Analysis

  • max time kernel
    154s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2023, 16:44

General

  • Target

    Crypted.bin.exe

  • Size

    1.7MB

  • MD5

    927426bafb84fe8daff84cff77258e0d

  • SHA1

    320a91f6b810e4f5dbb38f58fd2949c780d4c807

  • SHA256

    6375e7e4c7cdc3f96afd991c4dfedd5cdfe4b31bf0662dccfa703c117e951f71

  • SHA512

    1eb9eb0e65a6cb5ea43db76b476f8a0a78942664980eee67e46929685005f40d7f7d85be3e1dec98fce3ca7bfdce62ad2d6daafdc96a4844e84a72a721d55181

  • SSDEEP

    24576:/5dZufOrzvckB+Fr+waFHTcqunNW3QdWvPiVD2CWgrUE94FFs+n9rQOF8nux8igX:/5dVwPaFHTTgkAAn2IQ39y9rRF8uxG

Malware Config

Extracted

Path

C:\ZQXLByuZ3.README.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free your personal DECRYPTION ID Tox ID LockBitSupp: 4FC18FE3304323D69CF8E0A4F88765B7B6E61BC30717B4908925DE4F3584A329993344E1306C Mail: [email protected] Write to a chat and wait for the answer, we will always answer you. >>>> Your personal DECRYPTION ID: 0742AF252D792D02C7E152F69268CE91 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in tox. Tox ID LockBitSupp: 4FC18FE3304323D69CF8E0A4F88765B7B6E61BC30717B4908925DE4F3584A329993344E1306C If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
URLs

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion

http://lockbitapt.uz

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

https://twitter.com/hashtag/lockbit?f=live

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

  • Modifies extensions of user files 24 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Crypted.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\Crypted.bin.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Users\Admin\AppData\Local\Temp\Crypted.bin.exe
      "C:\Users\Admin\AppData\Local\Temp\Crypted.bin.exe"
      2⤵
      • Checks BIOS information in registry
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4992
      • C:\Users\Admin\AppData\Local\Temp\Crypted.bin.exe
        C:\Users\Admin\AppData\Local\Temp\Crypted.bin.exe
        3⤵
        • Modifies extensions of user files
        • Drops desktop.ini file(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1348
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2108

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\AAAAAAAAAAA

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\BBBBBBBBBBB

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\CCCCCCCCCCC

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\DDDDDDDDDDD

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\DDDDDDDDDDD

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\EEEEEEEEEEE

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\FFFFFFFFFFF

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\GGGGGGGGGGG

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\HHHHHHHHHHH

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\IIIIIIIIIII

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\JJJJJJJJJJJ

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\KKKKKKKKKKK

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\LLLLLLLLLLL

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\MMMMMMMMMMM

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\NNNNNNNNNNN

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\OOOOOOOOOOO

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\PPPPPPPPPPP

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\QQQQQQQQQQQ

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\RRRRRRRRRRR

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\SSSSSSSSSSS

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\TTTTTTTTTTT

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\UUUUUUUUUUU

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\VVVVVVVVVVV

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\WWWWWWWWWWW

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\XXXXXXXXXXX

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\YYYYYYYYYYY

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\desktop.ini

          Filesize

          129B

          MD5

          68061510dff88e8f427db50ca0ebdab3

          SHA1

          9f966e257cf3d75b8eb1e8653e007271eac0e11c

          SHA256

          a1127dc6f517738484c0ad13957edd3cebb1308b54f4458bccd9d81aaeaa0dee

          SHA512

          1bac456a6995df7f8f895e7992eb7bf11471462d649cabe76d595343708474fafc04e7fcc30e78130e159a1b76cbf9a82fc52ea586ed4b8f0a59605a498bafe3

        • C:\ZQXLByuZ3.README.txt

          Filesize

          5KB

          MD5

          9c01d69e72dbf6b42d03fd97b2c13fdf

          SHA1

          f79bc79983152d43c8b7fbad069c60f2c8d0b070

          SHA256

          0b7b64a12f026fc15924b316edc023ed6256b5e7a48083dcba93511194a966c3

          SHA512

          90f9824dd9fb143ccddd0e58b7e7e4a3da0c32598a97bb6f52beddd3fd0ed502619bce0e417898670bc327d1e0d5d17b1a0632557010b235b8369be82a4112e8

        • memory/1348-155-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-152-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-161-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-2881-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-207-0x00000000024F0000-0x0000000002500000-memory.dmp

          Filesize

          64KB

        • memory/1348-225-0x00000000024F0000-0x0000000002500000-memory.dmp

          Filesize

          64KB

        • memory/1348-181-0x00000000024F0000-0x0000000002500000-memory.dmp

          Filesize

          64KB

        • memory/1348-158-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-227-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-154-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-153-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-164-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-151-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-150-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-2879-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-2876-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1348-949-0x00000000024F0000-0x0000000002500000-memory.dmp

          Filesize

          64KB

        • memory/1348-948-0x00000000024F0000-0x0000000002500000-memory.dmp

          Filesize

          64KB

        • memory/1348-947-0x00000000024F0000-0x0000000002500000-memory.dmp

          Filesize

          64KB

        • memory/1348-231-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/4244-133-0x0000000010000000-0x00000000101AC000-memory.dmp

          Filesize

          1.7MB

        • memory/4244-159-0x0000000010000000-0x00000000101AC000-memory.dmp

          Filesize

          1.7MB

        • memory/4992-157-0x00000000024B0000-0x000000000260A000-memory.dmp

          Filesize

          1.4MB

        • memory/4992-134-0x0000000010000000-0x00000000101AC000-memory.dmp

          Filesize

          1.7MB

        • memory/4992-135-0x00000000024B0000-0x000000000260A000-memory.dmp

          Filesize

          1.4MB

        • memory/4992-141-0x00000000024B0000-0x000000000260A000-memory.dmp

          Filesize

          1.4MB

        • memory/4992-143-0x0000000010000000-0x00000000101AC000-memory.dmp

          Filesize

          1.7MB

        • memory/4992-144-0x0000000010000000-0x00000000101AC000-memory.dmp

          Filesize

          1.7MB

        • memory/4992-146-0x00000000024B0000-0x000000000260A000-memory.dmp

          Filesize

          1.4MB

        • memory/4992-145-0x0000000010000000-0x00000000101AC000-memory.dmp

          Filesize

          1.7MB

        • memory/4992-162-0x0000000010000000-0x00000000101AC000-memory.dmp

          Filesize

          1.7MB