Analysis
- max time kernel
147s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
30/08/2024, 01:57
Behavioral task
behavioral1
Sample
ggc.exe
Resource
win7-20240708-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
ggc.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target ggc.exe
- Size 150KB
- Sample240830-cdr1lstbpr
- SHA256 274844568a6a9ce334d71efeac21f528d7b54b2cd4377c978cc1270c6ad986c4
- MD5 7e503c206e57f0295da017914a957d04
- SHA1 96c375b9c57292db73c7ef2f2df16cf7be1604bb
- SHA512 cd4889ae107c54df854042e030eb431664d4db9d6dc908d1f1910ca49b89d247222f9d19440fcc2d9a120c95b56cd694750072ab9486eea961b8c33391344c1c
- SSDEEP 3072:6qJogYkcSNm9V7DPaGkxDSzGmblnDPET:6q2kc4m9tDyNDSrdj
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\wlJ8FiR2h.README.txt
-
lockbit
Ransom Note
- ~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom DeathGrip Ransomware Attack | t.me/DeathGripRansomware This computer is attacked by russian ransomware community of professional black hat hackers. Your every single documents / details is now under observation of those hackers. If you want to get it back then you have to pay 1000$ for it. This Attack Is Done By Team RansomVerse You Can Find Us On Telegram @DeathGripRansomware Contact The Owner For The Decrypter Of This Ransomware #DeathGripMalware >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on Telegram t.me/DeathGripRansomware >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz >>>> Your personal DECRYPTION ID: B7568014A48684D6D525F3F3722638C4 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using on Telegram messenger without registration and text t.me/DeathGripRansomware Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
URLs
-
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
-
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
-
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
-
http://lockbitsupp.uz
-
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
-
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
-
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
-
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
-
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
-
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
-
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
-
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
-
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
Signatures
- Lockbit
Ransomware family with multiple variants released since late 2019.
- Renames multiple (611) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation BFA7.tmp - Deletes itself 1 IoCs
pid Process 4640 BFA7.tmp - Executes dropped EXE 1 IoCs
pid Process 4640 BFA7.tmp - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini ggc.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini ggc.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPujoij452w650uwctvyqa4enad.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPzyuen8n5x0mzze3jxl8zcc6yd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPejr2j2bfo0cg1elh_1fz_5k6d.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\wlJ8FiR2h.bmp" ggc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\wlJ8FiR2h.bmp" ggc.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4640 BFA7.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ggc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop ggc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\WallpaperStyle = "10" ggc.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wlJ8FiR2h\ = "wlJ8FiR2h" ggc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wlJ8FiR2h\DefaultIcon ggc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wlJ8FiR2h ggc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wlJ8FiR2h\DefaultIcon\ = "C:\\ProgramData\\wlJ8FiR2h.ico" ggc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wlJ8FiR2h ggc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe 2512 ggc.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp 4640 BFA7.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeDebugPrivilege 2512 ggc.exe Token: 36 2512 ggc.exe Token: SeImpersonatePrivilege 2512 ggc.exe Token: SeIncBasePriorityPrivilege 2512 ggc.exe Token: SeIncreaseQuotaPrivilege 2512 ggc.exe Token: 33 2512 ggc.exe Token: SeManageVolumePrivilege 2512 ggc.exe Token: SeProfSingleProcessPrivilege 2512 ggc.exe Token: SeRestorePrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSystemProfilePrivilege 2512 ggc.exe Token: SeTakeOwnershipPrivilege 2512 ggc.exe Token: SeShutdownPrivilege 2512 ggc.exe Token: SeDebugPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeBackupPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe Token: SeSecurityPrivilege 2512 ggc.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4824 ONENOTE.EXE 4824 ONENOTE.EXE 4824 ONENOTE.EXE 4824 ONENOTE.EXE 4824 ONENOTE.EXE 4824 ONENOTE.EXE 4824 ONENOTE.EXE 4824 ONENOTE.EXE 4824 ONENOTE.EXE 4824 ONENOTE.EXE 4824 ONENOTE.EXE 4824 ONENOTE.EXE 4824 ONENOTE.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2512 wrote to memory of 6072 2512 ggc.exe 94 PID 2512 wrote to memory of 6072 2512 ggc.exe 94 PID 452 wrote to memory of 4824 452 printfilterpipelinesvc.exe 99 PID 452 wrote to memory of 4824 452 printfilterpipelinesvc.exe 99 PID 2512 wrote to memory of 4640 2512 ggc.exe 100 PID 2512 wrote to memory of 4640 2512 ggc.exe 100 PID 2512 wrote to memory of 4640 2512 ggc.exe 100 PID 2512 wrote to memory of 4640 2512 ggc.exe 100 PID 4640 wrote to memory of 4652 4640 BFA7.tmp 101 PID 4640 wrote to memory of 4652 4640 BFA7.tmp 101 PID 4640 wrote to memory of 4652 4640 BFA7.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\ggc.exe"C:\Users\Admin\AppData\Local\Temp\ggc.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:6072
-
-
C:\ProgramData\BFA7.tmp"C:\ProgramData\BFA7.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BFA7.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:4652
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:6124
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{586FA09C-87E7-41AA-953C-6102851E5564}.xps" 1336945669505500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\YYYYYYYYYYY
- Size 129B
- SHA256 3b0e81052589e9e8f59dd56c26284f9863596dd270b67113397403005dd058db
- MD5 1cf8a08911ff58c217ca8e8fbba2dcf9
- SHA1 1fd4032cd45a75c8353e6a7589beee74ebc30e21
- SHA512 4d6510ce718d01c6ee77ac248686a5f41c12d79870a6f2784ceddb89ac6074f532a37c6d2768ac5a3214063205e04379fcea17d2274cc504f44562c492f6279f
- MD5 SHA1 SHA512
- Path C:\ProgramData\BFA7.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EEEEEEE
- Size 150KB
- SHA256 77cc2464b49eb331c6333b32f2a483b14cedbe5f31886739974257fcb46c83bb
- MD5 a141a54aaf2043bd215320c3dce8c36d
- SHA1 2e90099ca329bc17ec703a32a64dafa2cb95f542
- SHA512 cc677c2f4f67893e06c38ce69e04a133164f7ddf5d4338b9801d566c4cb70053b3d34a5e3d00581da351bccaadc0863c62d8b4da9e72e8bffe29cd2bd04562c3
- SSDEEP 3072:EPs9Rzes+/j+YVRusiu9Zpgcpe02KPs9Rzes+/j+YVRusiu9Zpgcpe02KPs9Rze8:EPgzesUaYVksiu9Znpe02KPgzesUaYVW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{8A2F6DDE-3B8C-4200-A663-75E095DFC962}
- Size 4KB
- SHA256 0b8044756de9a4fefec003585f93616036e0c381ccda7686306657ad9d9114e8
- MD5 a88dd9456a2268fb38822ea0ba9367ef
- SHA1 c2f0c912b3793481647ba193e4e9a2a2d49f2441
- SHA512 84564316c5faa7958e5f5a03f92038c32db9c8e3b016661e08d39288b8caf708c3be40c14a2f5b41992a25c0f1e6748a7c638db3756aaac80e7e6d17c1bfe876
- SSDEEP 6:RaHftYyfB3h1RRXUnfHwPwBy/FKO2iBqsW2itBRujlw//0lweI/msW2itjRujd:Ra/tYyf9/UfHUj2iXW222Wf/bW22q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 1db28a840cb638be8f11aba6fd186607b2c5facb1cafd49d1b4bff61f69d3e59
- MD5 4fd2f8874f22a8312155489c122727d3
- SHA1 a21217513216e1a109551ac9fe68b97a9ce12a81
- SHA512 3aeeac14bf042e8cabb59094f08dfde9c4e9e44861a725502ba6a835277e1bf62b2541ec134698d89e5738c5547017cc113006ac18fb055b670d9192a0428af8
- SSDEEP 12:Ra/tYyfHj/Uvupj2iXW222W6/bW2aXjW22oCFuHiQrG63EIxA/L:Y/tYyfHYWyiXHT5HaXjHWuBrGm1Aj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\wlJ8FiR2h.README.txt
- Size 3KB
- SHA256 9268d24e96639cf4c0e8d74f9769092b415015692ea528820faaded6fc5b052c
- MD5 b9674de0868a93e9121bdb1d02d80130
- SHA1 79d692fd03d3110a4358e2cc7442af9517489f3f
- SHA512 b3264ad33eddedb2c18da883e2345247c762adc8a604991fce931cba06b86c361d23fa121e79d6c69948a2d5b9c1613139f401b971360d9d684abb5a61543c02
- MD5 SHA1 SHA512
- Path F:\$RECYCLE.BIN\S-1-5-21-1302416131-1437503476-2806442725-1000\DDDDDDDDDDD
- Size 129B
- SHA256 3281138410f32c5e44e0ed39d192d68a132d164a7ba866a9c279376c355917b6
- MD5 74a1c9568b8df61d24a1e925b2256cb5
- SHA1 dee42ba1a8b3b8c1a510af6af07b9b1acc0c8cb4
- SHA512 f3c90ed8e1d7bed964b6661a2cf470f7a277531491093f10a42e55f9b3aff33f9acf1b2f02367e03befbf17dcff094088837dc5660f0b53502bd1ce8a4833ac5
- MD5 SHA1 SHA512