Analysis

  • max time kernel
    111s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2023, 20:24

General

  • Target

    LB3.bin.exe

  • Size

    147KB

  • MD5

    c1eb609c9ed588d372091d5531a74aeb

  • SHA1

    faf042b6cef13d0d46c5b5e7f3f5a595fa0a5952

  • SHA256

    7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e

  • SHA512

    828356900e5dc26d4e371b76504dfb4af3b4594708cb4acc76b22e69dc1766f5558ff55d0cbe0fa408fb97ca5741a08f6551b29fddebf6cddb35b6c0084a40c1

  • SSDEEP

    3072:w6glyuxE4GsUPnliByocWepkEa9YmM31iA9uHZiW:w6gDBGpvEByocWeJhRFwAW

Malware Config

Extracted

Path

C:\Users\Admin\zvV4dTvWn.README.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest ransomware since 2019 ~~~ >>>> Your data are stolen and encrypted The data will be published if you do not pay the ransom >>>> PAYMENT : Step 01 : Send 5000 euro in bitcoin to the following address : bc1qvmcaphjgaphshzl65m4um98ffwr6w3ztdchw4y Step 02 : Send proof of transaction to this telegram contact : @P3NT3ST_R00T (https://t.me/P3NT3ST_R00T) Step 03 : After verification of your payment a decryption code will be sent to you. >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID >>>> Your personal DECRYPTION ID: FF3BF712A630DBD255ADEE1B8D095867 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
URLs

https://t.me/P3NT3ST_R00T

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

  • Modifies extensions of user files 17 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\LB3.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\LB3.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:3408
    • C:\ProgramData\14E1.tmp
      "C:\ProgramData\14E1.tmp"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1360
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\14E1.tmp >> NUL
        3⤵
          PID:1780
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4156
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:2780
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:1364
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{3C153C66-2D31-4ABF-82A6-3727ABAEDAA2}.xps" 133227842740610000
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          PID:4776

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\AAAAAAAAAAA

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\BBBBBBBBBBB

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\CCCCCCCCCCC

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\DDDDDDDDDDD

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\DDDDDDDDDDD

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\EEEEEEEEEEE

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\FFFFFFFFFFF

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\GGGGGGGGGGG

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\HHHHHHHHHHH

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\IIIIIIIIIII

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\JJJJJJJJJJJ

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\KKKKKKKKKKK

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\LLLLLLLLLLL

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\MMMMMMMMMMM

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\NNNNNNNNNNN

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\OOOOOOOOOOO

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\PPPPPPPPPPP

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\QQQQQQQQQQQ

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\RRRRRRRRRRR

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\SSSSSSSSSSS

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\TTTTTTTTTTT

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\UUUUUUUUUUU

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\VVVVVVVVVVV

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\WWWWWWWWWWW

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\XXXXXXXXXXX

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\YYYYYYYYYYY

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\desktop.ini

              Filesize

              129B

              MD5

              8ae0015af9769fe3117de9ecec34a3d3

              SHA1

              50db1d9cdb6114b66ab39d59eae11157002489da

              SHA256

              861625062a06e02158646d871613c08e10a27c60f12eabbfe13e609d1d2690d7

              SHA512

              f491530e840093d381e41d3e5fe8a8d37ab0436f1c36df32825ea39648cf3ceed7dc113c4d7b7b6d5ee9ea3d82ec817ca71f69453e968f332c01ca7132f944b1

            • C:\ProgramData\14E1.tmp

              Filesize

              14KB

              MD5

              294e9f64cb1642dd89229fff0592856b

              SHA1

              97b148c27f3da29ba7b18d6aee8a0db9102f47c9

              SHA256

              917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

              SHA512

              b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

            • C:\ProgramData\14E1.tmp

              Filesize

              14KB

              MD5

              294e9f64cb1642dd89229fff0592856b

              SHA1

              97b148c27f3da29ba7b18d6aee8a0db9102f47c9

              SHA256

              917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

              SHA512

              b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

            • C:\Users\Admin\AppData\Local\Temp\FFFFFFFFFFF

              Filesize

              147KB

              MD5

              38cf85057a8f07debd9687fab2d9bf87

              SHA1

              9dd1c877721212c47bfb213fa253db24a214646e

              SHA256

              2d56e45e3d9fca00da43346f7361db370a5ce62f34f1772b9e532f04d7445634

              SHA512

              a482970074c9ed80340f05ac938eab8bc292d2c026c629a810e17f5b8da24412b06f40550072a7def6cad476581dc369424f9fc5354e5262e67805dc689e0996

            • C:\Users\Admin\AppData\Local\Temp\{8DFE9470-140F-44EF-985B-21C5F6F44F1F}

              Filesize

              4KB

              MD5

              78bb63755a394f5b7a10856871467e06

              SHA1

              39375b73d6b8765ea5fe230555d7769487578390

              SHA256

              2fd16d468a35a10d87bde25b3cdaab32810f3f43ef4aa27b10d6ef1f79600956

              SHA512

              959a38058fd7ef14867fa3b49448ef0e63ae1f8e1b032ecc8a3b9260ecbe4435d6d89c88c81d1bcf09401379b87d59ddbe3e57fb96dd1b0b0ecd169d7aa70c63

            • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

              Filesize

              4KB

              MD5

              2d2b9f40979d00417f3b5da96595d1d3

              SHA1

              2d75e843892dd45da1d4d0cb68bf6762a21054ba

              SHA256

              2bb09eb4ca62b7b1912811e6228593efdc7c6e9633320ef484aa5a8a742ccda5

              SHA512

              c24de92ac9c95eeabc11e0c25bb50ed84fd667426e1e90ad4395ea3c4e971ddcf21b3f11e79d967cf252459b2ea6727ce3541bfa6820fda92843e6e3ae94bfac

            • C:\Users\Admin\zvV4dTvWn.README.txt

              Filesize

              1KB

              MD5

              f4e01cd4975c53fcef0a39e1ea62d5f6

              SHA1

              da71928ed66f13c51bf688d17bf656ec401dbe86

              SHA256

              b5d5c3d25cdf958476bc0f8653092a7254d11742f7cd7bc2fb9057be7df08718

              SHA512

              f60af1776b953a4219d6d1b9d753868e2713d6a3041b9b94fa13285d986333e50263b554d65c5f240c72bb5ea4dced5215344e7b632145df25b735f724be1bad

            • memory/1728-2863-0x00000000027C0000-0x00000000027D0000-memory.dmp

              Filesize

              64KB

            • memory/1728-2864-0x00000000027C0000-0x00000000027D0000-memory.dmp

              Filesize

              64KB

            • memory/1728-2862-0x00000000027C0000-0x00000000027D0000-memory.dmp

              Filesize

              64KB

            • memory/1728-190-0x00000000027C0000-0x00000000027D0000-memory.dmp

              Filesize

              64KB

            • memory/1728-189-0x00000000027C0000-0x00000000027D0000-memory.dmp

              Filesize

              64KB

            • memory/1728-188-0x00000000027C0000-0x00000000027D0000-memory.dmp

              Filesize

              64KB

            • memory/4776-2908-0x00007FFFB8410000-0x00007FFFB8420000-memory.dmp

              Filesize

              64KB

            • memory/4776-2910-0x00007FFFB8410000-0x00007FFFB8420000-memory.dmp

              Filesize

              64KB

            • memory/4776-2909-0x00007FFFB8410000-0x00007FFFB8420000-memory.dmp

              Filesize

              64KB

            • memory/4776-2911-0x00007FFFB8410000-0x00007FFFB8420000-memory.dmp

              Filesize

              64KB

            • memory/4776-2912-0x00007FFFB8410000-0x00007FFFB8420000-memory.dmp

              Filesize

              64KB

            • memory/4776-2913-0x00007FFFB6230000-0x00007FFFB6240000-memory.dmp

              Filesize

              64KB

            • memory/4776-2914-0x00007FFFB6230000-0x00007FFFB6240000-memory.dmp

              Filesize

              64KB