Analysis
- max time kernel
149s - max time network
100s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/02/2026, 21:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe
Resource
win11-20260130-en
11 signatures
150 seconds
General
- Target 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe
- Size 68KB
- Sample260206-1rtclaev2a
- SHA256 3eb88d5f959b72dcaf147b7311c806015d42147ddbee4ca97ef24fe9a07287cd
- MD5 7037cb659af1afd83e3ff9f9e15a5095
- SHA1 5fdd8816ff1709ed812674cf1d2edc877cb544bf
- SHA512 5e5ed28bd711099d1cf400e4d822a5770d490f9358bf16d13c38dcd47bba4acd64eb2d382fc5341c05d0aec32f4abc3f2f29e91f69976ff373b004f9e47a6081
- SSDEEP 768:EjfzEz33zUHYg+adTO3NxiqIxQ2xVLDwUzc80gmq3oP/oDoC9:4f2u+adcNxiqIxbr/0O8/oEC9
- TLSH T18463732422B3842ED97D85B815FB2FB817B1BF126860C79D4A78D25C3F637B68C10B56
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
- Nitro family
- Renames multiple (101) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe\"" 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe - Drops desktop.ini file(s) 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe File created C:\Users\Admin\Desktop\desktop.ini 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org 1 api.ipify.org - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 5080 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe Token: SeIncreaseQuotaPrivilege 4884 WMIC.exe Token: SeSecurityPrivilege 4884 WMIC.exe Token: SeTakeOwnershipPrivilege 4884 WMIC.exe Token: SeLoadDriverPrivilege 4884 WMIC.exe Token: SeSystemProfilePrivilege 4884 WMIC.exe Token: SeSystemtimePrivilege 4884 WMIC.exe Token: SeProfSingleProcessPrivilege 4884 WMIC.exe Token: SeIncBasePriorityPrivilege 4884 WMIC.exe Token: SeCreatePagefilePrivilege 4884 WMIC.exe Token: SeBackupPrivilege 4884 WMIC.exe Token: SeRestorePrivilege 4884 WMIC.exe Token: SeShutdownPrivilege 4884 WMIC.exe Token: SeDebugPrivilege 4884 WMIC.exe Token: SeSystemEnvironmentPrivilege 4884 WMIC.exe Token: SeRemoteShutdownPrivilege 4884 WMIC.exe Token: SeUndockPrivilege 4884 WMIC.exe Token: SeManageVolumePrivilege 4884 WMIC.exe Token: 33 4884 WMIC.exe Token: 34 4884 WMIC.exe Token: 35 4884 WMIC.exe Token: 36 4884 WMIC.exe Token: SeIncreaseQuotaPrivilege 4884 WMIC.exe Token: SeSecurityPrivilege 4884 WMIC.exe Token: SeTakeOwnershipPrivilege 4884 WMIC.exe Token: SeLoadDriverPrivilege 4884 WMIC.exe Token: SeSystemProfilePrivilege 4884 WMIC.exe Token: SeSystemtimePrivilege 4884 WMIC.exe Token: SeProfSingleProcessPrivilege 4884 WMIC.exe Token: SeIncBasePriorityPrivilege 4884 WMIC.exe Token: SeCreatePagefilePrivilege 4884 WMIC.exe Token: SeBackupPrivilege 4884 WMIC.exe Token: SeRestorePrivilege 4884 WMIC.exe Token: SeShutdownPrivilege 4884 WMIC.exe Token: SeDebugPrivilege 4884 WMIC.exe Token: SeSystemEnvironmentPrivilege 4884 WMIC.exe Token: SeRemoteShutdownPrivilege 4884 WMIC.exe Token: SeUndockPrivilege 4884 WMIC.exe Token: SeManageVolumePrivilege 4884 WMIC.exe Token: 33 4884 WMIC.exe Token: 34 4884 WMIC.exe Token: 35 4884 WMIC.exe Token: 36 4884 WMIC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5080 wrote to memory of 4180 5080 2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe 78 PID 4180 wrote to memory of 4884 4180 cmd.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe"C:\Users\Admin\AppData\Local\Temp\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe"C:\Users\Admin\AppData\Local\Temp\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3688
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\AddRedo.eprtx
- Size 297KB
- SHA256 a512f54ff4f7f01bb0d83e1ff254ce39b3c88172f212b10276bb4dbdfa8b7463
- MD5 37d7b1ae0137d291f3267aef413b76e9
- SHA1 75363f01a3349da6c30bcf9c343af70a2b8c64ba
- SHA512 17dada02a873d81a42d9885e639234e4c5d547dc145df863ab7fb82b29fb966ba4ea6f6abf19cd82ef005359d614d27584202af35aa501cf9360ab451e1b4b5b
- SSDEEP 6144:EE1gBzCG2PSv1H2HQESU7nYa+es8ata0pPXo1FCnhzNFJTji:EE1gBz72PSv1Wwy7sYXFu/JT2
- TLSH T17C54235538F72A5875F0C7620B47F5634AF5F1940C9E83BAC377B581EB428E82839983
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\AddRedo.eprtx.givemenitro
- Size 298KB
- SHA256 3b1ce4b4063d5af59b4817083434b92619dc61418a5e19cdade30fa5bcab9052
- MD5 965993a1b363565b45766f2a169224a2
- SHA1 5370befb50623e471ca919c98362f019dffa3292
- SHA512 b4f98485e813816d71d8d9eb66cd84ed9975e086f6ea1851acc45bbb287f7b07901a870f793da718089ee1392511433736a1705644179acb05fe9a805a771984
- SSDEEP 6144:IHt6vRrjRnrfk2Rk7E4Y+ff1gMTharPsE7VoctvqGqAMJjvWNTM:G6vNXb8ftTE7sE2cZqpjwQ
- TLSH T15A542377628F10F2D0104D3CE6A0D830A9C6AAEBB2C49F895C1D7D5ACEF5BD36E19241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ApproveMerge.potx
- Size 454KB
- SHA256 464953c6eede45eed50d166a0644a8c32afd84e73fb258a12bd08c93452368b9
- MD5 eafce527c50253a068702bf35aaee6f1
- SHA1 aa19f9f5b76d48acff1df42a34d82e67bf084f44
- SHA512 7ad8e95fc1cc9622507faa42307e5bfeeb83afaa2ea306e5f6e5fdbb1969f5752b888a42da1cc6635167a014beda6faebf3efe92ac92e7fd7d8c0c6c57da590a
- SSDEEP 12288:lUhCmHgj2YBIkr/dKVk7u/KJ/GK/ii3Ge5wgbh:liCmHgjBBIkrQk7jJOKLt
- TLSH T153A4232A8CDEC97CF00E41A9F0A3F5A4E20DB6BF236D59415F652A987302D99F41D8D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ApproveMerge.potx.givemenitro
- Size 454KB
- SHA256 f9da08aa392ad037b5cf1b1de7525c5b480b4def603886a3d2da4b9274eb1b02
- MD5 a725293f37c0fe8da78e2ead5445d141
- SHA1 69a90df3fab51a0d94ac31be6dc7f37900d41aab
- SHA512 f5dee19dcbf1a1200eb36042f1a03854fb91ec490a129763747853709d37dea259a90e9320e205a7f1a481df925a5624ca9389e10466bd4c0f9d8f654131102e
- SSDEEP 12288:cwmqarSb11vJvmoGeV3EYNO4JLs+ZmK7gy3O:crqws11h+kV35BbJO
- TLSH T1F6A4238EA6047DC83C9DA50907DB00DAE666F1945175E4971E7AFA2AF3BD3187032CF1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\AssertSubmit.emz
- Size 517KB
- SHA256 26ef157f35a4395cf201d027c77f885b14edb4ccbda23dd202c01b5c40ade3a8
- MD5 501eed693bc4a253e98672233bf2b132
- SHA1 0d9689ea63c1f9ac77ffba60557f7cdf4b4674dd
- SHA512 b623c66b47e2504195e230dd594aecd85b3db55f9188c830c16fc66fc0a3ba165b922c47f86702ae5323bacbd09ff168d17ca58462ef65e4843e4fe7b120fbc7
- SSDEEP 12288:62/MkmYsO/0HPyxPLas5Sl7LF8iT+DkPvLfBY8CRxyit63:620kGPyZmzeqgGu8Qyit0
- TLSH T13BB423F0802ED15EA3A3826B764B27BB62D5F4A6011CC46459C6BD671B8BFFFD58C210
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\AssertSubmit.emz.givemenitro
- Size 517KB
- SHA256 afd6f6d8dae2f9dc77de3e86090c436d490cac27c6f8bab968e1f820c84ef419
- MD5 533d45e7c25cd53838f8246b0285e551
- SHA1 da373fbeedfecdc2eed8b18a602bd18e392a1e04
- SHA512 237200c7e116f2ced366cb605c757e103512f93ffa056af5654b00c5e8050bf92dc4b71fdb3d90a08c081d022879a8c5220becd4f02543bda351fc402b1b9efa
- SSDEEP 12288:q7+bSnGaKu9rVxUUxvf7lFRwOrwEEZnEDNzSv:o8+Ga//pFRwOrwgh0
- TLSH T1C2B42380E18C20DA6B93B8EE8897DC2B11965D89B391385D2FD32C933C945DD1BC6BF5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\CheckpointRequest.M2TS
- Size 438KB
- SHA256 75294f42f965441f693fd53aa818ab9128fb2316954a5ef6fee020a9bb8a163c
- MD5 aa07c4efadf805488de3a85a7e51d6e8
- SHA1 350ec7f21c688cac4043e1ac101e9dbb33683dd0
- SHA512 c69edb1ea8de01f43f96dfd4a19a5092f0d9946ad66c1a548884adcd0eb20959ed025f729f4cc60094fe72d3b686a415808132fa6404547a662e12daf243929f
- SSDEEP 12288:bfytMI4anKUD8PHZohnctfiWxyK2dxyPSJdc0r0be:rytMI4anlCo1Uf2K2TVis0be
- TLSH T122A42362F055A051F980FA7BDDCA42AEC38E5C184372BD3EE94A5281E16F84DC9ED41F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\CheckpointRequest.M2TS.givemenitro
- Size 439KB
- SHA256 ab8eb6622a28994347c7839c48149d75668a4de89fb762673c1897388a2f8b87
- MD5 ae652907f42c2cd2c8b112d05126a06a
- SHA1 aee6130a6432dd92a3cae2b005a38c585e97f437
- SHA512 b47b39b1aa9fea6904d40a3c7b3a57efd9ecd1e7a3cbc5122387d95bc7252f916239f795b464b0e4b3e11e2c8df887e5241847aeba58f8c05ec12172d4ff7ef4
- SSDEEP 6144:GFdCjtc5eUBRvOpOexmyTUbyCKxDgM0Au6vzi1dJPtWCW7TKcFWHTJOZuk:YdChI4OexmyIbybg1Au6vGpPtWea
- TLSH T156A423C31D444C9AF7D649A4E1C7A1BB2703497AE849D35A8B7225C3EFF1F194A5CB80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ConfirmCheckpoint.clr
- Size 282KB
- SHA256 e685af5420f4ade53c70924e6c9b6deb4c6c8df098fa4ac268b047c771609cfc
- MD5 43be34e23b9bb6c83a34f0fb9f0748e0
- SHA1 4a130da9021b0bbb07d01133ad03ec165e2a1ce1
- SHA512 6326e7bbe10d5185dbf6e645f0d61b34dcb959f89a1e9ef4f2a2e518b2fe1ce5f720858fa75fdf21c9724bdcd2ac14ffe2fe879ed08094a8c48232feef580a5e
- SSDEEP 6144:5Xi+ji9Ij9yRLAAAZ5giK9AbuCDI3j5VX4SAvd/r33gpuBxehcGSv7eX:5Xi+Zj9y7/V9AbZ2vXq/r33g4BxmcPjm
- TLSH T118542342B0EDF1D9A0A1977A73E715B0155D99750A8F838E2C3C1E2D9C64E8D623D0FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ConfirmCheckpoint.clr.givemenitro
- Size 282KB
- SHA256 0cc8b21e72e95af524a4a5931a4030b5cf9d5172e55578badfce1491a6add21e
- MD5 d6d4fde9128c011f5451fc4223219ab2
- SHA1 c1671c3000f6e83afb5c0bdb74210bf2ad6a7875
- SHA512 a45a61c35b272767a27d6706bcc3e55f3b4e65e9c23e5de027f262dc68fcaa078081f90052e1d09b180fe21ea9f5fea7109cc0905da5ef1611725b10736c463a
- SSDEEP 6144:BCQ9AMUqy5Fu9X8/BWmsAKW5jOuyWn6/ZT4rrj6kglTqjXzciRBM:BC3MVORzKWsu9nMJHkglTqzz3k
- TLSH T12254234BC5D663148D0E2A46A76FACC744F4E56D68F192E3E8C434F6EC7C580D68A738
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ConnectSend.xlsx
- Size 10KB
- SHA256 ff9701e8675505e65c3e6d547a324c876bfeb00178cd89f141a9be522207740d
- MD5 16dd75be617f863c07fe722735529585
- SHA1 e95d09e3f5bff6989f7228e608ddea4be1a18b44
- SHA512 c30749638edacbf8b803ca493b7ddf504b3614c7142d6b678d210cb7a5ccf97a0bb6d3e8fdc0b8b75bd9061b8bd23812ef9fa4c61b934bbafdd0c682ae89f9bf
- SSDEEP 192:wc8mVxYJYob3Ux8tugyR/aFUlbVvevUqzQXpS0PSQA1CMfyXMkNORaob6:wc3PQ3mJT0UlM9z6pX+1CMKXMkURaob6
- TLSH T145228D8AC270451CC3B2947E81AE01D0B54E11C09B86B6DD7C68F5AA5B416D313EF7DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ConnectSend.xlsx.givemenitro
- Size 10KB
- SHA256 0431a120590e90d3f457edba5824a1cd2a203228e953d6a2da96158b40cf5772
- MD5 1fa3d547b4250fbefdfc7e5af5b413aa
- SHA1 2aa866a8836e4219de3af2e3ef785f6e7918482f
- SHA512 d2d1272a0397dd5afd3ced9b84ce8fd8bf7e64f99eee3fb3c9109d1acf8864ca7d8039b45de3ae3be77b057f8034b3abfb56bacce682de65009377cee501e2f5
- SSDEEP 192:PnIbUftrAXXeJ/tS5Y7QMGwKb1zh2XKvBuKxLrpG5ewB92Ndtx:PnIbsUn6LnSdIuQYhGEhdn
- TLSH T17F32B091B68E156223833B7A57BE71BC6D5E8204FDBE97D608040C9E0789D91CE185F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\CopyConnect.ppsm
- Size 360KB
- SHA256 5d79d37254550d3a48265e78a828b8e8a81bfbb029279d63493e21d800003caf
- MD5 5f7a33c1d791440803e15e367f886172
- SHA1 bd01ca27cb7c3293ae615eca26e0afec0d867a59
- SHA512 38afd22c2f60f8644c48da30ec48404cc97b9e77e1e0623afabb4a9e27f772615e8c9639def6e2251bae06c0158d95ccec1809b1418d4cdbdfc462acde1be3cf
- SSDEEP 6144:1dIgCfc/5WrPWRDgGmonXRO5DaIPCOaPfbSbKFvw8x7AhlkCr0/n4HtRZfpYVWNJ:1vycRWrPWREJoXw5u59+bKFYCpCr0/nS
- TLSH T1697422161C8355BBEC7E8522CCD59A7EBAAD0EEBA5B1019D00897EFD2CE0349B055363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\CopyConnect.ppsm.givemenitro
- Size 360KB
- SHA256 b4205bce526143343c808d2a916b453c31ac871ea8d3a4800cf71f846320d8b5
- MD5 75c4d948936459eaf2ee9952f029ca5c
- SHA1 e61f141c26413066871e0eb98d9ae9baaf7a9540
- SHA512 692e1c848aea461f29f11fc22ad7a9e5f84a897b14d0d571b212bb42128d40a91afcd3dea2b9d63f69c1e7514737089455ef7ff14a1321e78b4410bd8bdfddd8
- SSDEEP 6144:UmTEwK4kJz5w8hX7xhA4z2liOVv9ukKPc65fUFPuZH+9fp8LPk6mDF:HAJJ3rnALiYN+cI8FWZH+9h8LPHQF
- TLSH T17C74235B5C52F24336F67B65228E78CCEE64AD94A35D31D8C6E1F25668FC5FB020282C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\EditInvoke.pps
- Size 235KB
- SHA256 1fa5cafd9ebe39091005292486ae22da23af515d8e878c3288140ae4436cbdfd
- MD5 c49946e11cc9841c0574888dd841fa42
- SHA1 caa26daaf7e456317e19d0fead6a51007c4a27e9
- SHA512 0204c2262ab8ad4ec3142adb789beb74423d5c54b8f714bde8157eb1915e53bb7b8c44bc3d22719bf769c811cb56fa10d6e109e642d56a915ff26f5ede730b0d
- SSDEEP 6144:vBs7PtGVngBTM9Zq1OnXMjj8q0AotAK2K:vwtYM1tZSKK
- TLSH T19B342364A043D228ED68CD27FB22C73473365007E778718C80EF2997A91A2FE9DF6464
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\EditInvoke.pps.givemenitro
- Size 235KB
- SHA256 8a522fa0cf24bfebbec3e1df34b4d1f8a02c64f28670bc4b9041ade2e1b65a93
- MD5 baa5c7990b5e3544f62f2d19d8f145b5
- SHA1 830af1d7f0881899b201fa1c11c57973e58750f6
- SHA512 1f8c6cd5dbed2b9a6ca5e175ac6005b6b5f07634f57898ce3f569773bcf97a5f6643775c0ac9f7e14f95c74e5982d66e775c5676999adecd8e4bc6d80404494e
- SSDEEP 6144:j4NfjPKwN3qpggiVO/LIjQjDO/5clQUhGpAGNLh:j4JDN3AviAEjlabsOQ
- TLSH T104342237C176C98D33BEF87E84A5682EBE7E13104DD9B5D96DC0471348D2A20270A5F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\EditProtect.dib
- Size 501KB
- SHA256 d997dcd5384c0a5eafd341e0ff544be589115ddcf9a2489555d0f09f6995697d
- MD5 b6cd0ecd0eede1b2bc411ed660d82eb6
- SHA1 3b53890b9ec4dcfe88c877dee730cfaeb0c52363
- SHA512 17f955a07855e4d1f51fa36f64485c37ee06b7cc9375dd72c218a6ad4b18d1e68687d164f55a8b030cd3627ceb6876afbb3175a8bc018dd00cf408b6fbcde456
- SSDEEP 12288:ecOuM1A7Cxtcw2AjfKpB8ZHWG5TIkND+Gu:ecOuu+qTtZHWw8i+b
- TLSH T17DB4231EBCFD661BAC9B313912F14702627A14613C33EEABED74314C63D566DEEA6804
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\EditProtect.dib.givemenitro
- Size 501KB
- SHA256 64f4f7769737e697e906873af5c0b21ea7b52cc14b9f593fde9a3d25f53c29df
- MD5 cc3eae659ffb0bec0f406a57681580e1
- SHA1 8067ec4a9ae4f25a9c7174d2f2cb0f315a08ec3f
- SHA512 eddb0e37d3c48c305774388568732c8f9bfff6a18acccb592225337270b6222a0bf0b9a10055fc03928e1f13c45e158226e26d7afef8f8d67213557f45dfe8d9
- SSDEEP 12288:f4Pfkk3MqWnoxOWoFibArjnal4Ouu7XrBSDVE/Kfbd3IugyIip:fnk3M5FiUrS4OXr/G3bRxp
- TLSH T1F2B4230A4DB93A732D3258BB7A1954117A4A1E0CD979782AF43377850BF6B343D8BD38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\FormatNew.mpa
- Size 313KB
- SHA256 207a98f9453a6d1097a64ff73a6925bd7e8afa8fce40fdace4b93fe203c3bc50
- MD5 375df6a1f102847836a7c7b201e5b62b
- SHA1 800e1b2375d0e26651fdcc999fee7e9b2433959e
- SHA512 004ba987d95cadd964a58a7624be795238afa500bbca12d5ecb028e9a81e17bce6ffb188f593dbc259dbb7585f099c5abe4131f675618a474388399c9b29c6b2
- SSDEEP 6144:LGsS2XFTVGaRPUPx5BKrqBFBg4CuTF5UP8HPkdx5lMLM2iCCcVuoV:CsS2XTax5BQqvBpOkvIbloiCmE
- TLSH T1CA6423C1736280A550115BC89AE45CFC8FF28404BE1EFBA984D67B22067705F46FE52E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\FormatNew.mpa.givemenitro
- Size 313KB
- SHA256 c153b0a89edec2ada7e598c33f10557eb0c7af35a2b49a0c9c5712fce10e8128
- MD5 a9ed0f8448c1c72f596f7d881d576956
- SHA1 cbcdc5a26f99bc0b40c6d3944234f12cf0ad3810
- SHA512 fac6111644b266404a481abc70f50a33ced752a8935c0e0eb5de7d9435bc5f2f7629df99f30e507957a83df0a16a58065b728fc314c6e43f0a8259f956a792bd
- SSDEEP 6144:V3tXgQOlPgOV1ZPO67Ea28UwjAyDDy6YG7X8X/URMXfMpCzI:V3tQl21v8UUAyD+m8X8KXUL
- TLSH T1AD64236E4A463C46794069E07623BC75A2CDF367606DF61623A18390DE20CE587FD8FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\GetImport.TS
- Size 861KB
- SHA256 6e3ba68794f87f66d86901f8dc3d61de855c55b84ccb7401c3b2526e19c3100b
- MD5 17bb46181de4ac2c90f8e9b555f45cd3
- SHA1 357759446f9e99f2e717086ef499e5dd21a8afb6
- SHA512 9849a768edde924ea1b011367a17345e43055d96cc3b82bb5e03935eeafdea5675fafbf3879e930372292ad2fc9b17e4bc01df24fb8f2370ad58f5c39faa5d82
- SSDEEP 24576:v9fgLXaeY3OTLoSU2sdGfcsjTHIX4R/VTmjnOt:lqbYeTcnhiFHIgFmjnM
- TLSH T13815234CC096560209C9F1DC0F350A1E4973A39638A799F0C58CCEEC61A6F9AEF7A4F5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\GetImport.TS.givemenitro
- Size 862KB
- SHA256 97b5ee44c892f6199e55274f74e49288383b975aa4844ce705b295a676a78e4a
- MD5 660e1e67a3f2476b50bb584c970f8d41
- SHA1 eeddf5069e1acb10be47ceeb3426b74472188aa5
- SHA512 2d55535de249cfd1c5c803de771429970fd8dcc0dd3f1eaf3d8079f5e218b3a67b2cc41bd115359c8dc75a84dea44aaf2f57e002433f0221193e1fe4e7f32339
- SSDEEP 12288:QcsP8KIfHnEr932RGTAzQVIHeyT/Zry1ywOP3MK7x5b5EmhatRjmmUD6ObUMH+9e:QcsE8rSkkAIpootP8K/b504D6olte7Q
- TLSH T11C1533AECAC35476EAF74A625FB52C90B179B9920BFBF2F075C115E00E52A30817E453
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\GrantSave.css
- Size 548KB
- SHA256 2adf343f29196260d5fd48da89ba41d88a6bc9cb3f65e7918380bab80e4a5185
- MD5 edc55a2c8ab983f5d61e7286cf4d1070
- SHA1 7d6787b9edbe8eb45b0625b116289a604ab0940e
- SHA512 d60280de42ab595d7330cc3efb22f20d329ec8c2476ff2975128c4f6e8ad57a8d80426ef8e6824cee609f93a858e048b3a3c703bdcab2faa071f1187231fe2e4
- SSDEEP 12288:Xn5FkNB92Wu4RmO2zMaXXC0qBFqg+pw/m2EpZ7Gzi7XMDLGbFz8/:X5F1v4J2LXS0qBFqVpwupce+CQ/
- TLSH T1E6C423AB4717685BBC88B76F3662C2D0FE6BDC8796813CB314B057D4E63D19A4C0391A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\GrantSave.css.givemenitro
- Size 548KB
- SHA256 2b13d79c6a4878a9c66d5dc242bc501fb294bdfd58a347b6dee9afee3e35934d
- MD5 95116dba6ee51029dfbdc4710932c3f6
- SHA1 cb0cfa722efa627f1efc6c7a8fbdead48ca389cb
- SHA512 6353117da63ce4943ee5caba7b70432d82204791d9fe4731f9e0a3dc23a404f293f8e4b833420d244e2227ff71feeba2c3859ec4abafd65e793039fdde842163
- SSDEEP 12288:fbcX8EwjrbgkDAFhJ2rBLU/1uQKYyjHB5:YXzwjXhChJ2q/rK3f
- TLSH T1A2C423E0BD5B6B48CC7878D49800AD8B48F58AB992ED5340B5DC074BF90E6EE2CD3665
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\LimitUnlock.dib
- Size 595KB
- SHA256 2684b61f438ef44c6bc1b8849d2ad5ca8f2c9663b1b1841cdd4d5af4eee47e21
- MD5 7fd35b0d2c0f51a06f2b31f9cfa31b1e
- SHA1 aec1c8d278abd5bce01c7722e04305a94416016f
- SHA512 10a0a4468c52915c714a613efc88c69cf0ffe5ee760f84a897e738949133eab1c03fd935181ee19eff4b9fc2121af33a06740039f476adbada897c2abc74c321
- SSDEEP 12288:68ntNqelgideG7IQvwQCyEJi5oIs4SJPCHrih:68ntEeSiPFVXs3qHrU
- TLSH T1ACD42355EF49AF344A21CBEC92067AFD53EC909514E6BD87E43E2CA29D53773C234824
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\LimitUnlock.dib.givemenitro
- Size 595KB
- SHA256 588984eccf1468cbebf3dcc03d2526e19b161db87c058b6a113c070fef7136a7
- MD5 ea95c795a10251e215355eca543a69fc
- SHA1 b63898456bd11fdb1f2b01537c79cd42cb20073d
- SHA512 0b1eee9569da12e26fe364e6d21238e196809354a2f0ad5ee8233fdb45f22e5e14206ccad1c357edfe2003dcacbd41594d0b7038aa4ca4dac9a80ad13ec035c4
- SSDEEP 12288:40xF9aiPubkTTSooD2xqrCkTF5Qzk/g3vOJB7FKr94ulBoNs:ZxF9aiPukiiYrCy5AkCsQx4yus
- TLSH T1B1D423D5A94FC912D5421D9E2CB7D5EEE94A46122FA6222343C3FFC6741B3290B38CD6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\MeasureUndo.vst
- Size 344KB
- SHA256 b33d64096bde221e87b5da98ef3a0faa9852cf4ea51a4b89ca7ba69695f11508
- MD5 d462c355f3a0ff5f3e2407100aa798aa
- SHA1 8e80851a3ea4d2e583de1f95651a614366ecd91e
- SHA512 8dc1c8a9fcb7f3156316957e1f5a6924f833f64d771f72d3cd43691d50f7313c67e0db2b51e5758aa12d6c77dd17a30377c7435a0422cbef186413a09b3bdd5f
- SSDEEP 6144:jYLzO3KUt6c9oopeZ2kjQhg5HEQKX7l9Nw5ykxgbN20KvAIpK:E2Rt6WoCC2kj4Xu5DUN2XvFpK
- TLSH T1AD74237C939790A952312F5899B6F0D2F450316E9F068A8A3C2D3149F31DD5BE70A3AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\MeasureUndo.vst.givemenitro
- Size 345KB
- SHA256 e492508beb64eb44b48333ed5b6c47950d1953ca9cfc6cbbce123f2682625455
- MD5 adf6c8e5897e1b320ebce71eb8955908
- SHA1 0e563f622216bd35845a9a65b13094bcd5ef3bf6
- SHA512 4500c04af58b595eb3687f6d46733b9effa4053bd91325ab87bc4d03e61f5c0dca32e03b82e7f0f661a72d88791f37058643be92f0076f0417b17eb80634725d
- SSDEEP 6144:A2j+oukFqpgi37V3KL4bncZvlDIV7jjnCRxry6vfxt+kp9XCmh5Wj0f4GIx:9j71igiLV6LKn0NA7jjCRVy6vfr5Wj00
- TLSH T1AB7423B68077EE49437EDE0CA055E2028ED503B1D2E79E589CC77807E6B3D94489B7CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\MergeCompress.MTS
- Size 423KB
- SHA256 5eac0dcdcf7b44b4143318c3a23cdca28bd9c14dc70e9ce87b3c6df45ba67a8c
- MD5 bc2dde947775e64ca1ba125c9eb6ef3b
- SHA1 e4e9756894b5b18f7ab11ab2bca8401268c76cb6
- SHA512 aa883b4e7d41c7374719bd03dd06473268d110e8bdc263778e3a68ee00a617cccbf0ecb169d386f8e5c43567008a893d64266b15c9e00896eb850dedc3ba5450
- SSDEEP 12288:td6+jzPGbg047HTm5h22NMYbeI0YBf9BL3q8:tU+jbm6zT+N4InP3f
- TLSH T1F2942320D0F0B82BF513D61CA87F4B6962774A402FB62D7CE91BF1852A9757F111A8E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\MergeCompress.MTS.givemenitro
- Size 423KB
- SHA256 9cef3349c0be43f6adb8e5eb19d30f87fbb5ae0a6d3ffa5af96c693b6a44fb39
- MD5 9bc4550f94e4b8e7901003f6dc1d6a6b
- SHA1 4b52499b09049d6c823a3d869fb4c91b67bca6e1
- SHA512 7cf92e813d2675e0e484f33825b33f29d1b437b79aba21f1169b6a8cfbfc524898506ef1604df8970c2b649896923705b282d78ba4d53987821af2e37525b0b1
- SSDEEP 6144:qPxmeAWF5bz/DXGaJ+EmS46tvC+tVaksTQWRieYH7F/hfjlQK+dN2bqWb:qPxmbWzbzNJ+q46iwVe+7r6dRWb
- TLSH T17594237C81639F854003E3E8D2DA22227F6D4F60D8D35D3E1B354D419F76A92DEA24AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
- Size 2KB
- SHA256 b3b8a33f763479757ec3ec3e58cff24c8979ea662a18ad271f214c41ad7b6cb2
- MD5 dec970dd72f9d0da4919564292d8bd73
- SHA1 b4b56ca283d676ab1f5e072015532672bd6c5553
- SHA512 be3aabfc68de698174522fdeec54cfe601f58472b582cbf6148c275f64e093cc6d7c28c4f53fb3d9ace324544540d0a2b9323f0867c170f385a5fac8ef2d7e90
- TLSH T1C841C2115BE5076AF3F6A9729DB367219A3BF808DB54871E0082424C1C67B09C92DFAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Microsoft Edge.lnk.givemenitro
- Size 2KB
- SHA256 fb617886fe63796b75f916eec7f6e6be193612bba54fa91b382b2528967b2e1e
- MD5 dee3c30c5fe50eb27430a1c2fe674f88
- SHA1 fe37e056b258ff299582b0193f81166202232d0e
- SHA512 e757ed018f0c4e3b5bce80f595362f46c3a24eed5c92082054b13bfa42e2d0d838b8c48da123d43218e3807ca00076e2d3d8bd70b3e53c514ebdec4a26bdcfea
- TLSH T16A516DC6838EBF1EC96162C1ADB4C770F7041A8B2F16975E8839B2D95626EC5D044BF4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\MountComplete.tif
- Size 219KB
- SHA256 ee9581b3375a55a3121a05a9d85b83c40a820e9f704034aecffd47eddc377979
- MD5 5a58b48bf81a8974b5c766b47eb04369
- SHA1 ac5efd52496757f8a3f8626471e9e4eff973ab60
- SHA512 8881dcb3541f1b79d64e7d537da0ae98f5bfe2a2facb878f00ddcfd5ea08dbffd716696eb6a4b014b0e39d2f8987a8f4f496e67d4c3dae7c652c62eeaae5e350
- SSDEEP 6144:IZiZVW8BzkViqzibEgZFPw3EwEniFHGLfwp/nGus0:xiczaQbEgpoEdgEifGd0
- TLSH T1852423301FAE7CF09501BC7ABC10DB114271D576991AF2B2ACE6596B2C79F88F096C27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\MountComplete.tif.givemenitro
- Size 219KB
- SHA256 44dd409c05cdb275fe73bcee12cc9bb5f14e8727cf675ed423364d48ec3a01c3
- MD5 a53e0a922c343600076e9b288778e28f
- SHA1 24586511262be05d87b208166f3c54cc70be2610
- SHA512 b366b774a74246a997636bf8c8605b26738c2a013d0256f999b07703bfb35a78e5319e7c287f96628efbd8c0cff151dffc74bb2b831c27cfc5732768605454c4
- SSDEEP 6144:+rAXjt+LXhkDfH8ybqQJc/+jKUh+QDxBkk4fugVW:PkXhkDv8yDJc2eZEx4fugVW
- TLSH T1B62422F22ADB018E1F4C79219641B9044342051687DB7F5B5E7AE3CD14A59AFAF300EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\OutAssert.wmv
- Size 266KB
- SHA256 206d4c259aa36053c72b154d20f3164892615017dd76abb1b71232885b0fc787
- MD5 efc773f5252b9e510be20bd7a8bbb69f
- SHA1 92f68d8d947cd719a13b006d49d69b24a5b04940
- SHA512 04317f1d3ba050b8c12392b4484efd692f2af9346a08864c9ab38b259a73e12fe7ca2ee34edea129f40a4cb43a0430395b6fd576e0f39c083b75d6b69a560724
- SSDEEP 6144:A2eHvXSDZWkx3qrO3CQg42yG0FJshJVOwU9EVfbUSLesGacZAAXIrk:A2Svelx3iuG82JIdYzUiesG9uAYrk
- TLSH T11B4423EA128B18CF1CDB49D6B474C5526D2721FD432800A5FCFC6E24AEBA9D1246F0ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\OutAssert.wmv.givemenitro
- Size 266KB
- SHA256 55fa563697f0a580508b974d732767c1a1498d1f9b16a3c4cdd9425fb03473d3
- MD5 74368a973edc4353742739a5d25e7181
- SHA1 b7df5bdf1e3b215bea8dc8d132494bef7678adc2
- SHA512 faa8f70480ba36094297e1ee2c250656b3a6819bb62b68fc03fb055e53fdb66b4f89d920f123502a4f4c7c0e963a5ae2ad8c5525bcb1ba5809bce35df8530cd6
- SSDEEP 6144:MLejluCgortqKwuz/u19Yf44rcXUmWMaMUw3B0reZcO4tAni:L5uXo9Fu1c4PU8aMzRckcO+Ai
- TLSH T1844423F9A0EA1967D6D8B3DE201DF14CC1D4C7A6D7752022C4D254A0ABEB621239FEB0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\OutUndo.vdx
- Size 250KB
- SHA256 75ffa75c9662aa21ee256e67047cecc42e15c0063b7ec6da8e11b92f13c07c52
- MD5 ae4f84aca42c22c4584d8933bafce84d
- SHA1 da4c4a072f02ac9a346161f4ba523fda4e9a4c02
- SHA512 afac558b42232332d2a0de09618260a8e5d5187324e4d0a026e5a0cdfe07d43cbe7b622907b56ce318a37e2eaff3156bd8ac318d6da6ba0719834557be9708de
- SSDEEP 6144:6zITgD2tkwZ4+JzQW0ZNvBTDd86LT0tVaEqEvYS3kVU1NcD/:KIVkwZ4+ET5Nn0yC3FA/
- TLSH T18B44233369D2ABD4D6DFA6AE098BDDFC4252C3C1701B3A07C5A156C82E924F436A174F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\OutUndo.vdx.givemenitro
- Size 251KB
- SHA256 61d730f715c6f9c9815909eaa5b3ae8740a7b96f3002d391070bab64058a5d2d
- MD5 ca28c290a42b07e46de557149265ecf2
- SHA1 e1db069c04b4ea388f7d42c1e7c74363bed22502
- SHA512 346894711cb22462b19bf61cdb80b1ec734a8ad85a3968d5cc8026b16397a6ffb8adfb330437645a7a016655d7710595dbc5adb2459169aaa14672d34deeeae6
- SSDEEP 6144:WHaYpFV+XpkCuydbOSn+metbyC+rI9F3/tiS6XlFJgcY:W6YpvvCuyVV5er3MtHJTY
- TLSH T1E9442385026BF724B42CB48564167E3BA82E068B8F223D2419C5D5E7EED11C63DF7B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\PublishDismount.zip
- Size 626KB
- SHA256 3b77bdbef1368667b60e02fbd727e6780860d1dcf49e84462782f2ac1c06a243
- MD5 d2b8fd15470ad566864c555fd7f9ae55
- SHA1 e423ae1eaeebb0d822aee37f3832e08e30e8e282
- SHA512 231721070abd73951f8b17b1dd10351a1af3981d933563eefc3a8aa34875192b7b799f75ff09f8e5931c2f600d9ea3596349f98958a41e5b92b56912bd79962f
- SSDEEP 12288:dcESO+lXiUcLaw7ILEURvvNf2rz4S81RL8tGHx96rg:dce1ew0LEUd1f2/s198UHxEg
- TLSH T1EFD423FCB59ECF9B439DF54D22F919F5139B992C166C1F688CB243A788B7E01A24D810
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\PublishDismount.zip.givemenitro
- Size 627KB
- SHA256 dcb08b08565c1ccaa0324e1fae1063e9a5544f32c319978ff0d79843b19d4ed8
- MD5 d931da9d0e1bde0d09962e8e7d4bbeec
- SHA1 1639907ea5a9c04f338f21e57c403c438b6b21b7
- SHA512 33776f073460330aef5185fbe23deaaee362ed7a59a647090aa5c0412d5f6e494634328ee4d45047634e8e8987836a50d9367429d540bdb52d9a8294c93099e0
- SSDEEP 12288:O7It50Pqz7I+nzjcFnPHfYjf2W61vG83WYsROEHd5ihq1NF2VdNsjy:mIt5H/CnPHf661vG83WYsDuu47Nr
- TLSH T111D423A27E71A5E20D527C62EB5C4A885E8F0227A05D379CE5F8BD53E40493BDB1EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ReceiveReset.wdp
- Size 391KB
- SHA256 e287891d2bb0afdbb3aab6bd1e64d4b0c06ea99c2bdc3bf33e7334833c4a9fe7
- MD5 d68b091820ed41e274cea77536e716c8
- SHA1 1a960e1f2e144c1fdbeca913f6b175178119976f
- SHA512 0a58958fffc243593d3c3613ea3e4dc28f98b67624b33e811b61cc9dda9f5dfdf124bb7c205d80420626e60bb7c0567e299c80639108f67a829604f0c7af99ae
- SSDEEP 12288:IH4S0BjsdepEwOHIs58UqdpUxaRqxRbezHdqf/mcXE+lF:W4S0Bj8w85B46+sRYdEe+H
- TLSH T15684231233A77BE51D9304AD71AE571F09C1AEDE2E4ED50F40A9B9066FA3F826370429
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ReceiveReset.wdp.givemenitro
- Size 392KB
- SHA256 87f2a9ea9fd81cc88fe0f9ddbd00bb063bd2a275aa03bea5f7684dd246cd4f7a
- MD5 dfe487e9c6e6c68a0fcf55c2825b619f
- SHA1 d9d94465d384383f71d1782e2141f8e34c3bebad
- SHA512 d749db6aa213925699003acb97ff9b2a86dedb0edca966c3242f47ce7bc9045b5be8a007fd343a3ab9b36611dc08f187c1e3ef47cab42dee2b87707f109c5554
- SSDEEP 6144:WgOBR0ERInMeuc03zzXr1Qdy6FWp2gXQqgaltejgXenKJ4tiOOgjJANAy/Nzpv:WcMeucGz71QbF2LQBEkjtticAukNzd
- TLSH T19B84239A33663630E5F432024DF76C8638FE6AB1E8697289FF58411395D3D57A38A31C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\RenameBlock.bin
- Size 407KB
- SHA256 543cffb69de9efd3f119eefcce7e1f8b1cdad8ea58525cd2345bc057c390831c
- MD5 fe54909806a078a07a7dbc7834e627ad
- SHA1 4a7656963a4f09008bdff7a21ce68207d9757dc2
- SHA512 3672c5060d657cced09048533c07dc6144204de62059d5e364fb5e183b70f2878fd8f0f6dde5900f76e92ea74610e912883ea67581416440cc170e00da489a4a
- SSDEEP 6144:aPr2khOlsyW7CgmlEo3q0BzDixaBQ3UeVTRLz++LaY0fmBmwLulMoJ936gh9xr6w:sRjMEoBBewyVT5jmTj8YMu9Znxn3Vum
- TLSH T1449423798405945AA00F504F49BBB0B0A9BB95E154E72716EF0DCF7CAC6F6B0AC99F01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\RenameBlock.bin.givemenitro
- Size 407KB
- SHA256 0d06ed89c3fc1a1dee63738ed77098a6f5fd1a61e588fa3493c3df092fbc92d5
- MD5 e751f0ae9211e9bcda968411cfa79a6e
- SHA1 7a184ffc07eb9d5b354fc6fee0d93d6c9f2f7a95
- SHA512 1d60f184ef0433a6e0c6da7f5d181865113cb3d27ec6189787d994ca5afd757abfb866127b88ad085cf9eaee1182fc871ef948e391d523a93e8145e6a292bec1
- SSDEEP 12288:8PwrN4mqAUuG2x9Djg5W524P/o+/5dWTU0aS:s4zePGj4+fIAdWcS
- TLSH T18894238B129C34D42CD98AB00973A070FECB05EE6D9E5E2D2B7EB54F1C755B03A1691D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ResetAdd.bmp
- Size 611KB
- SHA256 09da329c210df4ccaab9f5c8b46676353fcc25dcb0f3d5f32711c458f7392fd2
- MD5 61371447455baf50b9e8a037808a57d6
- SHA1 88a9c12183fa8bce19b87b7733725230c15f80aa
- SHA512 52e53f9d538bbff506b9cfcd03e7c09d193daf31f89af9629daaa02e5156631dfa10fc2097e0023ea75f3d41dcd4cdddb8c09454c9d99cdf0285a9b2b1d24ff6
- SSDEEP 12288:j1pR88ANl0DqQikh1rumr0Hoq78ryPC3mNahfCF53XHgpwfIiryOatk4E:ppCADxdzrkoXGPC3oIfuxHgpw1yOatkX
- TLSH T105D4237AC2DF7A965B8ADC35457081F1442B2DB8494BEF4152B29F988BCC3B07A63D44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ResetAdd.bmp.givemenitro
- Size 611KB
- SHA256 b33f32e1fd712b56890e01e6430c396692bc19e2d8d9149a3fb99b6218d39c33
- MD5 26f58a1e880f2f37a4baaec79994e301
- SHA1 f6d843385ada8fa4093e721bc339f73ef010b6c3
- SHA512 31b600c0829c54c8fc616006efe7f5ec93a32723a19cfb0607d1d9bd2e34341c719785b9d80256ada2ee823c53f960e0a7af6aac1b26263f9fd97a32ba801262
- SSDEEP 12288:EPkx19I9ERdRLB+xIQpK3gyA7GQrBRl9K4SPoVBtzeR7L:EPI1e9A8xIQpzqqBRlnVzeRX
- TLSH T166D423E84C4A9C283392767B014661DCBC633B673834E58DE98FF1A97CC5585A5E24F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\RestartSwitch.vbs
- Size 376KB
- SHA256 673be62fccccd9f155df0e8f621f731ddccc04ee01b2dedef4e5e159aba3a044
- MD5 862e0b1c12279b533e879299ed1e845c
- SHA1 ce55c3fedc732320df8be2bdbe0cb9382394869b
- SHA512 49028662f957aae6a29ee67e8c980d0a4400be1ffaa6877868a7c520bcf250892b7b1d28cc4931a3aee2c496eb8db819a4674b216453f1f0239abd535babc4a8
- SSDEEP 6144:lnOzHRXaYoPiGFWifWcTcBp9MJd1H+tqAhT3xFpuBGDZqzIDCm3ItUpJfoGtnI7Y:5gXanKGDbgq1etjTBFpuBG1qzIeg8UQ4
- TLSH T12B84231538B498831D63EA26A8033D73BF5CFD035D46492E12D066929F193DCDEA6CDB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\RestartSwitch.vbs.givemenitro
- Size 376KB
- SHA256 10513ef44fef8628475b228d0912257dd20e88813aa942aa81afd896785f8e31
- MD5 8359d636864cfe2361a9d227d3ce85c2
- SHA1 755bdd8c2745a350e84ea5aa80b519d6b418a555
- SHA512 404fcaf99c233fd14b31a5c3554921f3e562bfde6be87f6a3b9454d6e03ca8cd3bd1d85a35f533e31d7d3ee348703329d790b7ffdd977bf927bc78c80b7ed902
- SSDEEP 6144:7LADR+KtU8h+Eq+t8l5m/d2iVWnFswMGdgvqDVvHx/jQKsHhHGH4Y42AmvT0ImwZ:ADt6e+Nlm16nywMGdUq7r+hqrv0ImwvR
- TLSH T1508423146BE6D844BA34629C43B1BB56166B0BD18CE663700FE2D847BCE765074BCBCD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\SendLock.vsd
- Size 485KB
- SHA256 8196e4cde2657fb16ab506b1b3cadfe11c36d2fa02ac47e1b1613b0ae47b07f6
- MD5 f28fea5a9f1de1be662d589b995dd775
- SHA1 2b10a6db6cba74359729fb90aa67c7ab4279665d
- SHA512 ca940efaa20a05a5b9c9e6ce92d8eaee5f45927c27af964403048cc37831143210fdbfeafa1bd622a95aab986e8b44b1c09cbe6395ecb9b75b9b9f9e33c13f2a
- SSDEEP 12288:kVzPxI0leWBxHaJPUfBmCkyx+3W1wQUhBo6Hs82SWRM5ZfWFI/5:kFPOOBx6JPUf4RK+VLLTUFQ5
- TLSH T1DBB423F807B3B602CD52AC37DC5E734BB74E60D44CAE9F554A21283FE4763106A6964E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\SendLock.vsd.givemenitro
- Size 486KB
- SHA256 f0738b463159d1ae82018dd02f0ea87629e67970e2e881889714c96c765481f2
- MD5 92a59f30f505a928acb43f6bf9bd3d36
- SHA1 5f45a0d87bcdd237f13a5acb3cdba5968e63fc60
- SHA512 a622512777ca4e91238794cb2a1b01094a9c02c4673151f5da3097cb264801eca1f6c02e83206b2ee7fdfc2fdad2ff1e6b11c0fc35533755f66bf328a09e2b2c
- SSDEEP 6144:d5EU1rRoFE8u4FzPe3LTFVFhMDOPJ8CV72/KIV9DF6kRuElOieUCDI3FV3+hGDpd:d53tq9TxiHhhMDyJ5zInxjfS83ptnYrY
- TLSH T171B4236E59B1D4D494BA817FCEBD53E8047242BE7295888B20CCD350F56AA16C31CFBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\SendUnpublish.bat
- Size 564KB
- SHA256 ce42dd81b275b2ab276ec4f997d97db142be3af528928e183a8c99602661ec6a
- MD5 e5d3f94d9636eb695ebcbeb8a519f69d
- SHA1 9509608702ac4f82b43b94ed8fbe55ad50a0d477
- SHA512 f2bbbe3bb4b9d48919384e23ec6186fecd5f65cd5b06837d3efbf207a21f26bf9103b560063b053c856a70ceb066a199c73c0fbd0ba8a93f81e0e261a0044aed
- SSDEEP 12288:4oF1STDjhNZ1WwV/MrU0I/dUpoXCoItsdoW/aDwmKNGFd9:HF1STv515VkrS/dU9Fko+aDwmHH9
- TLSH T19AC423C9373E4B6713DFF44969805A6D59341F8A892173F2AA8096DC7182FC6BC31DB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\SendUnpublish.bat.givemenitro
- Size 564KB
- SHA256 bcdb5b8f5bb00b40e116ee723f7f32dfa28f78e295119d3cbf40ccc63ea72192
- MD5 3e37ade13bdc92041a535abb56060247
- SHA1 652d677fd4eddae61d5737c8d3511b89edc6e134
- SHA512 04cc491f267b21a7107249b336a131f1d6b04a793d0c345757c85ae81e15fe085115edf1a50c7a1fd419aa8e1547c62bb8f7d9b519f33a2d2fa097b8535a57a6
- SSDEEP 12288:N/T0A22jsQBhSppeF/MUZ0fW3kyZA2X5tKAlLssq3osZeDp5j:Nr02RCA/MUZsokV2vKA6sq3BIDp5j
- TLSH T1F5C4234C222EFA3F4E43CFA5FF84CE1046FDE91A555CAB4523D8BB95A38215E7834849
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\SplitResize.vsw
- Size 579KB
- SHA256 c213d1e667d2ea423d45e4c19007aa75a6934ce6ba749e59a2075fd767f3ec9d
- MD5 55e26dd4fa258169a01227bed7e82e56
- SHA1 15464a0932355f24614077a23fbff05ef9d87b40
- SHA512 4c749dee78b8d326e3755948c5052bdecf4cd5d7ca64bd91eb775131525eef89b97035c14261b62d82d399196556521d409cfb21c1270374a3f93511d5770223
- SSDEEP 12288:QfksY5fCEM5Ui9jThac4RqPyqujrGkZcPds4WsEj7z/lj11PWz:Qf7BEMjHURqytXGkO1s4TEjHl7PWz
- TLSH T1ACC433B7D831D0D6F01BBC315D29A2BEAA228F36B9C17613817B976F4A502F0740D5B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\SplitResize.vsw.givemenitro
- Size 580KB
- SHA256 ff8dca6ac13f3170a5ee919af0d4fc2e10bde7914bb2e0209c9f84c8c0381cb2
- MD5 060814ae4b458b09fccebeec9dcee36d
- SHA1 4ddbf90ad44d1ed0806f21daa846f1bd7c2110ae
- SHA512 ecf85c5206c4084b454eda22ae665df8f9f5685dbd272d1a51363e2d065465382e94ab2752198ba203f9ecee1603aa208cc5bfacab7cf9eca3ace6951becfcdd
- SSDEEP 12288:9vdZyCzmvvfAf9rzlKy1iCZI98I4izgyaW4qJH7EsbLAMgvQb9:9VZavwfBx/MeI9L4XkJH1UMiE
- TLSH T128C4234C9B3B4A65E840EA94E4321A5688C2D6FF9259282C48FDC3759B3F0CD733794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\UnblockJoin.mpeg
- Size 329KB
- SHA256 5b98d04884cfcbad80ff173d327392d6e1b2a8c7a84da2af60bb4b8ee16caa54
- MD5 96e82916ebd379afd83a620e9fb9fe73
- SHA1 f1799efdebac7ff62ff7f7b89415ed546fc0d808
- SHA512 0ac939679899716270f49cf796b72beffde1eb0d88fee9dec0912aa90aac3713c8f5aede688161a3401784b9340d956de2ffd5507853c90dc3082d77b3ba900f
- SSDEEP 6144:seWA6YwW9bqIVLVvs5oE6HshoGN6UkzSrSpEtB/BaZR2Mpsx9pLv79+GI:sxA8WlqIVtid+pOFJtv79dI
- TLSH T1146423413B7606A70328E53454760ED9712EC4513FEA09F244CAD321B973ABB99987EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\UnblockJoin.mpeg.givemenitro
- Size 329KB
- SHA256 4389a5f4b8e5b50c8359a3cbe685eee145a7b3ab506c4943f8ba3ecf67c5b01e
- MD5 e6d6c1e4049abe238c045d6eac95b347
- SHA1 29aeafb33d0e8e9b6d7deb2b0fbff462486765c4
- SHA512 5f5308533157266beccb69cd15108352b6cedbaeaf48d0a4e1e54652252c59c9bb536c7bf4757370bd8ef468b07da70d47e3687dabad67de5f1c42c03a7a46de
- SSDEEP 6144:DrusNtEKqW2iB2kCSoVtWIRKgt4MRavnF45oDQwn0iZSHjZh5ZeJzjxPp:Gs5q7A2oot7uw5osc65Atx
- TLSH T18E742311B6F7188E86E83E7EFEC675D14A101108924E8F359B2369DDAEAB450CF2E570
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\UndoRequest.xlsx
- Size 9KB
- SHA256 348ba37a74fe04e6426f7c192f0e75deee52f9f18c67b3a8930b32e2dc7a61b5
- MD5 a7584ae3670e618e165c8b75853162ab
- SHA1 35d265f05afad70a0b870b96e8263d950001577f
- SHA512 403cfdd3a74bb246d6d32b1f46aa9ff8452e141331026d694691754428cf9f21a6444dca02b3bd5a00dee1f7178e8318bb2c8465236b522d2e6d828d4a7283c2
- SSDEEP 192:wc8mV/b3Ul6LB6aFUlbVvevUqzQXpS0DyFBgnjCJo+s+aoU:wc3F3kKUlM9z6pPjCJod+aoU
- TLSH T163225D56F970542EC326C87ED18E01E1B34DA085AB87A8493D64F6DF724119712EF3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\UndoRequest.xlsx.givemenitro
- Size 10KB
- SHA256 929135f4748664d61aab05ebf8df43b5d446aca075f8b8f164c838c469b74607
- MD5 14c4a0175046f0384baec0ad06c54ada
- SHA1 33a5c8e74912347d563c387bf28271e2cbd92e9c
- SHA512 c38d6b5d9656890eab22994be67a4b1b95e9006bd697a89ab285885b08b1d33431c865b6fb6f36a729e07d59e332d7e1cfe4556b0105e6c4b26848f39415ce5f
- SSDEEP 192:K489cKTd4yDHZKTZnhvRvUnLt1m4JiSzYLhmlQ737mGJ7yjy:n8v54856ZRm1m4JX8gloak+y
- TLSH T1C022AEC409EDB61F138C051B83E6425D311689148EE5EB80FE06774CEDFCD2F959E829
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\WaitExpand.reg
- Size 470KB
- SHA256 fcac7f9b03f8846c6780fdf2b94bb030927dd07b3f2a9c9cd09bd90f0a7c6137
- MD5 da5d1a299f4903313ad373195dae1ad7
- SHA1 646f46302f689b68881b65f505fbd8c44dc3d6aa
- SHA512 5a92a59ad7a667b65f3b638c5a7c14878f88c11cf7e8d1833d4ea158e141bb244ed11affb9899c85f02b1bbbfca1de1e42632625110c2d0be8e83f55b1c5e0b3
- SSDEEP 12288:B3euHAsERbRqmgqilkueoeBLQeAiUEZntqeqkcDKyk:BpURb1tuenx8foqrkf
- TLSH T101A423D82779AB522D8C7699B640D6833A344D837D784D5A74BCD3893E28E72423CFD4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\WaitExpand.reg.givemenitro
- Size 470KB
- SHA256 b53ff81eff36fcf02ed07ea6d5320de233fe78b24ad37863eb9fbe0ae8f600dd
- MD5 37b8ca467e02cca9f9b9c480dcb08952
- SHA1 74cb841ef350a605d5409e720385c38222c50d07
- SHA512 f388cdc9ed97a0f2d388f2ff98177c9e21d3ed1421aad458ae97c5213a2443f2596235a88d09cd3ec0953528399f12d087e8ae29e98e4843531e99114e174b77
- SSDEEP 12288:QcwVtp6sUJfSy9usHvN1T0bSD1y3LApQYZQsNVSmmx:QcwAsifSy1vwbpGNVux
- TLSH T16BA4235648D854CF57D37D24923E598F0C1C5624130362BAB2FC0BFA867D7F04AACDAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\WatchUnpublish.xltx
- Size 532KB
- SHA256 c79439874f799d014b4dc5153fa3c779a815722412d7110b51d1d61c27dd039e
- MD5 e362e0979e58ab0095aa102dc3761ba6
- SHA1 86461f3b2030649cd6453f8d9b91b920b87a2a4e
- SHA512 359518d758a78751d78a6f2f70d577894c1d696d6266f12d46aba16a88d547220ee1b8230d97025bce0bc4287e12ddfdc302f2964f8bb277d2f1efd4e7fcbf58
- SSDEEP 12288:t/hk6yY0rF9nJhykpz3jbZFTohCzsaIFDN6Yp5Hsbq/Rp:POtr3jbZFiTN6kAqpp
- TLSH T1EFC423B1521EFA39E002A260B0313C512B94CEBA7DE37515DB566CF32B790E36D9F864
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\WatchUnpublish.xltx.givemenitro
- Size 533KB
- SHA256 1afd01ee12914ea0eb6be35e15d8abf1c5cec004e9c50d8b824580da6c5ede07
- MD5 9e967ca29a60feb4dfc50b4ab1c7f565
- SHA1 41e2d0039ff7fab4282e70fe170cb90678424ae1
- SHA512 49d0699d506ffb18542bebcadb245bc360f5dec874b468b80d1c8d37cfa71002494cce358a26795b7ca890b797b1e30d89ef138a73a40361bf83b90f64ef93b7
- SSDEEP 12288:FqW10ZOtUrtokCMmoFQ7GnQOatFgLh0jmienepESd5SO3:NyYnMmoN/amajmrnepL5R
- TLSH T15FC4239E844C58B7E55BD1688F1F8646561F21B8CB850468A8714EF0B2FFBA878443FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\desktop.ini
- Size 282B
- SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
- MD5 9e36cc3537ee9ee1e3b10fa4e761045b
- SHA1 7726f55012e1e26cc762c9982e7c6c54ca7bb303
- SHA512 5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
- TLSH T1B6D0121496E8221052714E22BD789001DBB1B8213C1BCF9E4680918B18E1A44E632B43
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\desktop.ini.givemenitro
- Size 564B
- SHA256 9b493b62d61bb4220e8c88d20f93824ded39c14a48e5a16040f112f85ceacb87
- MD5 d4ebcd69d315ee45fde403d6791e04dc
- SHA1 c5444d62488aba9963d2dbd0d2a4c12dfbc375db
- SHA512 cc1aee5636441d66fabb90a070ce171bea8daa144a3ad8b4243a707da9114100ec65a234f5e2da1e2fbb84ef99c2a755c30d84b4b43944114f14b5144f95a851
- TLSH T189F09615E45A4E30D1B4260AD94A0A9831CC18982B6870A40B6F7302672D40DB92829B
- MD5 SHA1 SHA512 TLSH