Overview
overview
10Static
static
10Ransomware.zip
windows11-ltsc_2024-x64
1Ransomware...er.exe
windows11-ltsc_2024-x64
10Ransomware/7ev3n.exe
windows11-ltsc_2024-x64
3Ransomware...le.exe
windows11-ltsc_2024-x64
Ransomware...it.exe
windows11-ltsc_2024-x64
10Ransomware/Birele.exe
windows11-ltsc_2024-x64
5Ransomware...r5.exe
windows11-ltsc_2024-x64
10Ransomware...us.exe
windows11-ltsc_2024-x64
10Ransomware...er.exe
windows11-ltsc_2024-x64
10Ransomware...ll.exe
windows11-ltsc_2024-x64
7Ransomware...ck.exe
windows11-ltsc_2024-x64
7Ransomware/Dharma.exe
windows11-ltsc_2024-x64
9Ransomware/Fantom.exe
windows11-ltsc_2024-x64
10Ransomware...ab.exe
windows11-ltsc_2024-x64
3Ransomware...ye.exe
windows11-ltsc_2024-x64
Ransomware...pt.exe
windows11-ltsc_2024-x64
10Ransomware...en.exe
windows11-ltsc_2024-x64
8Ransomware...AZ.dll
windows11-ltsc_2024-x64
3Ransomware...ya.exe
windows11-ltsc_2024-x64
10Ransomware...ap.exe
windows11-ltsc_2024-x64
3Ransomware....A.exe
windows11-ltsc_2024-x64
Ransomware...om.exe
windows11-ltsc_2024-x64
10Ransomware...ot.exe
windows11-ltsc_2024-x64
Ransomware/RedEye.exe
windows11-ltsc_2024-x64
Ransomware/Rokku.exe
windows11-ltsc_2024-x64
10Ransomware/Satana.exe
windows11-ltsc_2024-x64
5Ransomware/Seftad.exe
windows11-ltsc_2024-x64
6Ransomware...re.exe
windows11-ltsc_2024-x64
10Ransomware/UIWIX.dll
windows11-ltsc_2024-x64
3Ransomware...ck.exe
windows11-ltsc_2024-x64
10Ransomware...od.exe
windows11-ltsc_2024-x64
10Ransomware/satan.exe
windows11-ltsc_2024-x64
5Resubmissions
11/11/2026, 02:18
261111-crd1xadt6p1011/11/2026, 02:14
261111-cn8q4set4x1011/11/2026, 01:54
261111-cb2f9sts2r1008/09/2026, 17:42
260908-v91lqsvzby1008/09/2026, 14:47
260908-r5xshastaw06/09/2026, 10:46
260906-mtz19shn5s1002/09/2026, 16:53
260902-vefcbaxhjb1002/09/2026, 16:53
260902-vd1xmaxgqd26/04/2026, 11:25
260426-njgydaas6r1024/04/2026, 20:04
260424-ys8gssbv3l10Analysis
- max time kernel
8s - max time network
15s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-es - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows - submitted
11/11/2026, 01:54
Behavioral task
behavioral1
Sample
Ransomware.zip
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral2
Sample
Ransomware/$uckyLocker.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Ransomware/7ev3n.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral4
Sample
Ransomware/Annabelle.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Ransomware/BadRabbit.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral6
Sample
Ransomware/Birele.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Ransomware/Cerber5.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral8
Sample
Ransomware/CoronaVirus.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Ransomware/CryptoLocker.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral10
Sample
Ransomware/CryptoWall.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Ransomware/DeriaLock.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral12
Sample
Ransomware/Dharma.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Ransomware/Fantom.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral14
Sample
Ransomware/GandCrab.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Ransomware/GoldenEye/GoldenEye.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral16
Sample
Ransomware/InfinityCrypt.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Ransomware/Krotten.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral18
Sample
Ransomware/Locky.AZ.dll
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Ransomware/NotPetya.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
Ransomware/PetrWrap.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Ransomware/Petya.A.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
Ransomware/PolyRansom.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
Ransomware/RedBoot.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
Ransomware/RedEye.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Ransomware/Rokku.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral26
Sample
Ransomware/Satana.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Ransomware/Seftad.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral28
Sample
Ransomware/SporaRansomware.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
Ransomware/UIWIX.dll
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral30
Sample
Ransomware/ViraLock.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Ransomware/WinlockerVB6Blacksod.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Behavioral task
behavioral32
Sample
Ransomware/satan.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
Errors
General
- Target Ransomware/RedBoot.exe
- Size 1.2MB
- Sample261111-cb2f9sts2r
- SHA256 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
- MD5 e0340f456f76993fc047bc715dfdae6a
- SHA1 d47f6f7e553c4bc44a2fe88c2054de901390b2d7
- SHA512 cac10c675d81630eefca49b2ac4cc83f3eb29115ee28a560db4d6c33f70bf24980e48bb48ce20375349736e3e6b23a1ca504b9367917328853fffc5539626bbc
- SSDEEP 24576:/4GHnhIzOasqUgEOr69/BRH7dCibu+XoAX0eOTva49ttrSpt81ekHPyWe:AshdasJgEOrGBRxCihH7OO49rveMG
- TLSH T103452394A452D017D2C67AB9C036DAB45BA4B831EEC2391BC354F651BD70383CB67B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Renames multiple (188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 3 IoCs
pid Process 2936 protect.exe 2000 assembler.exe 1476 overwrite.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 overwrite.exe - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral23/files/0x000e00000001c63f-19.dat autoit_exe behavioral23/memory/5532-226-0x0000000000620000-0x00000000008AE000-memory.dmp autoit_exe -
resource yara_rule behavioral23/memory/5532-0-0x0000000000620000-0x00000000008AE000-memory.dmp upx behavioral23/memory/5532-226-0x0000000000620000-0x00000000008AE000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language protect.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assembler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language overwrite.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RedBoot.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe 2936 protect.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 5532 RedBoot.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5532 RedBoot.exe Token: 9800198928828409368 5532 RedBoot.exe Token: SeShutdownPrivilege 5532 RedBoot.exe Token: 20266335777671344 5532 RedBoot.exe Token: 51539607552 5532 RedBoot.exe Token: 17179869189 5532 RedBoot.exe Token: 0 5532 RedBoot.exe Token: 0 5532 RedBoot.exe Token: 0 5532 RedBoot.exe Token: 0 5532 RedBoot.exe Token: 0 5532 RedBoot.exe Token: 0 5532 RedBoot.exe Token: 0 5532 RedBoot.exe Token: 25769803776 5532 RedBoot.exe Token: 171798691840 5532 RedBoot.exe Token: 0 5532 RedBoot.exe Token: 0 5532 RedBoot.exe Token: 0 5532 RedBoot.exe Token: 0 5532 RedBoot.exe Token: 0 5532 RedBoot.exe Token: 61143669828942712 5532 RedBoot.exe Token: 61146246809320312 5532 RedBoot.exe Token: 61130269530979192 5532 RedBoot.exe Token: 61131128524438392 5532 RedBoot.exe Token: 61338317746797432 5532 RedBoot.exe Token: 61338489545489272 5532 RedBoot.exe Token: 61341066525866872 5532 RedBoot.exe Token: 61336427961187192 5532 RedBoot.exe Token: 61342440915401592 5532 RedBoot.exe Token: 61343815304936312 5532 RedBoot.exe Token: 61345189694471032 5532 RedBoot.exe Token: 61346735882697592 5532 RedBoot.exe Token: 61351889843452792 5532 RedBoot.exe Token: 61347079480081272 5532 RedBoot.exe Token: 61347766674848632 5532 RedBoot.exe Token: 61352061642144632 5532 RedBoot.exe Token: 61525166004042616 5532 RedBoot.exe Token: 61522417224973176 5532 RedBoot.exe Token: 61522589023665016 5532 RedBoot.exe Token: 61530491763489656 5532 RedBoot.exe Token: 61642126553447288 5532 RedBoot.exe Token: 61642298352139128 5532 RedBoot.exe Token: 61642813748214648 5532 RedBoot.exe Token: 61645906124667768 5532 RedBoot.exe Token: 61652434474957688 5532 RedBoot.exe Token: 61650544689347448 5532 RedBoot.exe Token: 61651919078882168 5532 RedBoot.exe Token: 61632677625396088 5532 RedBoot.exe Token: 61634911008390008 5532 RedBoot.exe Token: 61630787839785848 5532 RedBoot.exe Token: 61863678146444152 5532 RedBoot.exe Token: 61867285918972792 5532 RedBoot.exe Token: 61867629516356472 5532 RedBoot.exe Token: 61840828920429432 5532 RedBoot.exe Token: 61841344316504952 5532 RedBoot.exe Token: 61852683030166392 5532 RedBoot.exe Token: 61856806198770552 5532 RedBoot.exe Token: 61639377774377848 5532 RedBoot.exe Token: 62046609393515384 5532 RedBoot.exe Token: 62066709840460664 5532 RedBoot.exe Token: 62065163652234104 5532 RedBoot.exe Token: 62073066392058744 5532 RedBoot.exe Token: 62073753586826104 5532 RedBoot.exe Token: 62044719607905144 5532 RedBoot.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5616 LogonUI.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5532 wrote to memory of 2936 5532 RedBoot.exe 88 PID 5532 wrote to memory of 2000 5532 RedBoot.exe 89 PID 5532 wrote to memory of 1476 5532 RedBoot.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware\RedBoot.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware\RedBoot.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\65330069\protect.exe"C:\Users\Admin\65330069\protect.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2936
-
-
C:\Users\Admin\65330069\assembler.exe"C:\Users\Admin\65330069\assembler.exe" -f bin "C:\Users\Admin\65330069\boot.asm" -o "C:\Users\Admin\65330069\boot.bin"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2000
-
-
C:\Users\Admin\65330069\overwrite.exe"C:\Users\Admin\65330069\overwrite.exe" "C:\Users\Admin\65330069\boot.bin"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:1476
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:712
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a28855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5812
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:3660
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\65330069\assembler.exe
- Size 589KB
- SHA256 2a5305369edb9c2d7354b2f210e91129e4b8c546b0adf883951ea7bf7ee0f2b2
- MD5 7e3cea1f686207563c8369f64ea28e5b
- SHA1 a1736fd61555841396b0406d5c9ca55c4b6cdf41
- SHA512 4629bc32094bdb030e6c9be247068e7295599203284cb95921c98fcbe3ac60286670be7e5ee9f0374a4017286c7af9db211bd831e3ea871d31a509d7bbc1d6a3
- SSDEEP 12288:C9+m3cibQpBFu0ZMY7Ox1x0RzoyE/xd7I6Ixq8wd8JS:C9+m3cibQrE38UoS
- TLSH T1DED4E6ACE542D5ADCC3103712DD3D66E69B8AC1994135B83F7BA7B5F3C36B80212A271
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\65330069\boot.asm
- Size 825B
- SHA256 91e74c438099172b057bedf693d877bd08677d5f2173763986be4974c0970581
- MD5 def1219cfb1c0a899e5c4ea32fe29f70
- SHA1 88aedde59832576480dfc7cd3ee6f54a132588a8
- SHA512 1e735d588cb1bb42324eaff1b9190ec6a8254f419d1ba4a13d03716ff5c102a335532b573a5befb08da90586e5670617066564ef9872f8c415b9a480836df423
- TLSH T104019078F91A0BC005B52A2DF6B29E47D0DA915F56E26866750C803E9FFE101887287C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\65330069\boot.bin
- Size 512B
- SHA256 a760d8bc77ad8c0c839d4ef162ce44d5897af6fa84e0cc05ecc0747759ea76c2
- MD5 90053233e561c8bf7a7b14eda0fa0e84
- SHA1 16a7138387f7a3366b7da350c598f71de3e1cde2
- SHA512 63fda509cd02fd9d1374435f95515bc74f1ca8a9650b87d2299f8eee3a1c5a41b1cb8a4e1360c75f876f1dae193fdf4a96eba244683308f34d64d7ce37af2bb4
- TLSH T1FCF02BBAA11871C0D556143BB7225B577917909C536808671D0AD02DAA775068872D69
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\65330069\overwrite.exe
- Size 288KB
- SHA256 f2bc5886b0f189976a367a69da8745bf66842f9bba89f8d208790db3dad0c7d2
- MD5 bc160318a6e8dadb664408fb539cd04b
- SHA1 4b5eb324eebe3f84e623179a8e2c3743ccf32763
- SHA512 51bc090f2821c57d94cfe4399b1f372a68d2811ea0b87d1ac1d6cf8ae39b167038ac21c471b168f1d19c6b213762024abb7e9e5ca311b246b46af0888289e46c
- SSDEEP 6144:h6r+IrezXLUgqspn73GDwG/K6786TEnCAIpi9MxipEl7BuHBTpOdNPIGAZTBO9NS:hSlUXoKOlzGt
- TLSH T180543AC7FA865DF3ED23037448E6D36B123BA6815616CF63EA20D93A0E53AD16DC4706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\65330069\protect.exe
- Size 837KB
- SHA256 e61a8382f7293e40cb993ddcbcaa53a4e5f07a3d6b6a1bfe5377a1a74a8dcac6
- MD5 fd414666a5b2122c3d9e3e380cf225ed
- SHA1 de139747b42a807efa8a2dcc1a8304f9a29b862d
- SHA512 9ab2163d7deff29c202ed88dba36d5b28f6c67e647a0cadb3d03cc725796e19e5f298c04b1c8523d1d1ee4307e1a5d6f8156fa4021627d6ca1bbd0830695ae05
- SSDEEP 12288:5CdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBga87YAQ:5Cdxte/80jYLT3U1jfsWaEYAQ
- TLSH T1F8059D2273DDC370CB669173BF69B7016EBF78614630B85B2F880D7DA950161262DBA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\AddDisconnect.wvx.locked
- Size 411KB
- SHA256 924537f69c27964036e22e8146d9b8817a503d0216277332792a40384c16254c
- MD5 d64c2cee03a3922d47f549c8b7e2385d
- SHA1 a8c56c2934dc99851843a49b15b024a0572d4e38
- SHA512 abc73feaafc7348ae5ebbbf3f360892822c5e9086178da64949d0a044d36b57bf5b665dd917fe871910c305789af8257349a75ac172820b963f4cb5b674ae895
- SSDEEP 12288:6EjggP0uPRyTEJTo1cK2Gbn41RktWYkkwb:f8w8TEJTlgn41Re/kBb
- TLSH T1C594231E9854D026EF053E726230D5E7421BD870EA76F7DB3AFA9F728401942693368F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\AssertStop.xps.locked
- Size 283KB
- SHA256 c15fa72b964d0f32473f2f9871ad982b877825461f898da7d2535a4619118460
- MD5 e071db858b9fcb2965e89e895407a988
- SHA1 6a339f800f95e7b4b0480252813c2caa779c5171
- SHA512 0843f5e651c96894953216a8b27bb5b71d88732b7e8000ba29e6a3072381f8abd1c5523c19ae902acfa0676db37a74daab590299052a376d9ba2f06d6307f69c
- SSDEEP 6144:thlPln1gWG2f8+xkUBrQgWpH4r3DJ1ARkFuldV37bZLI88DTpkIk0jYH5HeC:Db8YF2HODJ1AK2dZ7NIpDTCd06eC
- TLSH T1685423D53093DF54020B762DE27481B89E96EB8B3D78CCB50AF5D1406F1AD36636B871
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\CompressConvertFrom.mp4.locked
- Size 737KB
- SHA256 490a7e0ef757fd046b9a5c2a95d502d35c3beae775bc5bcf9ce52a462ab466a0
- MD5 ecccddd9ce95afd02c32f6a8ea2a0d1c
- SHA1 2e0478289a32aa39353a05ba2765759f4b92f5e1
- SHA512 deae4a2e681d67fe3e09437b9caca65433b4e8c6cce593faa6ae7bd43a1751e2599214e0da75a9f62af12e7bdfb697ead15d5c957a253c6b59e4e3775ee6b7fa
- SSDEEP 12288:KLZThr3V09S12+J9k7ydPmGFZrrKR2oDt0AqQSJwGufMxqS1laydiRXezl+Y+W:KZhLJcePmGFl+p57avqS1laylzb+W
- TLSH T1BDF4234F5F9E99FD2E9F0E2435057230E1F20AA8B5EB4CA612C2371AF605725BDC509B
- MD5 SHA1 SHA512 SSDEEP TLSH