169da58a5e57c6a68c1b9c07061b70e6c60d23f1708821a091d6f41907b0e9d7

Analysis

max time kernel
156s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
04-07-2024 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LB3.exe
Size

146KB
MD5

567371a071752719b9890da555dccb9a
SHA1

4e076a6c2a213f5efc197cdd9e08d8362c24f456
SHA256

169da58a5e57c6a68c1b9c07061b70e6c60d23f1708821a091d6f41907b0e9d7
SHA512

08081a7a8dbf3434088c9fc51506e078db95abf8cf4797a279f5145d6658c970be896b4adcb25e40d2ecc115e2b11e0d7a688fbd34be98a4d8e62f83cf361e8a
SSDEEP

3072:C6glyuxE4GsUPnliByocWepW5nVTbXaiMI9iyVD4cr:C6gDBGpvEByocWegn1Jlr4

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\tmVnvSyWm.README.txt

Ransom Note

>>>> Your data are stolen and encrypted All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is 500$. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - www .coinmama.com Bitpanda - www .bitpanda.com Bitcoin Address: bc1qccpche8qeyxcj4vptta27g2xjv9k2y889wre6w You should send the amount to this bitcoin address. AFTER the payment contact this email to recover your data: [email protected]

Emails

[email protected]

Signatures

Renames multiple (526) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

Processes:

A3E2.tmp

pid	Process
3928	A3E2.tmp

Executes dropped EXE 1 IoCs

Processes:

A3E2.tmp

pid	Process
3928	A3E2.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

Processes:

LB3.exe

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2457560273-69882387-977367775-1000\desktop.ini	LB3.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2457560273-69882387-977367775-1000\desktop.ini	LB3.exe

Drops file in System32 directory 4 IoCs

Processes:

splwow64.exeprintfilterpipelinesvc.exe

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PP6aqzl18yp92o7srnayasm1u3.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PP_emog6ih5933r3rmpespe2_be.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPb5agbi3tsktzcu2nm18wfdin.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

LB3.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\tmVnvSyWm.bmp"	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\tmVnvSyWm.bmp"	LB3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

LB3.exeA3E2.tmp

pid	Process
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
3928	A3E2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ONENOTE.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

ONENOTE.EXE

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE

Modifies Control Panel 2 IoCs

evasion

Processes:

LB3.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Control Panel\Desktop	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Control Panel\Desktop\WallpaperStyle = "10"	LB3.exe

Modifies registry class 6 IoCs

Processes:

LB3.exeMiniSearchHost.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tmVnvSyWm\DefaultIcon\ = "C:\\ProgramData\\tmVnvSyWm.ico"	LB3.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tmVnvSyWm	LB3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tmVnvSyWm\ = "tmVnvSyWm"	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tmVnvSyWm\DefaultIcon	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tmVnvSyWm	LB3.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

ONENOTE.EXE

pid	Process
2092	ONENOTE.EXE
2092	ONENOTE.EXE

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

LB3.exeONENOTE.EXE

pid	Process
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
4636	LB3.exe
2092	ONENOTE.EXE
2092	ONENOTE.EXE

Suspicious behavior: RenamesItself 26 IoCs

Processes:

A3E2.tmp

pid	Process
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp
3928	A3E2.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

LB3.exe

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeDebugPrivilege	4636	LB3.exe
Token: 36	4636	LB3.exe
Token: SeImpersonatePrivilege	4636	LB3.exe
Token: SeIncBasePriorityPrivilege	4636	LB3.exe
Token: SeIncreaseQuotaPrivilege	4636	LB3.exe
Token: 33	4636	LB3.exe
Token: SeManageVolumePrivilege	4636	LB3.exe
Token: SeProfSingleProcessPrivilege	4636	LB3.exe
Token: SeRestorePrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSystemProfilePrivilege	4636	LB3.exe
Token: SeTakeOwnershipPrivilege	4636	LB3.exe
Token: SeShutdownPrivilege	4636	LB3.exe
Token: SeDebugPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeBackupPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe
Token: SeSecurityPrivilege	4636	LB3.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

ONENOTE.EXEMiniSearchHost.exe

pid	Process
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
2092	ONENOTE.EXE
4932	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

LB3.exeprintfilterpipelinesvc.exeA3E2.tmp

description	pid	Process	procid_target
PID 4636 wrote to memory of 2064	4636	LB3.exe	79
PID 4636 wrote to memory of 2064	4636	LB3.exe	79
PID 2564 wrote to memory of 2092	2564	printfilterpipelinesvc.exe	82
PID 2564 wrote to memory of 2092	2564	printfilterpipelinesvc.exe	82
PID 4636 wrote to memory of 3928	4636	LB3.exe	83
PID 4636 wrote to memory of 3928	4636	LB3.exe	83
PID 4636 wrote to memory of 3928	4636	LB3.exe	83
PID 4636 wrote to memory of 3928	4636	LB3.exe	83
PID 3928 wrote to memory of 4932	3928	A3E2.tmp	84
PID 3928 wrote to memory of 4932	3928	A3E2.tmp	84
PID 3928 wrote to memory of 4932	3928	A3E2.tmp	84

C:\Users\Admin\AppData\Local\Temp\LB3.exe
"C:\Users\Admin\AppData\Local\Temp\LB3.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:2064
- C:\ProgramData\A3E2.tmp
  "C:\ProgramData\A3E2.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A3E2.tmp >> NUL
    3⤵
    PID:4932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3140

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{1FB91272-6B7C-4040-830C-3AB940937694}.xps" 133646112315980000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2092

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2457560273-69882387-977367775-1000\DDDDDDDDDDD

Filesize
129B

MD5
89cae1d5efac7eed8012751196f8c8d9

SHA1
dd9350800a6a667ccb228d80a6a93d0a078ab010

SHA256
aa2895088bcbf4874c65183ed0e70adc03e2fb90572348cfb907dc1b272c1687

SHA512
1943a04cd83abaa74dcff948c8723c55ddffe08778c15643d5e97cbeb3ab93048e6ccc3d0c46c24b651036cc37e3d7280c942fad10419721338408600738e972

Download Submit
C:\ProgramData\A3E2.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{1FB91272-6B7C-4040-830C-3AB940937694}.xps

Filesize
12.8MB

MD5
dfdd82d88149e75bd423656410db120d

SHA1
49865ad368f384ebe48cc84dffce8052d772f292

SHA256
23c4af408de953e442d7d0678a4fe07fa0111ad3fc0802a26101f3ff4cbc388a

SHA512
203644a7e4d868ce616b2ca47c43c6a5832b2fa881811c0fd69fc0566d37b9433e28174a7af0f8faac36eaf202c73a6427bd76a453b1a35375067f16f6a1a74b

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
a71ab244d565671f741686cb2c5ed11b

SHA1
b6e766a85f1f878d512f752df2dd4873971755e2

SHA256
06a5716962f3b50a8aa3acd30e33d6c75664465c3d795196ad6dce5e33a80faa

SHA512
0826c8e52b0f5dbcbda745f06390fd59ce9eee8e0e845cdb007f4a97b19065f2544ca63226b34d361adf9e1cf26644672abfe5dcfd75651cd2aeb1ae27f16f84

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
44408d8bcd8c4ffe97a60ddf16281885

SHA1
ab8773e27c92a24e12969dd4dc6bb8422f15d589

SHA256
a6047cddc1126bc128da907db3550e725647640752e6a5c71ce9445735a9e83a

SHA512
ff4e382bd3d00515f57bb735c6ffce35afd9f63a8def25ba18f722e618ac9f107e31e0ab44ff7758394e9ca7f52bc67b0ba70710c4dfd6afdb470a34093a35c6

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt

Filesize
846KB

MD5
766f5efd9efca73b6dfd0fb3d648639f

SHA1
71928a29c3affb9715d92542ef4cf3472e7931fe

SHA256
9111e9a5093f97e15510bf3d3dc36fd4a736981215f79540454ce86893993fdc

SHA512
1d4bb423d9cc9037f6974a389ff304e5b9fbd4bfd013a09d4ceeff3fd2a87ad81fe84b2ee880023984978391daf11540f353d391f35a4236b241ccced13a3434

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDDDDDD

Filesize
146KB

MD5
736bdd18459c0a13d1008f2a01c5ecfc

SHA1
e43c2a44a72633f490d1c862d5175f1fddad88a5

SHA256
0e7be292bccce63f849bfb086596e9fe2dbbeeb0233693c36039d64475e48f53

SHA512
5bf7cd27bb88d02b9cce2f2e405160c71ae29e011ec9b6df827a2a6c4e7467208ded24ce7f56c5ae9da196b0f267bc953879d4d5681abd176e636f1a89d6538d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5E55742F-4952-4844-BBF8-A968DF8B2CD5}

Filesize
4KB

MD5
6c7e7eb666b91ab6a11739af11305243

SHA1
744efdbbdab4f63040c5304e8e01e1faa9b469a1

SHA256
49a17a2a4fd8d261d1f80fefee143439903b4aeea833cb7e3d5809de974d4a98

SHA512
5242f9f2031f831769b5453fd8095e34432862e0ac6fa7891c9227079fb09a0cc122d9d39863ebed81db216b0d470084abf523d42d23e069f3d2fe4604b16ef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{B6F0039D-9BF0-4B3B-AAE3-28BE000D26ED}

Filesize
4KB

MD5
c8f17b6e756355324d534e2ee20527c9

SHA1
eca91e693ccf983bb72beb9594101415c9e88bf0

SHA256
7184130ad07a5898d0482bbfb39b4e963f6a5289a0e5d0798f23cdf38aa17702

SHA512
7093134dafdf6f99c4f40727ee14eb81ac14d394a888d3e3073a44465ca3bc734312edcf302ae8642d963d3df732fa5a64303858130956ac1c1fa8c983f0471c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

Filesize
4KB

MD5
6f8dd2e9c35a452f368e14ed2de442f5

SHA1
8bd239ff33283954de77dd2b7dad3047a309828a

SHA256
1e626b2fff51b7d053fd8027b635eb2bef01f867f6a699e769f45861a49781fe

SHA512
a6bbc251342f5aa870b8a48384372907a9973b96dd397a2c8fca6eab13c4a596611a2462140086b0f6ce053f366810da5ef7821063dea1ab0f27ffaf467a5c9a

Download Submit
C:\tmVnvSyWm.README.txt

Filesize
1016B

MD5
0b45fc3bb5ecfc4c26e03fac71d58901

SHA1
a74cdcd027147a06dfb6bb09030ce630eacd2d77

SHA256
9569d1f997217139e5c79398af8e20382201ae66d07f31a71635dc072febe122

SHA512
74b244770db52bcf50db9aeb3102eb9ec9253f5adcff200bef8e1d9e49d8d5e7b2e1c333b5f92723502ecbb3b9922eb4f9fa404a65c988afae0ad56e0303fa5e

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2457560273-69882387-977367775-1000\DDDDDDDDDDD

Filesize
129B

MD5
c433931c99f3b030d1d172ed624372c9

SHA1
781a2914ed76faa04a0ee1abbbc078d680286b3c

SHA256
fc1fbb03362cdb33d132a7a46e80bcd14f8a983a8270f92ec76db8c285696be6

SHA512
90bde7288613b05117fdf66ebf8ab284b1e20eea5cec51214315e8fac4e2e0f929ccbbcf512a0f88ba943fc5024a1c95e7e649de8d8170cc56596207291f9f4a

Download Submit
memory/2092-2680-0x00007FF7D4AB0000-0x00007FF7D4AC0000-memory.dmp

Filesize
64KB

Download
memory/2092-2648-0x00007FF7D71B0000-0x00007FF7D71C0000-memory.dmp

Filesize
64KB

Download
memory/2092-2681-0x00007FF7D4AB0000-0x00007FF7D4AC0000-memory.dmp

Filesize
64KB

Download
memory/2092-2647-0x00007FF7D71B0000-0x00007FF7D71C0000-memory.dmp

Filesize
64KB

Download
memory/2092-2799-0x00007FF7D71B0000-0x00007FF7D71C0000-memory.dmp

Filesize
64KB

Download
memory/2092-2650-0x00007FF7D71B0000-0x00007FF7D71C0000-memory.dmp

Filesize
64KB

Download
memory/2092-2649-0x00007FF7D71B0000-0x00007FF7D71C0000-memory.dmp

Filesize
64KB

Download
memory/2092-2651-0x00007FF7D71B0000-0x00007FF7D71C0000-memory.dmp

Filesize
64KB

Download
memory/2092-2800-0x00007FF7D71B0000-0x00007FF7D71C0000-memory.dmp

Filesize
64KB

Download
memory/2092-2801-0x00007FF7D71B0000-0x00007FF7D71C0000-memory.dmp

Filesize
64KB

Download
memory/2092-2798-0x00007FF7D71B0000-0x00007FF7D71C0000-memory.dmp

Filesize
64KB

Download
memory/4636-0-0x0000000003270000-0x0000000003280000-memory.dmp

Filesize
64KB

Download
memory/4636-2-0x0000000003270000-0x0000000003280000-memory.dmp

Filesize
64KB

Download
memory/4636-1-0x0000000003270000-0x0000000003280000-memory.dmp

Filesize
64KB

Download