder8a LB3.exe File renamed C:\Users\Admin\Pictures\AssertSelect.crw => C:\Users\Admin\Pictures\AssertSelect.crw.x5zMder8a LB3.exe File opened for modification C:\Users\Admin\Pictures\AssertSelect.crw.x5zMder8a LB3.exe File opened for modification C:\Users\Admin\Pictures\HideRestore.tif.x5zMder8a LB3.exe File opened for modification C:\Users\Admin\Pictures\ProtectEnter.tiff.x5zMder8a LB3.exe File opened for modification C:\Users\Admin\Pictures\SendExpand.png.x5zMder8a LB3.exe -
Deletes itself 1 IoCs
Processes:
474.tmppid process 1268 474.tmp -
Loads dropped DLL 1 IoCs
Processes:
LB3.exepid process 1576 LB3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 1 IoCs
Processes:
LB3.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\desktop.ini LB3.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
LB3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\x5zMder8a.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\x5zMder8a.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
474.tmppid process 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp -
Modifies Control Panel 3 IoCs
Processes:
LB3.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International LB3.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe -
Modifies registry class 5 IoCs
Processes:
LB3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\x5zMder8a\DefaultIcon LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\x5zMder8a LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\x5zMder8a\DefaultIcon\ = "C:\\ProgramData\\x5zMder8a.ico" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.x5zMder8a LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.x5zMder8a\ = "x5zMder8a" LB3.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
LB3.exepid process 1576 LB3.exe 1576 LB3.exe 1576 LB3.exe 1576 LB3.exe 1576 LB3.exe 1576 LB3.exe 1576 LB3.exe 1576 LB3.exe 1576 LB3.exe 1576 LB3.exe 1576 LB3.exe 1576 LB3.exe 1576 LB3.exe 1576 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
474.tmppid process 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp 1268 474.tmp -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
LB3.exe474.tmpdescription pid process Token: SeAssignPrimaryTokenPrivilege 1576 LB3.exe Token: SeBackupPrivilege 1576 LB3.exe Token: SeDebugPrivilege 1576 LB3.exe Token: 36 1576 LB3.exe Token: SeImpersonatePrivilege 1576 LB3.exe Token: SeIncBasePriorityPrivilege 1576 LB3.exe Token: SeIncreaseQuotaPrivilege 1576 LB3.exe Token: 33 1576 LB3.exe Token: SeManageVolumePrivilege 1576 LB3.exe Token: SeProfSingleProcessPrivilege 1576 LB3.exe Token: SeRestorePrivilege 1576 LB3.exe Token: SeSecurityPrivilege 1576 LB3.exe Token: SeSystemProfilePrivilege 1576 LB3.exe Token: SeTakeOwnershipPrivilege 1576 LB3.exe Token: SeShutdownPrivilege 1576 LB3.exe Token: SeDebugPrivilege 1576 LB3.exe Token: SeBackupPrivilege 1268 474.tmp Token: SeRestorePrivilege 1268 474.tmp Token: SeIncBasePriorityPrivilege 1268 474.tmp Token: 33 1268 474.tmp Token: SeManageVolumePrivilege 1268 474.tmp Token: SeSecurityPrivilege 1268 474.tmp Token: SeShutdownPrivilege 1268 474.tmp Token: SeSystemProfilePrivilege 1268 474.tmp Token: SeTakeOwnershipPrivilege 1268 474.tmp -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
LB3.exedescription pid process target process PID 1576 wrote to memory of 1268 1576 LB3.exe 474.tmp PID 1576 wrote to memory of 1268 1576 LB3.exe 474.tmp PID 1576 wrote to memory of 1268 1576 LB3.exe 474.tmp PID 1576 wrote to memory of 1268 1576 LB3.exe 474.tmp PID 1576 wrote to memory of 1268 1576 LB3.exe 474.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\474.tmp"C:\ProgramData\474.tmp"2⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\AAAAAAAAAAAFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\BBBBBBBBBBBFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\CCCCCCCCCCCFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\DDDDDDDDDDDFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\EEEEEEEEEEEFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\FFFFFFFFFFFFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\GGGGGGGGGGGFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\HHHHHHHHHHHFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\IIIIIIIIIIIFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\JJJJJJJJJJJFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\KKKKKKKKKKKFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\LLLLLLLLLLLFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\MMMMMMMMMMMFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\NNNNNNNNNNNFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\OOOOOOOOOOOFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\PPPPPPPPPPPFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\QQQQQQQQQQQFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\RRRRRRRRRRRFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\SSSSSSSSSSSFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\TTTTTTTTTTTFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\UUUUUUUUUUUFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\VVVVVVVVVVVFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\WWWWWWWWWWWFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\XXXXXXXXXXXFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\YYYYYYYYYYYFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\desktop.iniFilesize
129B
MD57b8237d98a77e3808312d133408b4db0
SHA1364b25c70579a8d5940bdde0cafab6d6d83a8e22
SHA256f14280a82ebbb06a4c6ae177008a9384f8a0ca78ba7916dad1fb7104cc59c033
SHA51247392f13824ce852f6491973cebc613ad90366227cb9850b6d8e2de1720cd83953382b3bbd6491264d4b0692d43b20ccc17795e05154caeadba748778e1f65a8
-
C:\ProgramData\474.tmpFilesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\ProgramData\474.tmpFilesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
\ProgramData\474.tmpFilesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
memory/1268-83-0x0000000000000000-mapping.dmp
-
memory/1268-87-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1268-88-0x0000000002525000-0x0000000002536000-memory.dmpFilesize
68KB
-
memory/1268-89-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1576-54-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/1576-81-0x0000000000CE5000-0x0000000000CF6000-memory.dmpFilesize
68KB