hxxps://gofile[.]io/d/t6zd6iZx

Resubmissions

16/08/2026, 15:08

260816-sh4szadm3w

16/08/2026, 15:06

260816-sgvtns1vhv8

16/08/2026, 15:03

260816-sfclpseb328

Analysis

user interaction
yes
max time kernel
109s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/t6zd6iZx
Sample260816-sfclpseb32

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
75	4036	firefox.exe

Executes dropped EXE 5 IoCs

pid	Process
5148	frozen temp cracked by leah.exe
4956	frozen_temp_cracked_by_leah.exe
5840	frozen temp cracked by leah.exe
4608	frozen_temp_cracked_by_leah.exe
5908	frozen temp cracked by leah.exe

Loads dropped DLL 3 IoCs

pid	Process
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
44	api.gofile.io
45	api.gofile.io
46	api.gofile.io
47	api.gofile.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4956	frozen_temp_cracked_by_leah.exe
4956	frozen_temp_cracked_by_leah.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\frozen temp cracked by leah.exe:Zone.Identifier	firefox.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	frozen temp cracked by leah.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	frozen temp cracked by leah.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	frozen temp cracked by leah.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	frozen temp cracked by leah.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	frozen temp cracked by leah.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	frozen temp cracked by leah.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\frozen temp cracked by leah.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4036	firefox.exe
Token: SeDebugPrivilege	4036	firefox.exe
Token: SeDebugPrivilege	764	taskmgr.exe
Token: SeSystemProfilePrivilege	764	taskmgr.exe
Token: SeCreateGlobalPrivilege	764	taskmgr.exe
Token: 33	764	taskmgr.exe
Token: SeIncBasePriorityPrivilege	764	taskmgr.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe
764	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4036	4804	firefox.exe	87
PID 4804 wrote to memory of 4036	4804	firefox.exe	87
PID 4036 wrote to memory of 1436	4036	firefox.exe	88
PID 4036 wrote to memory of 1436	4036	firefox.exe	88
PID 4036 wrote to memory of 1436	4036	firefox.exe	88
PID 4036 wrote to memory of 468	4036	firefox.exe	89
PID 4036 wrote to memory of 468	4036	firefox.exe	89
PID 4036 wrote to memory of 468	4036	firefox.exe	89
PID 4036 wrote to memory of 468	4036	firefox.exe	89
PID 4036 wrote to memory of 1328	4036	firefox.exe	90
PID 4036 wrote to memory of 1328	4036	firefox.exe	90
PID 4036 wrote to memory of 1328	4036	firefox.exe	90
PID 4036 wrote to memory of 1328	4036	firefox.exe	90
PID 4036 wrote to memory of 3484	4036	firefox.exe	91
PID 4036 wrote to memory of 3484	4036	firefox.exe	91
PID 4036 wrote to memory of 3484	4036	firefox.exe	91
PID 4036 wrote to memory of 3348	4036	firefox.exe	92
PID 4036 wrote to memory of 3348	4036	firefox.exe	92
PID 4036 wrote to memory of 3348	4036	firefox.exe	92
PID 4036 wrote to memory of 3348	4036	firefox.exe	92
PID 4036 wrote to memory of 3284	4036	firefox.exe	93
PID 4036 wrote to memory of 3284	4036	firefox.exe	93
PID 4036 wrote to memory of 3284	4036	firefox.exe	93
PID 4036 wrote to memory of 3284	4036	firefox.exe	93
PID 4036 wrote to memory of 3084	4036	firefox.exe	94
PID 4036 wrote to memory of 3084	4036	firefox.exe	94
PID 4036 wrote to memory of 3084	4036	firefox.exe	94
PID 4036 wrote to memory of 3084	4036	firefox.exe	94
PID 4036 wrote to memory of 4572	4036	firefox.exe	95
PID 4036 wrote to memory of 4572	4036	firefox.exe	95
PID 4036 wrote to memory of 4572	4036	firefox.exe	95
PID 4036 wrote to memory of 4572	4036	firefox.exe	95
PID 4036 wrote to memory of 4684	4036	firefox.exe	96
PID 4036 wrote to memory of 4684	4036	firefox.exe	96
PID 4036 wrote to memory of 4684	4036	firefox.exe	96
PID 4036 wrote to memory of 4684	4036	firefox.exe	96
PID 4036 wrote to memory of 3928	4036	firefox.exe	97
PID 4036 wrote to memory of 3928	4036	firefox.exe	97
PID 4036 wrote to memory of 3928	4036	firefox.exe	97
PID 4036 wrote to memory of 3928	4036	firefox.exe	97
PID 5148 wrote to memory of 4956	5148	frozen temp cracked by leah.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://gofile.io/d/t6zd6iZx"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://gofile.io/d/t6zd6iZx
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {c2e51b17-5d37-4ee8-9ffa-ea8b18d34f67} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {74905a06-c26d-4490-9b1c-ad9753d1827e} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3656 -prefsLen 25164 -prefMapHandle 3660 -prefMapSize 270279 -jsInitHandle 3664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3672 -initialChannelId {3b8dca41-2aed-4cbd-a366-d4913c0dfa5a} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3824 -prefsLen 27276 -prefMapHandle 3828 -prefMapSize 270279 -ipcHandle 3896 -initialChannelId {d8a69523-a552-49ff-bcc4-5e0670ba3246} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4420 -prefsLen 34775 -prefMapHandle 4424 -prefMapSize 270279 -jsInitHandle 4428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4436 -initialChannelId {191a3fad-aa78-4a37-9647-1b571dafe112} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4952 -prefsLen 34905 -prefMapHandle 1228 -prefMapSize 270279 -ipcHandle 2628 -initialChannelId {4ae75066-305d-4534-b16b-2e5cd7e92e1b} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4980 -prefsLen 32952 -prefMapHandle 1496 -prefMapSize 270279 -jsInitHandle 5188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5200 -initialChannelId {59cf4bc8-5a71-492a-b9cc-31bfa5be5b49} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5228 -prefsLen 32952 -prefMapHandle 5232 -prefMapSize 270279 -jsInitHandle 5236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4976 -initialChannelId {d4ff5fc9-627b-4c67-bc2e-ac5894dfd339} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5232 -initialChannelId {298d1655-6bf3-411d-9c61-0e48cfe10b4d} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5856 -prefsLen 32952 -prefMapHandle 5860 -prefMapSize 270279 -jsInitHandle 5864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5872 -initialChannelId {429694f7-b5e5-492f-98a6-8b821b4b33a2} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4492

C:\Users\Admin\Downloads\frozen temp cracked by leah.exe
"C:\Users\Admin\Downloads\frozen temp cracked by leah.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Users\Admin\AppData\Local\Temp\5A8B0E7B\frozen_temp_cracked_by_leah.exe
  "C:\Users\Admin\AppData\Local\Temp\5A8B0E7B\frozen_temp_cracked_by_leah.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4956

C:\Users\Admin\Downloads\frozen temp cracked by leah.exe
"C:\Users\Admin\Downloads\frozen temp cracked by leah.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5840
- C:\Users\Admin\AppData\Local\Temp\19C01E7B\frozen_temp_cracked_by_leah.exe
  "C:\Users\Admin\AppData\Local\Temp\19C01E7B\frozen_temp_cracked_by_leah.exe"
  2⤵
  - Executes dropped EXE
  PID:4608

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:764

C:\Users\Admin\Downloads\frozen temp cracked by leah.exe
"C:\Users\Admin\Downloads\frozen temp cracked by leah.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5908
- C:\Users\Admin\AppData\Local\Temp\A0E61E7B\frozen_temp_cracked_by_leah.exe
  "C:\Users\Admin\AppData\Local\Temp\A0E61E7B\frozen_temp_cracked_by_leah.exe"
  2⤵
  PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 9d77780926a463f522f4f2e3dd9ea44799186fc59a872c31a50920d8ef92fde5
MD5 24c060c1e89e2bd03211e83cfd1d860a
SHA1 bbf45977c80941a17ac4fbf150b339fb49c611cc
SHA512 f4a51f874979eb64051bffe4bb48b193c4b4eb40d8713ee7067e6a86c297afaee9c2f3f778a3aee06c5ad323aff29c5ad62e740e819580e936a52062831115cd
SSDEEP 384:HXkRyiO024YMDL84KKDL849B7SOEAd9KVRaAcP+AWRMAVRb:3mZYMDL8lKDL8CB7S/AmVAf+hRM2Rb
TLSH
T182728F3D4F003CAC25A780ECC5B982AA4D18BBA7DFE6C06D21583D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 73KB
SHA256 de438b0c112e0282faa395f1558d8faeb6a32970e0529046b7fda90425cd3090
MD5 2ce41b29e7a8484fe942181ad1b59a2b
SHA1 72655941ea678e5405b41bbd859d23e0b87d2bfe
SHA512 999fac8065582f6efb7c859ab01cc41638ed422e471180ef7940a603b171402020febdc52f3a5875a3ad31576620336147e1f7afedc828bb619994bf8332dff7
SSDEEP 768:HUyXeyNBHdEUz8Gosh8pGcmhuce6YaKle6EwgO9qbkbBbgbLbP0kN442MyEKSxE/:tXeyNBHdEUQGoshW6YadRN4BMyxZ
TLSH
T1DC73BF90DB1B403FEC1485BFB495573C2625F4614A599B0B3AAC04761DCB3FF2D0EA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 21a4ec7fa8cb8c58972ab8e1681e2d200f6c9101d0cdf7895556a022ef4b98ac
MD5 8d1ea24af7eb28af73526c52e63ee26d
SHA1 86d97efd401f509607803579e8ad0f92093821a6
SHA512 7546890a4511ed61493e2b6bd0958d93b2bae20f675736887f2447e0ffd9d4f981e279e709e2e50a8c4c5bea6307d231ea7246b23bcb29b657f1ff0f413e22f0
SSDEEP 192:KOv5zbowbmlyjSkHMMX1d66JozGzgCl6mc0d:pbowbmlyj1HMMld66JozGzgC1j
TLSH
T1D1D1EB68F728923BC449523BCCA61F410F32396BA84E3F1932DC600D2D566DE769E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f76c3285e7398bf60181340f89f038480b2aa1920e9520fc10ad49a108beace3
MD5 471d1338cb2932b78680a29538fbd327
SHA1 5b377906092491cb92b161cd1fa5c58a5a764f7b
SHA512 30ac3ecfb092ca45d8603077a7f9d99c43103f6b900f135558c4e4954c277cd9b292db9e6cc8efcb0cd8095a2c79b1171b56cd892941e354808471606dd9b7d2
SSDEEP 192:GHMMX1d66JozGzgCl6mc0dIOv5zboPP6ZmlyjSI:GHMMld66JozGzgC1jtbon6Zmlyjl
TLSH
T126D10A68F729823BC419527BCCA61F410F36389A984E3F1932DC600D2D576DE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ec7f26e336608eabfebe8d6ce2edac44641fb287df46da53fe8e14722e8f3fad
MD5 8baf0c1e77443c3b91b9283250555cc0
SHA1 3f84b73d05247c565800fbfabdff70d1cefeb617
SHA512 75e5990569e742ac559f416475108f4e38939263b55793141b4d45299394cd65c0e7a7e0c8a9dbd1b1b5a12f32471d160892980c16aab65e6b3f122b27b9fb45
TLSH
T1BA217F9C3FB48D3A5DCBE29CB452028E53914E0B04871C438E62EF8CCE919DA316E53C
MD5 SHA1 SHA512 TLSH

Submit Download

3f7dd164-90cf-4602-a816-c227c3f4d909

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\3f7dd164-90cf-4602-a816-c227c3f4d909
Size 16KB
SHA256 a9ec917473121226d55c83db0a5b3112b1258422111219ab502ba2ff8343068d
MD5 ec477a9d29cb154f925c90b2144c121a
SHA1 f364f96621b5fd0863632b243ed266ea0cf78978
SHA512 d97bfbf68a527666631b33e71adfde1b53738cf0262d93458619a15e4f43dcfd0305d78eee638594fe0be92d0f78e96422a6c32a7f3967fef632e692813ab678
SSDEEP 192:S0QsInAPMB77j/2xJnzfNOhjGi1Y3Vc4BWCbTF/7VtSzbKECbRiSsdabheRvaI89:S0X91c48CvFRtS/KPbRiBdCdI8Yc
TLSH
T17172D956686045BA8251E368D4F87FC3E5F52CCF4C418FCACBE4BE0869DA0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60aa8257-dba4-4737-a8f8-c7a774e4361c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\60aa8257-dba4-4737-a8f8-c7a774e4361c
Size 2KB
SHA256 d4b3de8406b3fa6222b31ccaddf5bbbbe2a74668f0dffa5654494166146bd759
MD5 14110e16770ae9edc19e3d4b3867550b
SHA1 c5d801cdd865202dd0c87630c499fc9dd22b4278
SHA512 2bff4c9f3d430604ebbfd403735f594de22a46297aa22369dcda6fd15b95429dd67ea11dd6a3a056dcf55ff513336075a0d00b819b4db89b919584e1bf44d741
TLSH
T1F141365C3B789C779DDBF19CD441234E57A48A0704C618431DA1DF0C8C9A69DB32F02B
MD5 SHA1 SHA512 TLSH

Submit Download

b6d96276-afd0-4c35-bab3-dfd4dc843014

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\b6d96276-afd0-4c35-bab3-dfd4dc843014
Size 883B
SHA256 7f2eaaede044e97461af1af1e3e2210d8341c8039db8ee79886ae22db0e71c09
MD5 c1e05d30327622dd9898a3acab005d5b
SHA1 8390bed33eb4952a8afd823fea64d00f8172d328
SHA512 5fbc16ff6c99188db2cc01698454da543c12c2d96e595afd925f6b488f3e65350e36594f87e005b7c771374f6157b71997aae3b75d85cce87cc0de80c1b59b24
TLSH
T1BE112381B774B4B39DBCD25F85863B0647F4B61380C641143EA15B240D7EA2F932B20B
MD5 SHA1 SHA512 TLSH

Submit Download

d20e602e-281d-4d7e-972f-277ebde60030

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\d20e602e-281d-4d7e-972f-277ebde60030
Size 235B
SHA256 db57b1ec34ecfd404b364eb43f1a330876c3b09bd29b13886409df4e04e59113
MD5 5d5e02a7fcc5097d2d78c33684eca8e5
SHA1 2607cbbc1f6437d8d8fa7acd789888f2d0a61dde
SHA512 8516e6bbf41270406ffd195b9040422c0f767c2a6dc1531dedd8d3d17e04887b7dde165b285bc712d559371cd46d98fa707805f591431d3e9b208aa3fe3d63e5
TLSH
T134D0A7C4B8FC775E8D180F1AB0B069E675988C3318757871D6D2457899BA9C8516281A
MD5 SHA1 SHA512 TLSH

Submit Download

d7fbcc6a-8107-4866-b846-4c69218e3dd0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\d7fbcc6a-8107-4866-b846-4c69218e3dd0
Size 280B
SHA256 7692b92468b6628711d744abca13ed8e82e8ebf7db8b931589df4cdfa3873141
MD5 ac1ffce93e965180875b44db1e3785d6
SHA1 fc5863d9778ed043c9c02d3609e39083a5f8171a
SHA512 7afe5094e11d7f504084866154ebd989fec9a74e1cfb122e441a90f408bfc1dee9adf035e5f242cfb46da00d4502e454e01d6f510d2cfae44311b18c28f8b51c
TLSH
T192D02B90689863BD0EA84F17B0F029E739B64C33A0E0585595E20A389AFEDDD819280B
MD5 SHA1 SHA512 TLSH

Submit Download

dedbbb6a-6fd4-4c72-9a6e-45a60a77bbfa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\dedbbb6a-6fd4-4c72-9a6e-45a60a77bbfa
Size 931B
SHA256 e738ea216f5790acf6507701aea7730f7bc5ac467fbc60bf6faebc2ae7d52f7f
MD5 f8afa084cf454ae9d8f296f5e45095e4
SHA1 37741f2606d514d31554baf2e3ba3b98d9a70a58
SHA512 760ae5b6aeeae1061b83c8a79ad0eb69b1e0ce7ad1ff035af6270e879de11485c6f35d8c14ff1cc9258fd39bfc51c68ee09c10a100ba03e91ee822f115b480fe
TLSH
T11D111081AB6574B38CF8D19B94A83B534BB4752380C605083E9617180DBF62EA32B207
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\extensions.json
Size 16KB
SHA256 9cdf39f54f3b0241f0d1c3db9ee78526bceb2b9ebd72e38112be4f650a9fd837
MD5 dea401e3f2d7da3ba5c044c2ec0c752f
SHA1 dcd12f12ed9bd12b3c2a6c3275a24e6eba98a3bd
SHA512 6f4c02a72b9b5c6a4a8c64845b20126cb34266b18eae7c81d74e095d00f16ac93f4287ecf7b41e22e7cfbdbf1a730a0f2ef78b9f0468455271ff4e776b4f1c68
SSDEEP 384:okI4v2UmldvV8dhWk94zH96oLL4HkL4PRL4HgL4HuL4HEx4hs:/I4+RfmXt4Z644e4R4i40404u
TLSH
T12472521545049EB8294FA78BAA367E02C37D433B60845C78F4DD8FC802FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 7KB
SHA256 a6772a906139cc887822f5ba4dff0f4dd44e3f431531fdc8bd05728a41e29152
MD5 b3b8a2a9c2e364d2dedcf68458c021d4
SHA1 81cfdd2f497ea1db2528f93a5a7937f9e8a04b61
SHA512 b0f2b0568586ee58641587d507de3f50f52a95e00336236b5c88939ff446ceb5f5f81eb4f2fb30432fcb6452cb51f2f0835d46b8036c98886a106e26bd55c753
SSDEEP 96:xHBtTUxwPqGq5fg2yt1ObzS5ASSlWdv9jtnqH/8MBw88N8L4cn+wGC:H3CR5fg2y73ASS9dBw88/C
TLSH
T1C3F1FF785508CB7F74B676BCAC688D715AB2013BB7BF68C610BA9488051CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 6KB
SHA256 16d3a739441a51ce3b039e066977d901752b18fcc52c79bc256ee9e587bee6c7
MD5 97197dd40b4dd20e4a7aaf8df2350e87
SHA1 841b9c379361ebf6dd3a07df9eefe540d133c3c8
SHA512 0a64e5cb2bd02d5542e40a64eeec10080be66746a8a787bc4a37647b3e18a6778fcc49fb6b008e168e321390e6bd64f929ec44fb176d5a2008c0195d0b8564dd
SSDEEP 96:xHBUTUxVqGq5fg2yt11zS5ASSlWdv9jtnqH/8MBw88n8L4cn+wGC:HyR5fg2y74ASS9dBw88hC
TLSH
T1A3E120789518CB7F74B676ACAC688C715AB2013B77BF28C710B65488051CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 7KB
SHA256 75f197e26ca3a54a960717fe8cba1701e4d63a1425ec265e16471b6ad00723c2
MD5 0ac6dcd7f855b41a3165eaa459c02c51
SHA1 b60d91a91e2048726f3345a24527704f09db1765
SHA512 b2e1103dfad87e90e32102504cda9d6f27b9adda4ded64aaac8d947984112b500aa30188b2413876881b1507c60b978e267b19b2d3ce934562d7297fb7e89245
SSDEEP 96:xHBtTUxwPqGq5fM2yt1ObzS5ASSlWdv9jtnqWR3Ar8TBw88V8L4cn+RGC:H3CR5fM2y73ASS8RzBw88qC
TLSH
T1C8F10D785508CB7F74B6766CAC698D315AB2023BB7BF68C610BA9488051CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 6KB
SHA256 058722257f7336a6ec29308e261b4d151cb681fbb7fd17a7da833a416678f5fd
MD5 937de8c4b54a22ed0e5993eae469471f
SHA1 976534a1a73f3d9acb450b1f57591180e59b6b42
SHA512 4296540ee0b608ae2497f0b944bc0bb92c6aaac68b981b20704c49db67a1e499f0787f2196e29422eadc3174776641d71f752469d2275409409624955fe94d43
SSDEEP 96:xHBUTUxwPqGq5fg2yt11zS5ASSlWdv9jtnqH/8MBw88n8L4cn+wGC:HSCR5fg2y74ASS9dBw88hC
TLSH
T10CE12F789508CB7F74B676ACAC688C715AB2013B77BF28C610B65488051CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 6KB
SHA256 925712e92e58d239130a0b93ebd226138cce6b2e43645fed072ae3bec4768590
MD5 69153f44c844d4a34772002e69d24ba8
SHA1 5efb96fe5650ee4b7c8f81d5aaadae456b061877
SHA512 0abf67e9dd858cdc25a3c8736ebdcc03246370f000bf5d68cac9cb3a831d8c32104b72e70d12201ba21b9596c11b121e1f61943e853f443ce28724bf16d3a6a3
SSDEEP 96:xHBUTUxwPqGq5fg2yt1ObzS5ASSlWdv9jtnqH/8MBw88n8L4cn+wGC:HSCR5fg2y73ASS9dBw88hC
TLSH
T18EE11F7895188B7F74B6766CAC688D716AB2013B77BF28C710B654C8051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 df687edace60c0612c51004ac8e98caa36ae6f61c029cb220104e82a66059fd2
MD5 e73ef78bec768fc6598a3cd57221c5e3
SHA1 7ab86f3a802402aa09ef39c2882cd1198ca2d9a9
SHA512 b57501dbcee9c1a98fa3acd23ab623d0c3a5bdbedcaf86d424f7a1d3d89a832657bed77da82448a20ea775b04c9b038d14280c1fc3f51b421f451fb9efb576e6
SSDEEP 96:xHBUTUxVqGq5fg9o1zSNSSlWdv9j/nqH/8MBw88n8L4cn+wGC:HyR5fg9oYSS3dBw88hC
TLSH
T1EAE120789508CB7F75B676ACAC688C715AB2013B77BF28C710B65488051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 00e362dfd9ea3ed53d431a7950567431ca4b3742797eda44af5c6b23eb32a52a
MD5 8ad006dc224c4eb29323788faf61d011
SHA1 3c0412bde87fe79cba622d0376b0d4d5581c6620
SHA512 34405e02bdd665c683e4b305f47a9f8c92905081d2581e2658bb098e47089010736344f10a906c8a945bdfb1991d9e8cb44c7eef45dcffdf53c0bcc3e80f7127
TLSH
T184411988271D059EAE38C91CF58527F8C75CB42746AC5400ECDB544AE6FFAD9316E18D
MD5 SHA1 SHA512 TLSH

Submit Download

ApproveWatch.xps

Path C:\Users\Admin\Desktop\ApproveWatch.xps
Size 461KB
SHA256 5c0de1fa42c373b3961102a16bb7d143964e726f2d09afc8684e6621ed441333
MD5 94d0dc7927301bb271360b0889f09aef
SHA1 a75e21aac9e77ee225002b810ac809e5bc6366ce
SHA512 b86f4341c02154437ee41aff80314702ff12da7d3694ece38430f50d85c0a8beb3a7e40f6bb4dc2161787b8d83f777d386f76d87e2158899bab376aba78e4e0d
SSDEEP 12288:2PX1JAtFA5aOlINSI79e9jUiq8EX6cAbggejOOAdUYQoy7:2Pj4Fq9lINS97/tO15oy7
TLSH
T125A42376531C005566CE9DFBA183483FCAED1346AB38628B2F3A0777D9E092467DC94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertMerge.MTS

Path C:\Users\Admin\Desktop\AssertMerge.MTS
Size 436KB
SHA256 5557fbab191e3e5f641dca6c509ed9194232c323c5fae98cd5641a648e5275e8
MD5 3bbc57701fefd5a92fe1fc74425b32aa
SHA1 bb9fa85a73b5fceb9cfda9955972197ba0ab098e
SHA512 e5fb5d792b69952130fbf323dbe08005542f96e8097c3af0dcefac0fbfa57707e51ccabe6c2e9699e74c7025d005112aeb9815deddfbaa0b42e9b83c8b980624
SSDEEP 12288:FQ70WWTsKwl7I80zyiGirAnF7ZlJgR+/GKX0oktI:A0Ot0tAjHykNxk6
TLSH
T1A49423ACB7BD8AC8E4B0560306539D4B9F2137592007BD4E2EE98194393D6CCF9EC6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockSuspend.MTS

Path C:\Users\Admin\Desktop\BlockSuspend.MTS
Size 297KB
SHA256 7a1141fd9c408b2b186afcfca096f28227aeeb23f4079437be72f0d169040809
MD5 3f084816ae054f18758ec2ab6b262ea3
SHA1 57bb3ac331808ac757ffca1db1a2394de3afe080
SHA512 8355405300e143036de4db949f9902f6548f237866c942765d7336849eb3477ebad489e3b19693149719be2f9caae5029f67d831bdca39bf22c34d26d520f3e9
SSDEEP 6144:KY2ZOWrx/x2Xc3azzItiTNECc/KHTwBopMSqjwdnKZvMJ:z2s8x/xUcKHIaNo/KHcopMgKOJ
TLSH
T10554237B4FFB56C7BCDE91F80B769B0D02213D656905422526E8AE930C08E16EF5EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearStep.bmp

Path C:\Users\Admin\Desktop\ClearStep.bmp
Size 322KB
SHA256 7603656391e517e59159e59d7128b24dffce11a6a0e2c14818c1cd1d8901aa76
MD5 0bb295b7cded38d2f9fed7666b77899c
SHA1 070421475e82254917bd473546644d9e1df2f043
SHA512 628542f0f12312c88f059757719ffd3b7bb4746220772dea47d0087a64c9372c412e51c15e7ede5b2db35c5dd75abc6770b5b15b525057061a4edbb778926075
SSDEEP 6144:88r/LAyGVQoutMDzoHuY+a/pV30q8tKsCBoKjSE7y73NMRBWKl5hFfbyo:5jLjGVQpM8uY+aPV8/Cyp3NcsKbz
TLSH
T1B36423C2E45BDE7A6A363F5FB6EA829C4D44C68FB5D2D81B304605AC7097028DAFDD04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseUse.mp2v

Path C:\Users\Admin\Desktop\CloseUse.mp2v
Size 208KB
SHA256 5917c3e2ba890766b22ebcaad8b732409d224aff9062c0281535ffae44ee7df6
MD5 043021c80c6812f57151ea3ebf5e1a56
SHA1 1111de93f7b4ce3092bd602bc180bd6c4248e628
SHA512 24612bc37f693577f4a008ebb5bb1bc16db33781324cc391c826ce8355254b957ec2d392877b8d830bbd486ce90bbb34f5703417948990824a7d70769d3ebd8b
SSDEEP 6144:9+P2o8EeNE6nP3OZytr7j+7ko6TY6Ny37sc:9+UEeNE6P+kz+HQY6m7
TLSH
T1212412077C69488826716DE3CF0D21D26E507E4643E30FB981EF54BB997C928DD78E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyDismount.jpg

Path C:\Users\Admin\Desktop\CopyDismount.jpg
Size 360KB
SHA256 2ce45c3e051a1fd9d65aeee469f8496c7e6563411cd19f2256dc9b2ace0a2f5c
MD5 44bd24038c55a4c85b2f50933711f69e
SHA1 be6a6f85755b9a420288022ad7cb862fdfa33b5a
SHA512 7b1935c321f1dfa401fc98b8f208441e8fd5d0f91b36e1a1abb7fd0704f654ca286c2a620a50fe8c6181c08d74757c94e9a1f77b66f7bfc25912770a5d76abb1
SSDEEP 6144:p0VpRJ8YxC45B2Mn0mURpcLhn3z58cTACL4YcyptoTA8tKsbH3iXY2m/iwINn5kF:M4Y845MMnU+3NvAi4YdoTAgDbyXY2yuu
TLSH
T1FB742332C75AA95A937F134C1C89169409C19EFDEF02223AF7D01EE1D0C5D6B37B4AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugOut.AAC

Path C:\Users\Admin\Desktop\DebugOut.AAC
Size 385KB
SHA256 884e81194a8140b5028df16a21004e1abf5a9dbe882bcf862b363eac769343f2
MD5 be3125b0c784dc805fa2ad7444a7e315
SHA1 a5103b3cbd6eae39f8ece0e075e75bce7b8865b0
SHA512 b441e4ce52036984e993f473bdd4c1cf85a277b2ede845fc58b3d781106e2c9807cc2d854b6e99a886c6d8ba9151bc00a206645d6d024600cd020355bb219eb0
SSDEEP 6144:avo8kJH/mUb5N53wRm9V6TSw6zkS0uW5+Cn88ZXLhbzGfEALzbuwozjqyS:avo8kJH1F3w894okOhWvZbJGvfuwoqyS
TLSH
T1F08423661AB8A2FEF3AC4C5B7BAC208F634E49FF4352E55BC834051E4685534A3620B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyDisable.m3u

Path C:\Users\Admin\Desktop\DenyDisable.m3u
Size 221KB
SHA256 e0c490e32935bd3d4fe52616588f5546431e91f5f6f58815d6b43e9c2659295e
MD5 3babc64187b2a34c0ca00ec774c9ed8a
SHA1 16408cbe703464a0e4ced0159cbf221c75c6a840
SHA512 f27cb29a75942b795fd4b3a956aee7d38b3da713d3a860fc03324d4c6b333d2a8a1e5b276672b6f85c79a8d8b9f25cb39ab227cbd7c50956fd223b8359ab2972
SSDEEP 6144:BLfeeUqOo7ZfZnEBjwZd0b7Tr/K84wWViREXqUpK2p9vevu5:VWe5OQOjwZd0PTTd/UX9eu5
TLSH
T1F3242377F206037C33293C5AFAFE9BE14D03A647BD245EE44558AEDAD51A230079893E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindDeny.M2TS

Path C:\Users\Admin\Desktop\FindDeny.M2TS
Size 347KB
SHA256 4d15eb7acd96f7a925606849dfd17d087e1d8fc4ea0ecc440aa7727f771d6670
MD5 ff68a28f03e98b6d4af7098696dc7d47
SHA1 b3281e427f5a35c58abdd15426acd5c3a9679104
SHA512 c816c7356f5c634e957e723acbc0d3786b7cd785a71b163b50c85c90b691f8b3c5ef01d6cc3140774c23bb7af81ad4254928cee8c484df5ba9e20e075cdc0c14
SSDEEP 6144:rq3Jh/+Cnz4J8NZuB20xaTGTqjMRPueNaSM+2LzMbgtGAHUSIx/PDO9Kz6hi/bzP:rqZJnvNZu1xaOPueNaG6M+9bci9UDzIu
TLSH
T1197423E87963F865955FCEADB9F19C7D690FC0B72090937A03A02AF148A1E0567E13D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindSync.mp2

Path C:\Users\Admin\Desktop\FindSync.mp2
Size 398KB
SHA256 e78751be0b4bfc0529dd66a9a95b6e2fe7f316fa56ca729a635857ea89b2f382
MD5 d1bba2702423e7d0ae8630587ad310b3
SHA1 a1adf8f829869aac8a8d287caa0f941b06f11cab
SHA512 8916ef0b505d985078f281ade6cbc2872270d8a49392762f70a8393dcf4aa56183092b2bec1afc7c1e2582651e5c2ce3c65f7d28636e12108b818e718816332b
SSDEEP 12288:19rRFvDArdStyTTmQXaZ8Wyee6pvHuNnZcr:rraoQTcaUpvHwnZY
TLSH
T1B2842350691E29CBD9110360CCCFBF067AF6E3E565F99B6382C107C9371A09EDA57432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeFind.mpeg3

Path C:\Users\Admin\Desktop\InvokeFind.mpeg3
Size 486KB
SHA256 7a7724d43339b4df784e668a13a5273545fc5be06edcc20fe8199faccdef77f6
MD5 5280b2ad5a74107c3ee2cb035eaaaa4b
SHA1 8dbb2daeb09cb8b16f9c45d6adc0c2305a915efa
SHA512 81d1e349de379008ae5195dd272aad77c3b374620bc26d1f7ad567971536d76ffb6fd8f4cdcad49b11e51054e081684fe107e9f2577997ce31e567a9fe0bf644
SSDEEP 12288:PDt4N5KFdPC7HHg8an8L+yKgVxrJqhdy19Gl:LtPPKrHgMqyEn09Gl
TLSH
T1EEB42334064ECB06594EFE45F1224C88407139BBEB8FE2D8A45825DCD97E6F8B923C76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinRestart.shtml

Path C:\Users\Admin\Desktop\JoinRestart.shtml
Size 233KB
SHA256 8460730d585263f11dad1787b5b09a5e72c24b5a3f3e64a29ef6244d45acb47b
MD5 df150fe62019aee68a25f4148012334d
SHA1 f1c27a7485ec7a58e4ed9555f94d4e06e4f08ba5
SHA512 223567dd7f493ecc9ec34d0701c23af9714e62dab88d555deae990624729b2c5fc64d694bc6e699d15b0960952f047b5280a659566fbd2ca9bb0955b320419f9
SSDEEP 6144:BwvFXdEXTeo6taegNOemb6sn2EgMf2/VyO32On:BGnEDeJeG6Bt912On
TLSH
T1523422ED2007957B08EBC856442EBA2D7DEAF5CE8948F2134CCF165BDD633D546084AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinSplit.DVR

Path C:\Users\Admin\Desktop\JoinSplit.DVR
Size 284KB
SHA256 6cc02dc03a8ecdbdd9d51e0182b1338a0c99785713fdbace5f9715a5869b24bd
MD5 f90a72ba4ffb11626330b5310c21c08a
SHA1 cebc90ebf962b92cdfbb53f20e3e094a5577fc18
SHA512 064323f3235ef480b323c44477aaed2435f1b10c334925ee6577ffb5b03396323d744901fadfd085694597b3850f4bd76d508b33506ffa95e20082fba9a0021f
SSDEEP 6144:7KYiRxJ1OYLsMOtk9LQAjFq6D4fwmD/VevnBgbCNt0VqSZE49R1+5z:7KYiRdNoRk9bzUfwmDNevBnt0VHHR05z
TLSH
T1EF54236C98F9A315515DAD2078AE7A2F831E7A188C3671257AC74E7325CC73060CEFE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountFind.lock

Path C:\Users\Admin\Desktop\MountFind.lock
Size 183KB
SHA256 f9b88bc36a49912e008baf9fd3dba95179bc0b2451b0f00f38e744d26197d829
MD5 f369c292ec5692d6927ba529fb585f5a
SHA1 76ca2cfd56557cf4ae98e8b73940f4e7d7e70e1c
SHA512 00dc535c6eb7ece5d80888a385137e47b120984e1c0329ef5b87f7e9be423822fe5c82eb84775a1a3e01f8c2bc4dd997f886814117af2fa6f1bd08959cbc7c71
SSDEEP 3072:ZUQOMdDieFg9ZGWANhRPmB+Dd6rE7nVIQcu08v5bJI8y+RKDXrvIblj:ZUQOMcEEAbEAJ6rE7Vou0UFIvw
TLSH
T1AE042304162BB98CACE48D53B365D6D6D5284FDB224AE88CC543B74C64A83B3F4E3D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopConvertTo.asf

Path C:\Users\Admin\Desktop\PopConvertTo.asf
Size 309KB
SHA256 58a0a5460612823edb34846f7ef78616a315aa0c5abf20d607e3a44bede86b5a
MD5 75e8f8fce7ccaccef1454bed8649d8eb
SHA1 3201c4819a577659bb3ae12610a7d1806395379f
SHA512 f3cc12b59900dbb3ad538f947321ee851488eb2d1df28657cbc6adf57f3cef492b12fc89df962d7f9040354d8eb05fe68898513abbcb6e48295ca420594f258a
SSDEEP 6144:BWEWZhNCp0sKKg7qRVqPXUmAmDkxpktTfSIP7sa9ZN6gK:cBYDEqRVqvAmD6pktT9suu
TLSH
T12064233C93CFC844A763CB915AD2F38E15BAE7BE23887B17178E05595925D841F233A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectOpen.mid

Path C:\Users\Admin\Desktop\ProtectOpen.mid
Size 474KB
SHA256 d52869fdd90f8669dfe366b27df0b1e0121c22e4fc04aaacaadd6391150a516e
MD5 7c3225a3ff2cd03f358f895577465714
SHA1 070903ad827ac48f0414e7f9721f53a276fa2b93
SHA512 502af362143aec915f7477197ab23492316896c59eba3e26a52cd11cbba1ee9d8f3368d1e8d26704fcadc584c6e4c5806fd2bb0ecc1d8453c7f29f7eb3ee54c1
SSDEEP 12288:uBQlHV7wk19Z1myvjSjeZ+1r/f8bfK6DiAZBikG8YJeHW:uS9V7w2vvjAeZe/f8bfaAZBe8Y/
TLSH
T136A4231ED02A917E7D5FE9A8AC005287156E1E2279421DFD39CF88F53B8BE3E1717062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushResume.xlsx

Path C:\Users\Admin\Desktop\PushResume.xlsx
Size 11KB
SHA256 a4fe14b021c6c8522dc34524df6b603dba0fdd451f8663f2da8e131b6b617651
MD5 a8efeefbb476ce769637d84bd50496af
SHA1 bb36132365d8fcb8cacdea44da6e3993c19d8084
SHA512 295a9b2c470894ea730ad06c84ce66de9d094fbe9a8ad60ad0d9f699f8c0ec3f9c53d349ee71780772fde82b5bbb5c2ce0a572ef67cd6dc1fb9f2f08c18ccbe0
SSDEEP 192:wc8mVf99sLzb3U1YjowuU4yAaFUlbVvevUqzQXpS0m5xFDZipMghDaoqy:wc3BsLv36YjoxU4y9UlM9z6p+9DZiphn
TLSH
T1EF328D35F7609474C3AB847D90CB0BE3A25D208246853A8E3D39FB99568319762E71B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRegister.vsw

Path C:\Users\Admin\Desktop\RedoRegister.vsw
Size 448KB
SHA256 71dd77fc07cc90cd303c2a9b92047c698300afac1ffc66cac34c5e9e67eff94d
MD5 37fc0935342c018ba044bd3df9602ab5
SHA1 76184cec9381a0a9a56e846cad9d7e9baa722702
SHA512 706b138ad1686e81529dc9ce09a2a05906284b2125992cbd6fe47145bbc1dcc720422da35d1ae85fb640e92fec9e3442b05cb376bea6e75b273e7d5b6314e343
SSDEEP 12288:xd7J2tioANlxwKAnmshzQLGjMAJmS7Hhe:37J1lZAnmRLGUSY
TLSH
T1D6A423E4A231B2320C7D71C1EE9DE3652F9218D89F6F06B972D57B036EE6B040075A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeConvert.xlsx

Path C:\Users\Admin\Desktop\ResizeConvert.xlsx
Size 10KB
SHA256 a26e30c3a91dae173b1c36186a55bc76f3a247e1b0e18b5a00e36a528e51e103
MD5 9f5d07074ba24a46940129c65e5a9c42
SHA1 691f86a4ab5e7716f0c5d264639ac77bcfb9945f
SHA512 85f798b34b176354679f00e788287f8cfff2076715453ac2792ecb3041f860db975f7b32255344152d2e1ae46741e5c5068fef6c76de9fa5db6c2ad1c427c74b
SSDEEP 192:wc8mVm2YCGWb3U1pCPpyM3qaFUlbVvevUqzQXpS0HWRvm0Oe6dgsAvdxmaoUR:wc3Bf3jrUlM9z6p+R3OeQX+dUaoUR
TLSH
T17E227D4ED5655869C327C43ED1CA80D5AA4D90D14A462A157D20F6BE23C21A713EF3EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreSubmit.docx

Path C:\Users\Admin\Desktop\RestoreSubmit.docx
Size 16KB
SHA256 3d72547251d12b6e1b541c211028be4c9ec1a616bf0e24c0d2ab9bb4e4ee6bff
MD5 90dfc0d72ca32616bef992e52ecd5147
SHA1 8936ea60de7eb4fb9a7270623434656caeb09b2d
SHA512 0917de1065d00078bd01aa0ebe5acdda3b9ea1ec6457ab261ecaf5e3f626a0a4933ca6682f0ede955549f9547e57ff0cd83e7d67f31000401c5fed685d642502
SSDEEP 384:aYfJjRsiFjZpjBDmADp+pdNxt/ZtNNHuGIFHDOZD41n:dJRLFdpEA9+xxllNHuGItDaD4B
TLSH
T19C72CF39FA4118A1EB938ABCE15933FAE20641423748D5CA32CD97AF97697D307436D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectMerge.scf

Path C:\Users\Admin\Desktop\SelectMerge.scf
Size 410KB
SHA256 b13b32ca7f98edb44d8216764bebcd8495b0868805121e06cac00f3b36dffa60
MD5 1109615a0121bb8a25db281f77bd3a63
SHA1 43ba7efddb873349f5765937b9185a9fcac88d48
SHA512 cc7c34a16526835f24cc5726ce825c1fad52dacb5fd4a1cc7e8812977e9a137ccd543bb4fc356e0d1710d313f02abbcf8987983f72c1d3c96e063f5677519f6e
SSDEEP 12288:ecUjYYX+AQjGl7SFrKP53yAzi0UTwwhNim:laCL9QyKnMDhom
TLSH
T1FA9423C16BB1A3AEC7B3E949DE0E17501C9864434C6EC43982B8D79B94DA5C60FEE492
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowSuspend.ps1

Path C:\Users\Admin\Desktop\ShowSuspend.ps1
Size 195KB
SHA256 e9194d026f94e9c66a0cfabe272aaa8fe5f3bdf292f758f2aa80c5227bc30ade
MD5 010d39c130ce38f5c5bafde332506b2d
SHA1 b63e4c9b8d1ee673d7073c30e196075634b1405f
SHA512 052e97aace2204a5d1e22d51d2b4c1013c333d2a55f1e85230c627193c37758a735d81c554e36973f0bd6909080a9a98a1b7876b29f91b7dc63cb125d74adc63
SSDEEP 6144:W74RAFOfrEXKHy24kJOADiD04IR2h8oxKdm:W74afZ2DsADiERA84t
TLSH
T1741423FCF12C0672768677EBE6E8BD580DCD60D8886720D2D46730825ACFD9768AC54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitPush.3gp

Path C:\Users\Admin\Desktop\SplitPush.3gp
Size 259KB
SHA256 508e1f73469992efe27f9be52957aba71d6e2419502a51164a7f86f9a6bc5c78
MD5 2c4376b528c84b4a249ef4cf46af5c5a
SHA1 c24c197be13007e213ca73eae6f17991d248f3d0
SHA512 d1f1ff73ace678721140ccbec5bf83a759911ead43ea251260c1a9cc97defe3e4d3168772b3b6bf39216ec09a79e722ea793723a0eca5e1afc30a944c5a95458
SSDEEP 6144:E5ZnNeR6UamX8vWDymrHvpZDk0IQuBBubjlPc4o:YZn0gY8xmrvpVk5QuBBuhJo
TLSH
T17F44128086DA1E3586B995B38504B6AC09E0FDDA5AE0D49BCB69D877DB343FF190007F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceClose.vbe

Path C:\Users\Admin\Desktop\TraceClose.vbe
Size 335KB
SHA256 ef411163712243711480ce916edd9622fb51663d523b87b44a728026d152a6a1
MD5 3abe02e20d17b09105b07fb7dc273306
SHA1 9c3b90c83e9e00720e09cfd7169a5bdd3d00a35f
SHA512 553faf1429c3519cecae395736f48fb312871db8dbb5591713e9bedc2978b32866ef3a9418c8ed658d0f523d36c6135e9777cbbbbadc2d1e0282fb8bc8f0f4a9
SSDEEP 6144:EqC6FNsX5UG3ll8Q8vNeSJEdKk1JpWmSgE01sI7dD4ZELZwlOgxJzDCta:E6FNsXxlf8vNeSFgKmVRsIZDzMOgxJvn
TLSH
T14B7423BFDDB7A0053A28C348E51722DA088B457E979C98DA1EE9295F1C73A432117C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallWatch.vsx

Path C:\Users\Admin\Desktop\UninstallWatch.vsx
Size 170KB
SHA256 a3d1879624ce16600bfe3d9a505e9224cf58a4048a77ec74ac3c77801feec2cc
MD5 d6533ce1b045dd976b374bfd2444c14f
SHA1 7173a9369e13f35eca64601523020f5d459bb2ad
SHA512 0acd1afbc78682bcfc26f11b7916afd0b79c35f0eca5f8be627861664d25109dfdcafb13d2c9c22d308889df155bf9c20f96425400c6e11e2e1bf7a35187e0d0
SSDEEP 3072:NZ6yEVWuxmBTz7D4C+H8Y1IadXb19hTV1QAOeFdh6pemI+pqV83rp:Nxe0X9wJ1f7V1QAO+Kg+4V87p
TLSH
T1DD041364A192B11F2F620B78DDCC942DD58F1C2A63697C77802B5243D2E6A3FDB365A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishComplete.svg

Path C:\Users\Admin\Desktop\UnpublishComplete.svg
Size 271KB
SHA256 10fbc353a2123ce224e8eecd3978d0325547999a57ba71992f4f9153036e770b
MD5 69ece91537646a8875e852e3189f5a84
SHA1 a9d8e7cb9cbdb8637467de33699275cc329facaa
SHA512 2a200784dec678a9ee9dc511563562ba583321004eec3c86c50fcb756702de3fbc63657e1d5352ef1a14c70869e66ae17212f35d5da9a5a4c490fc72da847234
SSDEEP 6144:1XZgrqBazU2GqBiRDRepnXzQjHAV4qC/nbHnTdkh+eFXFZYBw:1OqBaFbYuDgqonbHnTmFXFqBw
TLSH
T1684412DE3BD1C6380B36EE9BBC50605C9E8946417D2E89B984F27683C864077F6E6F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitResume.DVR-MS

Path C:\Users\Admin\Desktop\WaitResume.DVR-MS
Size 246KB
SHA256 15d2f13b0bd7f39565280f6d0523f90aa10b9ba4255cfe3371ef596fa0d8f777
MD5 51b19e8a31a616e02e636753d37f726f
SHA1 7a473c393d1db704003e2a22159799ab18f78e7a
SHA512 69137141dd917c97758eda81d36e234771f8caf37f61364cc8c264b6d5f76e176b36bef7657b2eee0cebca308dcd9030fbc739bd0d52c32d6f9d136a7fc2bba8
SSDEEP 6144:xPI2mmLNfsJwXtC2YkLiz4BxIgxF4+N1YhlVyRO2AvobsLNf7b:9I2mpJIs2pLHxGQkv4sLNjb
TLSH
T1B33423415035D56E0E78ECB67835EF1AF7BCD2238E2D52B44EA296086D5876E83C8FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareStop.dib

Path C:\Users\Admin\Downloads\CompareStop.dib
Size 950KB
SHA256 1b2ca201b35330d841955ca5ba53bc4bc39cd955cf8182afbdad4fa9c7d357f3
MD5 9b5b2bc764023d99f9073856f6ecb74a
SHA1 f0b5fe097252f5a9fed92173b21a35a361d8d90c
SHA512 9ecf3808f584bfbe34bb6c6cc14c67168661645e57d5c0d06a1d2762eeeef972c938241af07b3ce158d6f24ed7fb5c2611643b56065e224c0fd84c2000d0c0c0
SSDEEP 24576:/b6J3wTrWoFQBVvFFeS+5dJpOyqtSz0UogrzxxzfN:/KgGoFQOSCdJplEM0UjffN
TLSH
T1EF2533CDDE56EA72D4436197CE2640BE9CBAB4143BD5EC9AC3ACA03271C96660CC2CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyCompress.mpeg

Path C:\Users\Admin\Downloads\DenyCompress.mpeg
Size 725KB
SHA256 41209c87a2051530f59816b326b46e8d19bec6594c5535ab9ef531beb947be43
MD5 010f31edf8b6ec9c9dd4b7147a30a6c6
SHA1 4cf57e9d04b936e9aa39f1d78db44aed0060293f
SHA512 f991601ed08678a1cb26e20d517684a7b561e10f7734756cfd10b7b202897f2cdb23a48a2f242250dec1983e37669f4d8d0b5c9c5cb8a0bb249d968c614afd2c
SSDEEP 12288:ONDaMAtHnWx0M1zBkxQZpAB0blefdFxto5W7AtksARFknJHeX2Tmu0W6nixvM:E5AtS6xQEB0bleFe5kAtksAmJ+X2TqW4
TLSH
T120F433448B4989082CAA9E5B740CFF4A27DF5F3FA133E71ABBA140D189CAC6EDD50D51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectCopy.vsdx

Path C:\Users\Admin\Downloads\DisconnectCopy.vsdx
Size 575KB
SHA256 5d42f3c9457cf2b167c765ab997a7af63d9fe9cb3dc7c5dcf5330f1e5c765396
MD5 edc6a1f61037c32bd99e8ffb61a32e1b
SHA1 f21aad7fcab1c3dba068747932922e4578a7a049
SHA512 8b3903e8aea03333fe8c1507c58db61cdcdf29fa0818b51e510e45893be344f72bde065d17b3f12647a6bb47d6036adb7aec33d5d1bd7ca3bbc1055c358412d2
SSDEEP 12288:pA9mUaDdq5CDCtYgae8fy/3Ziv78bPnO7Pm6ylskJ9i9tg:m9mfIl93A7+27O6yjG9W
TLSH
T16DC433FBA64061A671E75CB5C005B7A945CC948B82D886AFCF0EE8472F34FC34E6E525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableDebug.mov

Path C:\Users\Admin\Downloads\EnableDebug.mov
Size 1.0MB
SHA256 28d59738b5ebe11d9afd6728c9b6ffd26ae963e7ddcde1cb96e37f4802127a19
MD5 aa52d14a721a7ada7ca0b02d77bceb69
SHA1 a7fe114661192cdd5ae1318b5ba09c7e4cf96f3b
SHA512 e4f441cdbd1d4793b055d2576f09949504fc69dac23ef40639ac6f3581bd7d6f804b788283184b457fcaf503da6e719ad7912bd4d686993ff4eacaa143531592
SSDEEP 24576:T69vM+GDyFoKSqRgtHtHD3jEfZGaRSRANZyQlnmpIX5TTtCdSNRog7QFDc:T2U+G+iBhJ3I/oCN9lJXCdSNN7Qdc
TLSH
T11435330678BFAC95743DF6A49CE7FCCFF0A52B1B987DBDA528E192147B01961660CC02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindConvert.docx

Path C:\Users\Admin\Downloads\FindConvert.docx
Size 525KB
SHA256 9a021a5dd9c1ab4633d198afab2fb09574c19e0d6b05c23734e52611f4502da6
MD5 ad35c2e8637215c75aa539063849c287
SHA1 f3f114f35ba50a58fb2293158514a18766b58c4e
SHA512 01bdf317b14cf29250a802fd0d93c852d3a7016bfecc1f5c59dfeefa7d3512c8aef8629492a18c897791384ac7d50cdc2251bda8d93184783b5d86de0e06ff7a
SSDEEP 12288:MdG+Pw7PVvGM6lsLleZRoGmLSSt1E5kUtU+hiXKJ7Kgxirp:Mdzw7P1m6xeZRoGmL11si+hiX81xirp
TLSH
T11CB4232006D866936987E435D0DE58F7ECC900E16D8798FBC611D7B6A516EA00FFACF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatAssert.svg

Path C:\Users\Admin\Downloads\FormatAssert.svg
Size 550KB
SHA256 92920bc82fb50c54c46dce2eac5a9c0340c099e69e164bd23c25af5e4cbf5a4f
MD5 4916f1c16fe8ec751c711c9093a2e044
SHA1 4d91ac8d8e6e769505c82d7459d08eda3a492c19
SHA512 bf78801b7f6a6510c76b37bcdb8a772e1a5c7825406ec7e96f106ab7746050a3d19f336628ff8b66d35e6db47aa2b3a4943315ac81e4da6baad06d5b1dc35683
SSDEEP 12288:PL92CgaJp8ht580AHBay8J8vUO0v0jajqJ0Y+oJ6+SFsX:PL92CgaS80GBaxGvT0rC0XovYsX
TLSH
T132C423D699810AB39731305F5EC2318BD94BFDCE14BFF6099B241C43C3126A1968ABE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSplit.jpeg

Path C:\Users\Admin\Downloads\GetSplit.jpeg
Size 750KB
SHA256 a4ee9e5bc7da9f3444e11d1295f1267b1bc656f73b8ab07938ffd9f2c9227b04
MD5 44006a864118cae749083beb6685e8eb
SHA1 f7b64adf17de12d029db0ac5931cf5eee57e7bda
SHA512 b55cec152baea86765ca2415bf830ddabd30dd30fc993ea58c08bae5549a4fa53e8ed4de5a95b557eae6e0919496badbdf184435a9a93f2c597fdf2a904cb25f
SSDEEP 12288:Qw9aKdj4VkHCukLzcu2JnD3ThocBS4a+il2w9zfXtwGC6VCNgV4aXrj:Qw9asj4VlIuAjTKc73wbzfGb6T1j
TLSH
T120F423A81EA4977461A31CC7CEF0F661067D8027BD8C59A2BDF6134EB63D819354E8EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptimize.ods

Path C:\Users\Admin\Downloads\InstallOptimize.ods
Size 1.1MB
SHA256 7a3144f8b7b69eb13560fcff8b683e27747d1078f3abf60b26166226d2baa4c8
MD5 d19d63233b6ecbc832a2a47b95a82909
SHA1 3ad920873b51fb65b893531f400d46bb55c66401
SHA512 d55df86803ba010603581a6bcb3d80d23d40dac77870efe4885dfeb50d57d4ae3fc06ed6fd7245b65e82ddacf65eeeb89ffb9de23b45dd32ac65a1562604444f
SSDEEP 24576:oq3eXaVJmHylyDTLAlDdjEmz19ETU+DAaDH8L+Pod8TgqYaxTHt7J:oq3eK0z/El+mB9ETUGSkO8TgqLHlJ
TLSH
T10835339952FD146174913EEE80A355ED12F15E3ABA049E21FF8DA08DAF1E97F0B940F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitUse.doc

Path C:\Users\Admin\Downloads\LimitUse.doc
Size 775KB
SHA256 001d7f17c0d9946ae57228333eb85321042f9f504af7b3c790a4d6d3fb0116c1
MD5 7435926e0a4784290217aad98e4956c5
SHA1 d9036bd8d3d5ae6d811e5601ccbacc0ffee21f32
SHA512 fe7ba0638039fff70a706781517e514ee190a5ea699fca1e7fddff8fdc7f898fe79c95f7ffce7a6e01e406c25d205ae151e642a39997ce4400efd659904fa2df
SSDEEP 12288:nTBDnwrzwiu5NzCAzr78yH7ZXN35bw+l9q7n7kHnyCDkLXYHW6Lt9zuBsNFKiX:nVbriu3hfQexNJbw+lMYBDkx6L9X
TLSH
T1B3F423D597BB352C7CF18ACD46632B41C1E7232FA07BC239A15D38999A0D0CAEC45D76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockComplete.DVR

Path C:\Users\Admin\Downloads\LockComplete.DVR
Size 1.0MB
SHA256 efd9e4691a3c31048dd0d5a8bd96b7d0bc9debddbb701b3ad4c668513aa0747e
MD5 9a9d92078407d1f604362a904b1d1f3b
SHA1 ed3d000b6838f8ede1b908cfb2a376de79ff01a4
SHA512 7fb5c74e1f35c6640ea48f3689dcc70808bdc1565e20bb880c5c56f921b1527426109f9c32852fde0fae38d7e372dea145031bc8d951dca6b6dc822a37aac7c0
SSDEEP 24576:BvgOuE4Vxh3OWooaUOmQZviUkkv5STVtu3NOrv6ntrm7n4:BHu9VxxOr6OmeiUkkBS7gNAbn4
TLSH
T19F353351B8DC283D428694A127059F87948AB6E8D8AEDF7F380DD572DE22BCD5CB3430
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockProtect.cr2

Path C:\Users\Admin\Downloads\LockProtect.cr2
Size 925KB
SHA256 24b055d669c4808abe3c6038d671d3453ac59194ccae99c09d75f171849047ae
MD5 9530efa3ff69834298896b077bdd2ea0
SHA1 41e24046d424ff295d3a093f254897bef64332b5
SHA512 2fc456e189f3f1b3d5e57ba3cfee19f4a39ab3a6d63ed4424639e67f910a109e8f126601412a4b0777ce49e0016ed699cb2e57b720472983394e7458a4d5fb8a
SSDEEP 24576:/IuN/hSh6wGvxeDRUT3lE9HrPHIIeiERH:/Imh1/vYa7lULPoIedH
TLSH
T1C51533720DE6F1B6AD06FBE048A83AD98D93D72FDD34706B0C11466E6808DD28790DBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureRedo.wma

Path C:\Users\Admin\Downloads\MeasureRedo.wma
Size 650KB
SHA256 4f623518482457362edab0decd1be08d48f4176d74a4dfdc9aa27671d86520b5
MD5 0ac6ddb3a002017d9dd11b06c7a96532
SHA1 89ca73a237b449ceb6743996bf71631910788581
SHA512 292cfa8550f7f7392a582ba86517555e49039a61b70e25d7a4920bce18cdc3b71855b3733a899c8a995bd9610df416ceb5bf4c10502d7de43b8574bede9758ac
SSDEEP 12288:NfO/qJQFS3E4Q8aPYAKqQ017jKYEtqRP+uqHHOMOhrMkvRwxWL:NfO/qJCS3b/aAAbKzAUOMzkvRwQL
TLSH
T17AE4236391D6E1AF3046D951CC322D1DF391E2B1C7A8F596F990408992F62B80FD36BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewInvoke.mp2

Path C:\Users\Admin\Downloads\NewInvoke.mp2
Size 1.5MB
SHA256 51495f038979bf2cc3e42e6d41bbd5b5f7392decd0890942bdd0bce37c92e6fb
MD5 6c9898df10bd218da3b51e8655c43d1d
SHA1 24723c5ed274b4ff618ce58fe3b403a767910a3a
SHA512 348fec4dffeeda41c2250b0413829c3f38ba7d5efa6117ad1e7faf103134df4c1c517b3178dde884edda5ce8ee897235554b2e56b8debce0138b53e381290da8
SSDEEP 49152:Uq0eFzTSXUCiLKhwzdP2TbuZk8Ag4d9zifhKxsvJA:d0SSXUC3wzgf8n4d9zn9
TLSH
T1177533003B9B36143359B78BD726986F1730FB268A86D0A8C693D56454BBCEFB1DCD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenCompress.emf

Path C:\Users\Admin\Downloads\OpenCompress.emf
Size 700KB
SHA256 ccc2202f6e8aa1f1ca8f82a37ab57c6b3be44220fc43e26929c08d1a7b8a2b34
MD5 0da6cfbde63b71c425206861e7a06ad9
SHA1 746e9cad127ca6a51bba1d82096df9f3c0445bfb
SHA512 7e4e92fb09276b25d962e113edf8dae5abac88327c3c6515e188691a9a480ef43ecc73b528f1b8ad2cfa5b07f4de6544921d0a15777d9e0055aa067d97533664
SSDEEP 12288:X7FommjU1yOkjav5Kx4fW2gLrA4II7QpMZ0ElhlagSRzki/kff:YUAYBKif/gJQpO0P2iG
TLSH
T187E4333C7FB4410576051A33BAD49860EDBC239B3E6F70A5FF296687BFA32506C91621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingExpand.zip

Path C:\Users\Admin\Downloads\PingExpand.zip
Size 475KB
SHA256 b04fd67fcd5153f81be3f402636016c199c52f1e86722c68a7f24e142a2121e8
MD5 fd73f7d5d52daf7c8ec86ca0d56cb95a
SHA1 81e222b64f9e040dd33918e5a238e62bd8e78316
SHA512 9bc8e7d6ed69f5d409880357cd16cd3ac66035434b2d1f566e2e749318d47990dbdc841cc5e11e9f9fad5bec8d85a788cf39c43e75c0a41ef39210102f537d4c
SSDEEP 12288:qkEccCDeIoG9A6KoZhuQe0nc5Wg438B6HI/xytnrWy7/no:g6eIoGZZpSCFA4rWCA
TLSH
T18EA423317A3450EABA1DBDDC605EE9C456A137393C0797168CA96C9E3C867CC0C4A3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingSave.bin

Path C:\Users\Admin\Downloads\PingSave.bin
Size 825KB
SHA256 e7e1d8a872cff1d6b80964416ad6272cf62896b9627b4416ff704023a0149c6d
MD5 6e61e00fd1e532807522ac9c8bc72c77
SHA1 a0045b25bbe30c417c457cfe5f9688b9224b01ea
SHA512 72c0a35621c90c6bec21c4b4f84135e960d44e5cb62f8fbf491cd94ecd89fb391cef8c032e1423f9b1d84a4a5986bbbd322d9abf09ca6774fd3ea2a0c5f42d64
SSDEEP 24576:8UWgK3e5/J++jVQ99jmLSNFPBGxk0CWvoGinucJpXtZ:Tu3AdJ69jCS43C4orjPXtZ
TLSH
T106053389B225ACFD33909BEB0196DD7C867D9F507048B24153BF4DBE84D2C584EE9A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushSearch.M2V

Path C:\Users\Admin\Downloads\PushSearch.M2V
Size 975KB
SHA256 830e29bc68d1cddb84619b6f8736f25a056a5d65049b9e776f033ea2e1383075
MD5 9c22cdd9a1cface2288bda909c12aca0
SHA1 17fec15dfbed8ff10dc05c9f375c195f22a2854e
SHA512 e0cdf05cfc45a9ad559a44ad959371db4b3266dec500dde82e259bc190ed03ab44e63a370890cc8a4be36a9931ad5c674e78ef84f73fc1ce379d4cabdedb1fa0
SSDEEP 24576:gzPL+3DtkSZsvBRyg6Up0xIPrL1GvBn1/zDZBuSAr:Uj+3DWSZaR76UqgfYv3/zDX1Ar
TLSH
T1DF2523DAD5CAB3598E6D0B443F51B38FC559436B8232A941522C36DBE6262E32F3F5C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushSwitch.ADT

Path C:\Users\Admin\Downloads\PushSwitch.ADT
Size 800KB
SHA256 3d2d21ad73d82a180b0ddf32bee58d0fbdfca596a3418540d5b6e3c91a4f4414
MD5 2bcb1e5088a9a91a9874ae914da4a4a8
SHA1 a4fa7d2c194c8e7c2a9cc590e4fdd2d0283f0820
SHA512 41fa387b44e4206d5cbd821e8e9657c4d5edfefb728915ffd4be6cdedfe4f8f3328da237b8bc5c4e0ef531a26b9bb77a1f951c93f0871d19eec9972042aa9dac
SSDEEP 24576:LU9Jv6wOfuYLSpFdn3MClRFCGn7zbA5JN3LDoKK:Ltwn4SpnwG7zbA5JN3QKK
TLSH
T1110523349850E641863FACD3F4EB6D457DD4BFF81B06012192EA57CD87C2CAEDA8970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveWatch.xlt

Path C:\Users\Admin\Downloads\ReceiveWatch.xlt
Size 425KB
SHA256 9ad0d387bbf143d7ed8a3e99e5ce3d7a7f92b90da842bf15a75c1399270f64bd
MD5 99906b0ca5f9c932799e20225d0cc8b2
SHA1 6ffa38d7e6f588bfdce8d8978e8fb885956a88b4
SHA512 4aeadea1d5c0dac411844f35664251abd0ca7470e313c83d6e734c23a8d8b0b60988a80d79c3ebb3d32bc30540f462fc78a76218373e816fb2011e86d2399956
SSDEEP 6144:FKRnsd6vrT/z8Ykrfes8127YmVtVaRy4Vk/PThlsVxZ1EtCSMYvadrh3JL2dFyR7:FKNsQ3zma2XaRzVoFG7Z1CfuwAHVnXOm
TLSH
T14F9423A34E594C1A5F35035CE35B2AD81A738A7B264501D33BAFBED7839AF054B9C813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetPing.vdw

Path C:\Users\Admin\Downloads\ResetPing.vdw
Size 875KB
SHA256 e399e3deffe283b06e7256dc07761beabb618d7af0684169cf998b4acf1a5ca5
MD5 3486a0055c0cb259eed4e213edd5ee24
SHA1 bf8033dccf32c3ac2fe1f9696c232c43db6b803b
SHA512 d1947e4e8feb2408d0962a880c2153b8012f1e64858a411ff64a5063d08f7060ea0b871151a7baf0334331a841a964972542fb493ab3ae1ab8d7e9e103e14af1
SSDEEP 24576:3IKZIedqDP1CVcCZF5Fa74piielL6ZFy4WEAY0U/:3Ik+b1CVxaUoiJbWEAY0U/
TLSH
T1BB1533A6CF1B16EF633D7632C3D922931408C409DF936C3BB2B6929AC5605787924BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeRemove.gif

Path C:\Users\Admin\Downloads\ResizeRemove.gif
Size 1000KB
SHA256 9f45549b0a1b298d60ca385f64358eab98ecac58fcddc17abda9802b49090e13
MD5 87fc6911a9bc5c0cc787c09b8a366260
SHA1 d42dee43b25f481770f22152637a1878230a6d44
SHA512 291f1c2f1bda5357c8143f2077b48c02b738a0b94dac770fe1db0766e91bc268c8eed2605fda6604988afcf45911bfce40861697a0a12d4615c19936dd56968c
SSDEEP 24576:Uwq3JR2AhbMzDiYW9RNUhJTwUlTnKTkbYWtb7NoedNyT:dybMCYW9RN+zTKTk3XGT
TLSH
T1DB25333EA3AA9E7E06F5B71B09149AADB5D427FC798A3008F14075C35D1BF102A07D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveUnregister.easmx

Path C:\Users\Admin\Downloads\ResolveUnregister.easmx
Size 900KB
SHA256 8a54f925b480acf1908af79006bd0f016ea3723273b5649d590b4dc701fc43b0
MD5 9a14c16ee4c2343ff7339fb435f95274
SHA1 afa463002e4df6fda622e1e3911e8e3fa4d8dee5
SHA512 30dc80d850e98a859f2ff90d88d56affdbc82cf154d87c7dae907cb78208a0ec9901a361311af706063561a0121b6181c38f077d5df742567d36ac45628d14cd
SSDEEP 24576:fmR6Z7O/LQCAyrR/hAt/QfR3tLuvqpk+Q3KclA6:fmIZ7elblEwBVuyjwh
TLSH
T17E1533505802FA2B6064EB4AEAF1C62E9E443146BF4751F5D7FDA30AB0BCE3E07055E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartAdd.odt

Path C:\Users\Admin\Downloads\RestartAdd.odt
Size 600KB
SHA256 ed93af742fa3e2daedb126b35b0cb31ce311d4a7d69d725e25e8510e46b50f51
MD5 1a6552b2bd0cbf13f3236fedcc82ffae
SHA1 ac90ddab36964a4eb3077dcf2d7dcb1cc12a3650
SHA512 251967a6e817f6c9a5bded2ab29041a59787d1c63da2c374471d5bca32768a080c6c1356d7628ab4d643dc30cb7ea308d0c0b6981f3237fc6e2dfbb83a03e105
SSDEEP 12288:sJhRzSj3PpxrGB7O1hikmfg3UWs6md7TXqQlYrv0RD3:s/RSTpp8ylg/Xqam0t3
TLSH
T17AD42383DC311459A8B86DAC996FBF5F5ED3E244F8940B36CCB8801293759F413E562B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartApprove.aifc

Path C:\Users\Admin\Downloads\RestartApprove.aifc
Size 625KB
SHA256 e272798c6e09c9fc6515bf179155720fe2ead5a952c6b8123d3ed1a23d234378
MD5 0761f7f541f72512d23b6a3ae9a8efcc
SHA1 af21f837634d3f6d6eab10946961ecfdd65fc2f0
SHA512 681da5a95a2e47e0caa8ad585d702c72d1b70f23d2e267704ec1091f636ebaee05e302f72d6b62deebf0440caab5a8ad9fb8468eecc872aa1e19bee56aa13267
SSDEEP 12288:uUlgtBJXEnBtzVeOjV6oakM6IZm0p5a+pzWhwaiwIBzIYiZhfV:sBJXezVjVPM6IZ7pE+NW5iwIBMDhfV
TLSH
T1C9D4234D4A4F49ACD9CE55E0EE1A860758DB44FCC1C317F9BB9F04DA29E3679222C938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartExit.xht

Path C:\Users\Admin\Downloads\RestartExit.xht
Size 450KB
SHA256 cf683f9183b23f2b923134005476815c27b9bfb1a807043d2278b1383974342b
MD5 28ea80912d19bc3fd8e53edeeed3fb43
SHA1 85e3c5de7aa7bf7d785e8dd0f85de039285843c6
SHA512 0192d2b6fa1a7f404d396420095a8c826946489f160a8687100b9b2281cd1ee7e2fa15bf95b7bff978ce903f154eb3389ee272a8ca4193a1ce0d341ae4c25869
SSDEEP 12288:wgOEijLhtGYZe/evt+EKJYS9n9dxeJm3YId1oQoIXEzlHa7H:GnDYo+EK1t9Lh/vUzlHo
TLSH
T198A4234E16B574D9DBD021949815FA1C00738FE822DAB93841CF7E42DFA0B8667BDB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartUnlock.rmi

Path C:\Users\Admin\Downloads\RestartUnlock.rmi
Size 1.1MB
SHA256 2e2658031f8981ee13d116e0bcac412c8455f77038d32c58a1fe030e77292814
MD5 bfdcf1dcd3bfbe29a9b43378225f0ac2
SHA1 82e8d75978c33f9dc0c6010b10da5b811380450f
SHA512 22ac17e19ca77624ae494a3d15b30460cdfe3ce7573f96a3da50361965a285ab591393237535ccdd7c381a82d8f217bacaa61fd002e384f42db42f2080887b61
SSDEEP 24576:fjLGgF/cnBq/KGCNS9BYVlK3bmEHdQvCbJrGoRwnstbCFj:fjzNcBc9BYzK3bmEaCbJ26b+
TLSH
T18D3533904DA703AC950DCBEF01D9A26E55AD896F9B18F0D7ADA39DB1D032D23390F274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartRequest.bmp

Path C:\Users\Admin\Downloads\StartRequest.bmp
Size 850KB
SHA256 8db8dddd591b658bd0870c3be1a4acdec7ba6389f12fbf51377decacbfd9ee44
MD5 c0ca82c9a3face29576fed379e06004f
SHA1 e7341ae052a9f8f34dc813b849415fe1f8d28aa5
SHA512 09d3a5a21ab2c16c39e47fe08e7ce5ed8341a63153dfe096a148996523b3f7dc224d2b9bd83d3cbafb7bd880f0c17818dcd65489f5b42f50856103926a58fcf7
SSDEEP 24576:mcNZ+jHkXi6N9uOwqNi/3R81K290UOQml:3NEjEXi6NlNi/3X2MQG
TLSH
T12205239064F7251435018DF299D39D28EA3E6E97DCDEE592C27CE4CA98CB037FD68508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitUnpublish.mhtml

Path C:\Users\Admin\Downloads\SubmitUnpublish.mhtml
Size 1.0MB
SHA256 485816a30b15547c87262aed58714703e67c218feb217df2660a5f654e6689b6
MD5 a1bcadd4402e668677e4148a6a95aed2
SHA1 6857c14fe79ddbf4635a5f04a3555dea4b354428
SHA512 7778bf456626841837ee456355594f5e79028d9016d1473667688c5bec4f4aface0b72e24a96697bea05b54f8105bd3c79c632e616311ea8d6aa29a6e6bfb69d
SSDEEP 24576:B73sXnfLTuHU+n4cEv5hJMvYeYiwvNHIZg1AzPWYnrLyc:9SfLTKU+t2UvY5vNd1sOwLyc
TLSH
T1A625332590A777AFA08933B4C24C457A7A723F801CDB9A9C6711B59274F08FBD3F6189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterOptimize.hta

Path C:\Users\Admin\Downloads\UnregisterOptimize.hta
Size 1.1MB
SHA256 fb5d315aa7c10dacb6e98c30e936c57833641d34ffd0c373f8305daa9d229663
MD5 1c9334f8f518f70ae527e9300bc28768
SHA1 b1ff1f0687252cbc4b856211b8d527b131ddb8a6
SHA512 da7735f51243cc18c98eb8212fa49a5681676cc7b15ff4f32571f3c0fc517cfb79d3e3f389525c933b90c342c13ce7676a18b71f22c156fed5a10962e592a731
SSDEEP 24576:Cd1cJybsM/IYxhbog0iPPfrlAqye0aOH+21v7nvnh2pt1By80uOC:HJ1W0UPfeqye0L+Ezfh2prL0M
TLSH
T1EC45339DC4427A933C5F3F393A32AD98C8D4AE8F814FE5DAE29131579F488A94C2C413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateGroup.mpg

Path C:\Users\Admin\Downloads\UpdateGroup.mpg
Size 400KB
SHA256 0872daf01177e1c6ffe2c56464c3cb751d89713aa5ea5b346aaec861fd707a31
MD5 28f204fdef7b6485b2fe0d9dabb58010
SHA1 8d0660c5ae4f08edfc5b75f7e6093f048e6bab3c
SHA512 29a5421a603c4da9953c97db61d045bf25ac87ed8a19f988f991ecf3b7ec2e6426942e945684fbf817fd423e6bf6d56e39db4cf37bad9fc61b035a7d3e47de9f
SSDEEP 12288:yn/EX5Y8K9Iiy+YSSf2iSZP8s9nvxKs5v:ygbiy+YSSRsvtHv
TLSH
T122942384D7D3E66260DFC144DEEADE56C085795DFFB8598707EB8A1003B939239AC838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitResize.asx

Path C:\Users\Admin\Downloads\WaitResize.asx
Size 675KB
SHA256 21df2bd3b52ef91f8c77fe56c64e6c5c3ebca62807f9517e4ee103b3a82c3add
MD5 b57f0bf769249d5c82fd730b2d7ba0e6
SHA1 ff56630d6a09bfd844890ec18025712df75c8c59
SHA512 d82296947a5ee3bc6bfb889efdbde58071d677c56a52f51b17376241884114998170144ca68404fb30497e1fb4ca49b1954073c6e7164a64e6d1d59de943d36d
SSDEEP 12288:mcetzbfTON8rdjyDNTE3sydsK58RsaRirY91HbtGT0InxWtAOsS2I/lwfd0Nq:LuaNSGDNg8s5+a+pb1i0YS2INwFp
TLSH
T1ADE4238C97F5874C78055AAADBD4C362FF86090713793D8A61FA94ADBF80071A3C3997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WriteUnregister.dot

Path C:\Users\Admin\Downloads\WriteUnregister.dot
Size 500KB
SHA256 77f7f509fa173982f708022657b8837f4df8fdf695bad1a9a44ef9d6dae3dff9
MD5 a2b09a780894ee7342f7aa819b281f5f
SHA1 b8aa6255c5cfd70c39dc44979874cae75c14eaaa
SHA512 9b4988907c792c6fc82dfe9e2df3af02a8e1d42d679de35414fe67f7bb14c07f4a2c266fbe561f25c8efe3cb2c3bbafccf70d86a0ad859280833bb164e86bd98
SSDEEP 12288:sSUT8du0pzxwFsIqhR/o4sVDzGPGZ04zc3v+BIy4T9I2LEJA+:sSq8gQxKay4sVU944/ok/LE2+
TLSH
T162B423BA8D83AD3A93DEE58831B287D769183A74E9299A5720F3F03DC4CC15ED46305C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 4ed9462b232b8ad33fd6ba251b03dbe7c10822714a5602396e44bb9f700e526c
MD5 67bebd1fae69bf03047ee36940716396
SHA1 c811bee59e63bd6c44d5b7409ed653d750a7b077
SHA512 95465f09373b74ecdfb25fc42efbb69ef96940c0bb0e3eacffefe9ecf5c4dad4a722e791d01a6c1cb128804bc6000ccfa832b8c1c9ea3daf2bf6bbcf4a8dbead
TLSH
T1AB41B3504EF71706F177D6FA9BF30522FA31BC51A1065E5E8184838B4AA2B00D979F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 1KB
SHA256 e85f3971e93301b96f8d111fdc7f81e60d44b89c5305d947dc9d9915071cf2d9
MD5 9c1a55147e45e10ea4becd48e98ab8f0
SHA1 245f666256fb310dceaf3fe0c201c0032fd8af76
SHA512 b45b1356373f7c541c2cdc51383aad739ee97b83d64c68f7467c4ec8c08c3dd49992916547e7886cbfeae0d74a7eff0b932370fa50b0a3d20bfbb53bee607e1c
TLSH
T1661199004BF6055AF0F7C2306B716B235333BD139A6A135AC28563C849762208A6EF52
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 1453348d46bdc17df5f56afbada5c89b6737b2b52a8b8341b6d92fbb34a65f86
MD5 b60a4d3d9b32e879cbf21e6132850784
SHA1 a13fca7c2b7a519b6e341cb98d45f70b57560765
SHA512 fc1c899590749da172e21c459938b4deaf0027f7a00b25997694c8e5dd0a290352f0a901b8c57044e702a6562ca2b582020233f670840e25da039822004bcbf5
TLSH
T15A417801BBFA1619F3F3C672A9733B210F7BF82395245A2F5084428808A2910459DF77
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Public\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 44d86ae316b4845dcfd64c46ffc79402c6baa71e43bbfc71d6fd237614e8a64f
MD5 55dd097819e712aba709c61ddde7dcda
SHA1 67cacd3d6a8de4e329c6aafc6629646fb350fb6a
SHA512 0ed11542099d33ea4d2b89d2510e7331ae345cfbac060f4949ed556310f4a1b96eb435060c172d98af93ade939f16f58109319082bf66ec82034106c8fd49e6a
TLSH
T14341C010EBE60759F3B6DD71D9737A22AA77B80AD919071E8084814C0C67A09C97EFB7
MD5 SHA1 SHA512 TLSH

Submit Download

VLC media player.lnk

Path C:\Users\Public\Desktop\VLC media player.lnk
Size 923B
SHA256 84774c2d4ab0792670f7da996194bfb42ba56fbde5986c094154b1b651934edd
MD5 9d8bfa30f0f9cc1d93e283198de4c02b
SHA1 89c8cafaaaf90184b6c2d6f606cd9796cfaeeeb0
SHA512 9a9290267063795ec6c0fb2ed4590cb0d773ab361d304147ac00e2d2aa51a0b3a1809c64cde096606b0fa63bad6748b7fef261ac0765fdbd82743d497ab82c8f
TLSH
T10211D000ABE32B0EE3A7C2F055760321BB32F816465A372FC1C0414D5879700C66DE75
MD5 SHA1 SHA512 TLSH

Submit Download

memory/764-946-0x000002246DE20000-0x000002246DE21000-memory.dmp

Download

memory/764-936-0x000002246DE20000-0x000002246DE21000-memory.dmp

Download

memory/764-938-0x000002246DE20000-0x000002246DE21000-memory.dmp

Download

memory/764-937-0x000002246DE20000-0x000002246DE21000-memory.dmp

Download

memory/764-942-0x000002246DE20000-0x000002246DE21000-memory.dmp

Download

memory/764-948-0x000002246DE20000-0x000002246DE21000-memory.dmp

Download

memory/764-947-0x000002246DE20000-0x000002246DE21000-memory.dmp

Download

memory/764-945-0x000002246DE20000-0x000002246DE21000-memory.dmp

Download

memory/764-944-0x000002246DE20000-0x000002246DE21000-memory.dmp

Download

memory/764-943-0x000002246DE20000-0x000002246DE21000-memory.dmp

Download

memory/4956-933-0x0000025651BC0000-0x0000025652BC0000-memory.dmp

Download

memory/5148-930-0x000001EB22950000-0x000001EB22A6C000-memory.dmp

Download