Guccifer 2.0 Evidence MD5/SHA Hashes
Adam Carter --- April 16, 2020
The following files all relate to evidence concerning the Guccifer 2.0 persona that claimed credit for hacking the DNC in 2016.
I'm publishing this to safeguard against potential manipulation and corruption of evidence in case any of this evidence ceases to be available or Guccifer 2.0's blog is removed.
Archives
"7dc58-ngp-van.7z"
md5: a6ca56d03073ce6377922171fc8b232d
sha-1: e4279f464b8f902057944c4a755e9b1dbf47776d
There was another file with an identical name that was later shared in relation to CrowdSourceTheTruth. It was not the same as the original, had content missing and files introduced that were not in the original. The original (which the above hashes relate to) is still available through
The Pirate Bay and is also available from
ddos secrets archive at the time of writing. This piece of evidence shows Guccifer 2.0 transferring files at speeds consistent with USB transfers, later archiving files into RAR v4 archives while Eastern time zone were in effect and then either writing the archives to or copying them to a USB device and finally archiving the contents of the USB device with 7zip.
"HRC_Pass..zip"
md5: 98bb5e37f273238583f454c1734806be
sha-1: 9fb9c1434aa5ce79a7dd532339002a6bb53fc0ad
"CF.7z"
md5: c7574d3503ed3009ec918cf8b79c007b
sha-1: ad6cda054517356bdd35405a365f89c8cb2e5e1f
At the time of writing, this is still available at:
https://www.mediafire.com/file/cqri63iyzrh6piv/cf.7z
(same link as can be found in this article on Guccifer 2.0's site). Due to some files in this archive being contemporaneous with a transfer observed in the NGP-VAN archive, it was possible to determine that files in this archive were compiled while central timezones settings were in effect.
Other Published/Released Files
"1.doc"
md5: a0977ccf006a9e9b5d2c396986cc8da7
sha-1: 69b3073a16dd5c6d3cf7269129d00fef88c754f1
Part of a series of documents released by Guccifer 2.0 that were constructed from documents attached to Podesta emails but for which Guccifer 2.0 presented as evidence of hacking the DNC. The files were covered in Russian breadcrumbs in what appears to have been a deliberate process. More details are available
here,
here and
here. At the time of writing, "1.doc" file is still available
here.
"2.doc"
md5: 4409de44ef522b583e38a5ed79bf09f0
sha-1: 6f3039b5b33d077df5666972321904e8ce0e4cfb
Part of a series of documents released by Guccifer 2.0 that were constructed from documents attached to Podesta emails but for which Guccifer 2.0 presented as evidence of hacking the DNC. The files were covered in Russian breadcrumbs in what appears to have been a deliberate process. More details are available
here,
here and
here. At the time of writing "2.doc" file is still available
here.
"3.doc"
md5: e44f494ed23907c5298b645063a5dbc3
sha-1: d2500fcb9173c38e3c36d89a93c4475948a68064
Part of a series of documents released by Guccifer 2.0 that were constructed from documents attached to Podesta emails but for which Guccifer 2.0 presented as evidence of hacking the DNC. The files were covered in Russian breadcrumbs in what appears to have been a deliberate process. More details are available
here,
here and
here. At the time of writing "3.doc" file is still available
here.
"4.doc"
md5: f79972d72f5304bf1dc4cd2ae6c3a2d4
sha-1: 8f677da5ef4116f84081a22cb787c29662651b39
Part of a series of documents released by Guccifer 2.0 that were constructed from documents attached to Podesta emails but for which Guccifer 2.0 presented as evidence of hacking the DNC. The files were covered in Russian breadcrumbs in what appears to have been a deliberate process. More details are available
here,
here and
here. At the time of writing "4.doc" is still available
here.
"5.doc"
md5: e2c432bb1e0ef06226594699876292dc
sha-1: 18aebc7d890f090732a7bb94498d956000722ec5
Part of a series of documents released by Guccifer 2.0 that were constructed from documents attached to Podesta emails but for which Guccifer 2.0 presented as evidence of hacking the DNC. The files were covered in Russian breadcrumbs in what appears to have been a deliberate process. More details are available
here,
here and
here. At the time of writing, "5.doc" is still available
here.
"hillary-for-america-fundraising-guidelines-from-agent-letter.docx"
md5: 8e67dfb0779c085c36560506db7d03bb
sha-1: 0472c788f1f2c2afb63d5555aeb7c214ebb8c5fe
Track changes was enabled on this document. This recorded a PDT timezone indicator. More details on this are available
here. At the time of writing, this document is still available on Guccifer 2.0's site
here.
"dws-az-op-ed-comparison-doc_lm.docx"
md5: e494ccead64955a0677a007d71695b78
sha-1: 8bbbc6d2ae34bc44193ca536c6eba6c57d888f47
Track changes was enabled on this document. This recorded a PDT timezone indicator. More details on this are available
here. At the time of writing, this document is still available on Guccifer 2.0's site
here.
"potus-briefing-05-18-16_as-edits.docx"
md5: 4eb4366f43adb02ecb061216a2fb9df0
sha-1: b7246a3aa39c3b7979be596911320e7da0e40fc6
This document recorded an Eastern timezone indicator. More details are available
here. At the time of writing, the document is still available from the primary source
here.
"clinton-foundation-investments-final.docx"
md5: de84c2e8397fce6e66186aced0637fac
sha-1: 6c46ecf3e91d3a916fc44995b2b1d352e876addb
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"convention-memo-12-15.docx"
md5: 6112996c826afde10dd7f280fb10128d
sha-1: 8e3340351d533aa5b2a84c9be766febd7b854fdf
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"dws-az-op-ed-comparison-doc_lm.docx"
md5: e494ccead64955a0677a007d71695b78
sha-1: 8bbbc6d2ae34bc44193ca536c6eba6c57d888f47
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"foreign-policy-debate-response-book.docx"
md5: fd227cb5d5772945317e265aaab3f84d
sha-1: bad7346f21fcd7c90eb2b3cce4401a35a0d1e71e
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"gci-dnc-rap-and-visual-materials_clean-for-vet.docx"
md5: 4651bdbc44817418b89c895a448e1020
sha-1: d0503da5e33d44a82792c649f6320ff4b63e6998
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"hillary-clinton-travel-final.docx"
md5: 35c51f45e42304f3def8fd4b92497216
sha-1: 114a956b38dfb5a7b6e09c7a34230150e1d04801
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"hillary-clinton-travel-private-jets.docx"
md5: 0524795f20b410e4ad5e8c1f0ae21102
sha-1: ecf4194bcad63de69026940099ac597d61977087
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"hillary-for-america-fundraising-guidelines-from-agent-letter.docx"
md5: 8e67dfb0779c085c36560506db7d03bb
sha-1: 0472c788f1f2c2afb63d5555aeb7c214ebb8c5fe
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"hrc-personal-and-purpose-driven-roy.docx"
md5: 76bb1fc0fdaf18b0bbff8df1cbe6a43a
sha-1: 18eee4611a5646734d92edcff98de5e119b29556
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"potus-debate-response-document.docx"
md5: e715010e3857d189ac0d73d0bd3676cd
sha-1: f602912dd6d20b45b25c909b28564e0edd6e5bcd
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"presidential-campaign-2016.docx"
md5: 777f2af3847e80449f375b8952b9d6e6
sha-1: 651680b62066762f2631f036c3a44e40dffec630
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"usaid-narrowed.docx"
md5: 62325418a118863cf7d50f9763e2cb67
sha-1: d37d415280464ec985c2d1330a6cb21baeb1d6ab
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"wjc-hfa-requests-9-16-15.docx"
md5: 7c46a689eeb7a932abace4eeb8301b6e
sha-1: fe44f861bd6cde251ff413c3897a570af06f76a4
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.
"wyss-democracy-strategy-03-06-15.docx"
md5: 6023350681e9a31d48800bd48fdc638d
sha-1: 7b3d96fe39ec330923157de1e9e3bb973706d6e0
This was part of a collection of documents that had Russian language settings written through needless editing but also had locale settings recorded that pointed to a conflicting locale
(ie. not Russia or Romania). Full details on this are available
here. At the time of writing, the file is still available from Guccifer 2.0's site
here.