453701e9b50f4d998e2fdb30d876d81cdb57ad8fdff17f801ce120f0ba8fb95b

Analysis

user interaction
yes
max time kernel
763s
max time network
490s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fnaf-why-did-he-say-this.png
Size 150KB
Sample260924-e7lrssyfpf
SHA256 453701e9b50f4d998e2fdb30d876d81cdb57ad8fdff17f801ce120f0ba8fb95b
MD5 90e0a20ed19e92485165dc781cd5c4ce
SHA1 031386f679051ba781aefcf1ce4725e74cc23513
SHA512 766cb89e56c36e3e878531dae5cd85e10a53a3d4d22a418b1cc6ef6654e666ca41c80e7daf1bf74db217a82b2a04f0add9a2e494462f7ff3d8a96d309061ea97
SSDEEP 3072:c4q4RWwU1gxwY3rd0M7oecs7scT2+xarsyRwo0372VR0m5SLcKAc3PBFff:21mw+Z0M7FcksWarsmZMLAc/BFX
TLSH
T128E312A283A65DE33563312B88FD8EF61DE5B1C0BC8B9BB895F0B454D97A0801F55C6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
3824	hl.exe
2360	hl.exe
2416	hlupdate.exe
6060	hlds.exe
6356	hltv.exe
6548	hl.exe
1740	halflifecrk.exe
7072	halflifecrk.exe
4476	hl.exe
4404	halflifecrk.exe
6092	hl.exe
5484	hl.exe
5856	hl.exe

Loads dropped DLL 64 IoCs

pid	Process
3824	hl.exe
3824	hl.exe
3824	hl.exe
3824	hl.exe
3824	hl.exe
3824	hl.exe
3824	hl.exe
2360	hl.exe
2360	hl.exe
2360	hl.exe
2360	hl.exe
2360	hl.exe
2360	hl.exe
2360	hl.exe
6060	hlds.exe
6060	hlds.exe
6060	hlds.exe
6060	hlds.exe
6060	hlds.exe
6060	hlds.exe
6060	hlds.exe
6060	hlds.exe
6060	hlds.exe
6060	hlds.exe
6060	hlds.exe
6356	hltv.exe
6356	hltv.exe
6356	hltv.exe
6548	hl.exe
6548	hl.exe
6548	hl.exe
6548	hl.exe
6548	hl.exe
6548	hl.exe
6548	hl.exe
4476	hl.exe
4476	hl.exe
4476	hl.exe
4476	hl.exe
4476	hl.exe
6092	hl.exe
6092	hl.exe
6092	hl.exe
6092	hl.exe
6092	hl.exe
5484	hl.exe
5484	hl.exe
5484	hl.exe
5484	hl.exe
5484	hl.exe
5484	hl.exe
5484	hl.exe
5856	hl.exe
5856	hl.exe
5856	hl.exe
5856	hl.exe
5856	hl.exe
5856	hl.exe
5856	hl.exe
5856	hl.exe
5856	hl.exe
5856	hl.exe
5856	hl.exe
5856	hl.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	hl.exe
File opened (read-only)	\??\D:	hl.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hlds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hlupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hltv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	halflifecrk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6808	chrome.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346984226376007"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Half-Life.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4296	mspaint.exe
4296	mspaint.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5484	hl.exe
5856	hl.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	firefox.exe
Token: SeDebugPrivilege	4996	firefox.exe
Token: SeDebugPrivilege	4996	firefox.exe
Token: SeRestorePrivilege	5356	7zG.exe
Token: 35	5356	7zG.exe
Token: SeSecurityPrivilege	5356	7zG.exe
Token: SeSecurityPrivilege	5356	7zG.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe
Token: SeCreatePagefilePrivilege	6560	chrome.exe
Token: SeShutdownPrivilege	6560	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4996	firefox.exe
4996	firefox.exe
4996	firefox.exe
4996	firefox.exe
4996	firefox.exe
4996	firefox.exe
4996	firefox.exe
4996	firefox.exe
5356	7zG.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
4296	mspaint.exe
4296	mspaint.exe
4296	mspaint.exe
4296	mspaint.exe
4996	firefox.exe
4996	firefox.exe
4996	firefox.exe
4996	firefox.exe
3824	hl.exe
3824	hl.exe
2360	hl.exe
2360	hl.exe
6060	hlds.exe
6548	hl.exe
6548	hl.exe
4476	hl.exe
4476	hl.exe
6092	hl.exe
6092	hl.exe
5484	hl.exe
5484	hl.exe
5484	hl.exe
5856	hl.exe
5856	hl.exe
5856	hl.exe
5856	hl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 4996	5336	firefox.exe	110
PID 5336 wrote to memory of 4996	5336	firefox.exe	110
PID 4996 wrote to memory of 4604	4996	firefox.exe	111
PID 4996 wrote to memory of 4604	4996	firefox.exe	111
PID 4996 wrote to memory of 4604	4996	firefox.exe	111
PID 4996 wrote to memory of 5972	4996	firefox.exe	112
PID 4996 wrote to memory of 5972	4996	firefox.exe	112
PID 4996 wrote to memory of 5972	4996	firefox.exe	112
PID 4996 wrote to memory of 5972	4996	firefox.exe	112
PID 4996 wrote to memory of 3344	4996	firefox.exe	114
PID 4996 wrote to memory of 3344	4996	firefox.exe	114
PID 4996 wrote to memory of 3344	4996	firefox.exe	114
PID 4996 wrote to memory of 3344	4996	firefox.exe	114
PID 4996 wrote to memory of 5700	4996	firefox.exe	115
PID 4996 wrote to memory of 5700	4996	firefox.exe	115
PID 4996 wrote to memory of 5700	4996	firefox.exe	115
PID 4996 wrote to memory of 4908	4996	firefox.exe	116
PID 4996 wrote to memory of 4908	4996	firefox.exe	116
PID 4996 wrote to memory of 4908	4996	firefox.exe	116
PID 4996 wrote to memory of 4908	4996	firefox.exe	116
PID 4996 wrote to memory of 4740	4996	firefox.exe	118
PID 4996 wrote to memory of 4740	4996	firefox.exe	118
PID 4996 wrote to memory of 4740	4996	firefox.exe	118
PID 4996 wrote to memory of 4740	4996	firefox.exe	118
PID 4996 wrote to memory of 5764	4996	firefox.exe	119
PID 4996 wrote to memory of 5764	4996	firefox.exe	119
PID 4996 wrote to memory of 5764	4996	firefox.exe	119
PID 4996 wrote to memory of 5764	4996	firefox.exe	119
PID 4996 wrote to memory of 4768	4996	firefox.exe	120
PID 4996 wrote to memory of 4768	4996	firefox.exe	120
PID 4996 wrote to memory of 4768	4996	firefox.exe	120
PID 4996 wrote to memory of 4768	4996	firefox.exe	120
PID 4996 wrote to memory of 3872	4996	firefox.exe	121
PID 4996 wrote to memory of 3872	4996	firefox.exe	121
PID 4996 wrote to memory of 3872	4996	firefox.exe	121
PID 4996 wrote to memory of 3872	4996	firefox.exe	121
PID 4996 wrote to memory of 5652	4996	firefox.exe	122
PID 4996 wrote to memory of 5652	4996	firefox.exe	122
PID 4996 wrote to memory of 5652	4996	firefox.exe	122
PID 4996 wrote to memory of 5652	4996	firefox.exe	122
PID 4996 wrote to memory of 4988	4996	firefox.exe	123
PID 4996 wrote to memory of 4988	4996	firefox.exe	123
PID 4996 wrote to memory of 4988	4996	firefox.exe	123
PID 4996 wrote to memory of 4988	4996	firefox.exe	123
PID 6560 wrote to memory of 6608	6560	chrome.exe	146
PID 6560 wrote to memory of 6808	6560	chrome.exe	147
PID 6560 wrote to memory of 6820	6560	chrome.exe	148
PID 6560 wrote to memory of 6820	6560	chrome.exe	148
PID 6560 wrote to memory of 6932	6560	chrome.exe	149
PID 6560 wrote to memory of 6932	6560	chrome.exe	149
PID 6560 wrote to memory of 7028	6560	chrome.exe	151
PID 6560 wrote to memory of 7020	6560	chrome.exe	152
PID 6560 wrote to memory of 7028	6560	chrome.exe	151
PID 6560 wrote to memory of 7020	6560	chrome.exe	152
PID 6560 wrote to memory of 7088	6560	chrome.exe	153
PID 6560 wrote to memory of 7088	6560	chrome.exe	153
PID 6560 wrote to memory of 6120	6560	chrome.exe	154
PID 6560 wrote to memory of 6120	6560	chrome.exe	154
PID 6560 wrote to memory of 5552	6560	chrome.exe	156
PID 6560 wrote to memory of 4440	6560	chrome.exe	161
PID 6560 wrote to memory of 4440	6560	chrome.exe	161
PID 6560 wrote to memory of 540	6560	chrome.exe	162
PID 6560 wrote to memory of 540	6560	chrome.exe	162
PID 6560 wrote to memory of 6028	6560	chrome.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\fnaf-why-did-he-say-this.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {636f4a37-af12-4ade-8a33-639a3c743f6f} -parentPid 4996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {c5a441b8-f202-4b04-8716-c31e8c252675} -parentPid 4996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3932 -prefsLen 27276 -prefMapHandle 3936 -prefMapSize 270279 -jsInitHandle 3940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3948 -initialChannelId {e686b95c-97c9-41d2-bc38-42377ad69ee5} -parentPid 4996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4100 -prefsLen 27276 -prefMapHandle 4104 -prefMapSize 270279 -ipcHandle 4120 -initialChannelId {e88de218-89b9-4269-abc5-4ff2c18176eb} -parentPid 4996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3116 -prefsLen 34775 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3904 -initialChannelId {52c7a258-d555-4b61-8870-0f6dfa6e690c} -parentPid 4996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 35012 -prefMapHandle 4912 -prefMapSize 270279 -ipcHandle 4612 -initialChannelId {0219490e-8a1b-4c90-8a48-e739f96deaac} -parentPid 4996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4868 -prefsLen 32900 -prefMapHandle 4904 -prefMapSize 270279 -jsInitHandle 5032 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5040 -initialChannelId {5d2f6097-3e65-4e8e-981c-384eddbc7f65} -parentPid 4996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32952 -prefMapHandle 5224 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {45fbbe5b-6c8e-4687-a538-d5de3ae54518} -parentPid 4996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 32952 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {5dc02586-61aa-433a-b0a9-7770a5b2a50a} -parentPid 4996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6184 -prefsLen 33071 -prefMapHandle 5672 -prefMapSize 270279 -jsInitHandle 5676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6044 -initialChannelId {9a1c2970-c7ee-4393-99f1-b6b0ace10ac4} -parentPid 4996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2816 -prefsLen 33071 -prefMapHandle 5208 -prefMapSize 270279 -jsInitHandle 2820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {4931d6f9-ee38-4f6d-a781-47f5dc1524c1} -parentPid 4996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2716

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Half-Life\" -ad -an -ai#7zMap9439:80:7zEvent23399
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5356

C:\Users\Admin\Downloads\Half-Life\Half-Life\hl.exe
"C:\Users\Admin\Downloads\Half-Life\Half-Life\hl.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3824

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x514
1⤵
PID:2572

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Half-Life\Half-Life\HLTV-Readme.txt
1⤵
PID:5988

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Half-Life\Half-Life\INSTALL.LOG
1⤵
PID:2752

C:\Users\Admin\Downloads\Half-Life\Half-Life\hl.exe
"C:\Users\Admin\Downloads\Half-Life\Half-Life\hl.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2360

C:\Users\Admin\Downloads\Half-Life\Half-Life\hlupdate.exe
"C:\Users\Admin\Downloads\Half-Life\Half-Life\hlupdate.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2416

C:\Users\Admin\Downloads\Half-Life\Half-Life\hlds.exe
"C:\Users\Admin\Downloads\Half-Life\Half-Life\hlds.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6060

C:\Users\Admin\Downloads\Half-Life\Half-Life\hltv.exe
"C:\Users\Admin\Downloads\Half-Life\Half-Life\hltv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6356

C:\Users\Admin\Downloads\Half-Life\Half-Life\hl.exe
"C:\Users\Admin\Downloads\Half-Life\Half-Life\hl.exe" -console
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffadd26c728,0x7ffadd26c734,0x7ffadd26c740
  2⤵
  PID:6608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1600,i,8468280787119416611,8837759561074477457,524288 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,190907474991628998,12401051300051673740,262144 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:6820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,8871340483505137784,303514203064081233,524288 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:6932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,9753915337991984561,6642852193836016558,2097152 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:7028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2664,i,65948464410970466,11475493442190758369,2097152 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:7020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,15628109870110738012,7800417372459577765,2097152 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:7088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,8290539818734643358,14176827004582251135,2097152 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,13435346497361480154,13798934324975050193,524288 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5684,i,11473971058786649399,6083284134350063116,2097152 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3496,i,17875974472733483908,9187028497510547082,2097152 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,1826595254339231715,17074839890760736176,524288 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3972,i,15712917252831974770,1567196530946964454,524288 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,9741328250639558887,10688069024975293462,524288 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4556,i,4801123458310771810,18272710564188414742,2097152 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4208,i,18322587715449886321,6889211660281951362,524288 --field-trial-handle=2072,i,13022403522252160940,11839602518517154986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5276

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap7338:88:7zEvent23073
1⤵
PID:6180

C:\Users\Admin\Downloads\Half-Life 1.0\halflifecrk.exe
"C:\Users\Admin\Downloads\Half-Life 1.0\halflifecrk.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1740

C:\Users\Admin\Downloads\Half-Life 1.0\halflifecrk.exe
"C:\Users\Admin\Downloads\Half-Life 1.0\halflifecrk.exe"
1⤵
- Executes dropped EXE
PID:7072

C:\Users\Admin\Downloads\Half-Life 1.0\hl.exe
"C:\Users\Admin\Downloads\Half-Life 1.0\hl.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4476
- C:\Windows\system32\pcaui.exe
  "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {0c6f54e8-3e0d-46be-87b2-64a9ba4f694f} -a "Half-Life" -v "Sierra" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 1 -f 0 -k 0 -e "C:\Users\Admin\Downloads\Half-Life 1.0\hl.exe"
  2⤵
  PID:2988

C:\Users\Admin\Downloads\Half-Life 1.0\halflifecrk.exe
"C:\Users\Admin\Downloads\Half-Life 1.0\halflifecrk.exe"
1⤵
- Executes dropped EXE
PID:4404

C:\Users\Admin\Downloads\Half-Life 1.0\hl.exe
"C:\Users\Admin\Downloads\Half-Life 1.0\hl.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6092
- C:\Windows\system32\pcaui.exe
  "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {0c6f54e8-3e0d-46be-87b2-64a9ba4f694f} -a "Half-Life" -v "Sierra" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 1 -f 0 -k 0 -e "C:\Users\Admin\Downloads\Half-Life 1.0\hl.exe"
  2⤵
  PID:2984

C:\Users\Admin\Downloads\Half-Life 1.0\hl.exe
"C:\Users\Admin\Downloads\Half-Life 1.0\hl.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5484
- C:\Windows\system32\pcaui.exe
  "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {0c6f54e8-3e0d-46be-87b2-64a9ba4f694f} -a "Half-Life" -v "Sierra" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 1 -f 0 -k 0 -e "C:\Users\Admin\Downloads\Half-Life 1.0\hl.exe"
  2⤵
  PID:4336

C:\Users\Admin\Downloads\Half-Life\Half-Life\hl.exe
"C:\Users\Admin\Downloads\Half-Life\Half-Life\hl.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 cf05424b57dbb61572977b8284115207b9ac08c12587bedd8243808894a6207d
MD5 588013275640950c90ba80e35720dace
SHA1 2cb7826f2b9a32633c0c91d3d26aa06044389620
SHA512 97e601d07c5b9f3229c25e9f0d175e2675d21b89c2189d7dec601b7859190a44e2dc513b5d60e945130e8a2622579510c8cac8906c4edc30f5995277b89d34e1
TLSH
T155F042B5CC21AC371CFE0B2930A68B4AFB91232B2740495F3A3C911C8FB063B46A595C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 768B
SHA256 efd9e36be3515f8c9bf824dfaa7bc60db74506c1d2029b7339311c49fcabee11
MD5 cf3e6303ca0017295415bb89adf8d46d
SHA1 16882759e60812f2731aebc442154606f7208e50
SHA512 6c762b42be2efc02ee66d7ea5109d5c4f3a0b623a884e556f731c0fa959a17defbd9e784ee71e09fd5d04a9765ece7749c0cde54455b6abd24fe20b1a517c8ac
TLSH
T10B012295E5830040CBC73AB2B5B839F22C6A02DD4A4BFBCD0E844C8AF9C66B2114479F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 2672aa265ffae7551680dd7a7c2e65cb2bf38ce2b6be5bca9a61ac0e9bbf642a
MD5 0a12cbf57a2be5be1e9e14a2efe817ef
SHA1 fc802ffaf627ced9e483b24b3777fa1436dfb59d
SHA512 c689570cdce42e80d51011748aa94989b4a4a76c99c3dca1218e0d39346e4385d173d734a6f9f0c2bea24a713d722bc1ccd516f6605d6942f59d8de4e7514791
TLSH
T1F611D495A0870002CB863AF2B5B43AE62C6A16DD4A0BEBC95E458C99F98A672014478F
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 a8f94b2cdbce2031ad840c72840a9871f7d2eff3f00d6624fa0edb5593b5f3d0
MD5 48574532ef5db162311a40f4d83ceba1
SHA1 4e7743afc7b06208b674e32a8a81135d1fa58468
SHA512 560064adaef6a8edddf9223ec303482e8286a4b14605953a85aef1dac4410b57db4dbec8ce8f8f60a575e2949524bf43677ff220d08524187db59e6a986e6ad9
SSDEEP 3:MsEllllkEthXllkl2zE/legS2l:/M/xT02zPgS
TLSH
T1224404047FC40C07CD1473305071C3501370D4140713F757355114375CCDF401C10004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 afa7c81f868c34aba869b0e451c342d09a07d3501a5d3420bc7462c1f9874f7e
MD5 a66ef4560de72795115be911458844b1
SHA1 b599be9660a0f72df6ab2743088388912467b94b
SHA512 1337e5f38aa5d5b0c8a4792ac6833cd933e09d539e1572a26d5c0d8faa7a829bca7058d52f05ffdfcf833b4cbae5d0ba0954d826f327f338e4311e4d43d53cb6
SSDEEP 192:D8XedewhkJJ0qJDe9Kq5A2lCMKu0aPsvHfPO2YNPvkI3Iy1IIKQB9wT:D8XKewhkJJ0qJDe9Kq5A2lCMKu0aU/f3
TLSH
T1E4029EF3C3D8CA2DC91156F8AB257F1ECE190A28432C3D26C8D9AE5B93E1871D35564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 d874de6a3c2ccccc69704728e663f53b5fb0d93832c6b0415bcf5c988497acad
MD5 816e54ff9a5887f2a7c54590d3346b17
SHA1 41d48f65c3ce5da328f8c00bdc41fb40a958efd2
SHA512 7c152b6e0bd6042b0ea9a2f8dd40d11d9216fcbe32275e48758a1cb7b52976e6c3af8f4c53d2785df0bc4ffa4ff484be168873379389bf7b1e145aee2d3905c0
TLSH
T1771189E3C7BD782B10BD49BF2D04F80D49BAE439015224E6DFA6816CA0C26E35B16417
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6235fa509080471b3f23e7bcb8cef52b4ddf9fafb64204b3ed72b83042d684f0
MD5 50ca16abcbfd65d0274280e7ebfe3374
SHA1 b18544079813f05c0db4316371b3a6148499c1b2
SHA512 54e436ea5cd4e4b5ee0a6e5b5bd6b00e951a38c71b1786f087623f78328e61698590c85e218ba771389aaef10911e6857072d1ec58ff8beae510b648be84523f
SSDEEP 192:yRHcBzdupPPcH2CTv78pAPRp2YVJ9THsb+WNnrB4cC2eUiYpgJkwkHj9VyIsnAU/:yRHmzd84r4UXdJwNq2eDUgJEHjL8
TLSH
T13942A52EED50753B4CDBC21AF9617B16D7F6102560D42E88EAF88E7C24E79CC621711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 87af139cd610ebce1bcba6ce71963035c0a553c9f6defc8ae662181bcbed9693
MD5 1040ac3a4e8f002b46363e1ebf7be83d
SHA1 ec4d414f6422281a84667988aafaad716fbc9ba8
SHA512 176c544fc130695315e29c49e4543d70d8cc06227e447588c35af95ab61dac5cab8a4ba7547c8a4c04094a70bcd75b69c518636553d18be2f6d1d2cabf15ff80
SSDEEP 384:yRHmzZ84o4wXUyJwiK2GYe19UgJEHj0ife:cmzZ84ZGJwke1cW
TLSH
T16052A62EAD10793B5CDBC62AF9617B56D7F5102160D42E48EAFC8E3C25E79CC2217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
MD5 c8926c13ed1e541a9ebca052800d518d
SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
TLSH
T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a603fe64828726ff8706cc57906c01ac63bfa8427507da498f49b1bfae9026e6
MD5 b6c74e33acca085272baee1b78d5d158
SHA1 68b1e75bbb5c5612d503b1e0eb28750306f48459
SHA512 c3484abf5c33b97fca9808767323ba2bffe822b5b292f8767272d11c834d1ed98e1993f146b259224041e63b1c844df001ba73dd6059fc9c5c53689ebd371505
TLSH
T1C1B01215C0413711C40103711191D06472688F3DD52233D551E00D0AC8391604117109
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d8129.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5d8129.TMP
Size 96B
SHA256 cf400bf4663e3f95f1b7eb8f6bbe9a999a5a35240083ad5d64009d96a205a574
MD5 b28c3b88d6bdf61ac6298f6d6d55dc7f
SHA1 492b6ef04a2b66fd6378d8a491c5b7fbca6977ec
SHA512 d2dcbaec46d06237b2b1ed4e6bc98f8fadcd881088fa59c8b01ab3744dbbb09766284a997ed7d76e674cdf8a7914d91728dbfc4bc448861b7a0b9949c3e5edf6
TLSH
T122B00295C196B312C04703B0A59595DC7160EF2DC703231292F16FAEDD69B7246663A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 96bf2a507e96807bd2e7b2cfd54f31e67e0c4a866a6ee0d05fe5180f8328daa6
MD5 a3fd213d535582360aee15a08811c945
SHA1 b2d49821e3a239e1283a6327c535d7e2573a66ab
SHA512 8ade074b3df75d6b8a5949a47c4b48c4aa41ea8259c56f6d0f38546dbffc2973e5a38c3a5c03895a106ea2d29dc2623bc2695a7618182dff37b80a0e9348d475
TLSH
T1AEB0241001C40451CDCCC734C7C130C433100D1C17C345435075475FC71D1C35100314
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 304KB
SHA256 d704ed5bc933ad8b90a13171102889b258dc112ae765497f5aaf72de6eb44a9f
MD5 62442ba8e1bde65fa4d8e66fa4d9f68a
SHA1 1210543e227616bb1ff4c468799d8ee6ee2122b6
SHA512 fbc2330282865721e271cced6d74d58daaf26ddc116e983e920f7ed5c1648f9e34e24e624af3c02fd188a0e547e3b6a91c2f270239f8fce2a9733569fb7dea06
SSDEEP 6144:unEEVuGZxY1pIpjeoHzTsc8pfDh5V6aI9vhyE+hFD+7t56OD9ZfSApprR:u5Vu2xpCMTs/pB6x0EyFSXD9ZfS43
TLSH
T1986412366D59EC37CAB81D4A604732298EE176C9C0DDE6D990636FC9F12F85C0633635
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 a8c9c2858d8b21858a6fbbf4cb52ebd0b25b126d6508b1b7b2bc2164d239a54f
MD5 2ab7dc159b0199e0748cfafd4dc9d9c4
SHA1 6aed5b3c73067173070740ac1cc268be03fd14e5
SHA512 e79d19b0030af17cd6a408c234e06b1694f030f242fffef04f9db36a516c73f6089d3377b5ea981136cb96ebe5a81fc7fec118625cfe237ed78d91f74f8f5a2d
SSDEEP 3072:9+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:9+hFD+7t56OD9ZfSAppry
TLSH
T127D31232AA91C8BBC9BC6541B157A304DD76ACED41DE3A0944465F8EE05FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 fd57986aa67e705ea112b65876a7beb187f8f256e73cd06b94550731148dc576
MD5 1688c4835b52e210c50907efb958c88e
SHA1 27fd99190df400b0146119603be448a443beb760
SHA512 d5bb3cf3146de62e75c0721a5703edf0e086f014a13d292e4755d95398867b85347088c779ec601c5ec6665c3f84fa114b927004ef2a9e47533efd3f745ee65f
SSDEEP 6144:LjeoHzTsc8pfDh5V6aI9vhyE+hFD+7t56OD9ZfSApprR:LCMTs/pB6x0EyFSXD9ZfS43
TLSH
T1F54423266E9DFC33D9FC5942604B2319CDE176D9C0DAA29544925FC9F16F48C0733A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 be5caa0363c977e3137fd299f039e471235ea350adc0bc8ad556eb4f249ff1c4
MD5 eb13676af4eb66bfaafb98f57946cc5e
SHA1 8cc60cd3c71343f71fffb7933fda04cb17b97184
SHA512 ac45c3d18bfa1d5dd250d2813de00afcd37e2379b8d3d4ad6b98fc9e39f4353b1c1e06dd281cd031021c0a1dc761c3bbd91fbb706f3bade4ffb6bf94185ad23e
SSDEEP 6144:CjeoHzTsc8pfDh5V6aI9vhyE+hFD+7t56OD9ZfSApprR:CCMTs/pB6x0EyFSXD9ZfS43
TLSH
T1F84422266E9DFC33D9FC5942B04B2219CDE176D9C0DAA29544A25FC9F16F48C0733A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 13ffa79db539dc70b5a1ac0e1063747925572c0485db76eabd5f65d0e1cbdc0f
MD5 fdcff2d439759af482b9801a1e344fe2
SHA1 fa8d9f1a9bbf88431b508c12823adfbee6c08c6f
SHA512 284cc3d3d8249de4d5aab4693d8af2901608cf776e145d67f6572bd66440866b3ed7d69baf67cd0daa0ded31a0d813042bf0ff0402b2c9d1fd509e787dfff7fb
SSDEEP 384:HalwSiO024YNDL84KKDL849B7SOEAd9KVRaAcP+AWRMAHL+dS+N:6l8ZYNDL8lKDL8CB7S/AmVAf+hRM+L2t
TLSH
T1DF728E794F003CFC25A7C0E8D4B942A58D0877A7DFEA806D21683D0DDB98A69B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\AlternateServices.bin
Size 10KB
SHA256 827b61e48c94a8fdb94ac8d2955d3a1f3fc230bac59383ccc66de45c26b2bb3d
MD5 37e9d93da40eb356c27c4b68ac455c48
SHA1 4c0aff5af6e5aab9cc60b7015f32f03d92c20230
SHA512 4c5d24c33798ff421b3365a845e189057db913f13d95b76f47acb5935806be0f32d8ae30b4f468622e979ed611fd9b51ce0f8df2a9ba1d3bae2922bd777cc497
SSDEEP 24:tMuhMZnjp/P91rj9vO9xmj9Y79Byj93R89VvEj9v/55q9F55A5tj9z69l8j9gy9p:Y9b8sEYQBEXI56T0Cp93
TLSH
T1242274F36FB67563F0A2CFF49059B98C9C330325156D91C4CB5980F346C1AAA917ABA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\AlternateServices.bin
Size 12KB
SHA256 13362f926906892ef8e2dad54700d82b1f5707f9b81cf2068bf6a12ab90ea8ab
MD5 53404c91d884b8895ee3b442f7f79911
SHA1 1ad8e52d9cc83c66af22a987e1491aa263dda83f
SHA512 c08a44a576322412a38234d8f0ec92448c471f68725cd1a3a23c604bbe893e0c03f12fd92a4fa366db09bb827b3972531d57216319e72372437eb039f3f51763
SSDEEP 24:ZMuhMZq1rKjoP91uj9uO9xeKj9N79BCKj9089VvcKj9m55q9F55A5lKj9Q69l/jR:P8Lrvn9BDMI560Lbu9kBM/p2d4
TLSH
T11342AFF32BB66463F0A28FF48058768C9C734325146D91C8C74581F746C2BAA91BFBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 90KB
SHA256 263c8df1a4e21ab6aac095f7f7b140181649744296e273e4a92dec6ef45ac1e5
MD5 63ac094057e0f3c807d1fd35b0583e22
SHA1 b9d09b55825a0c97c9c0c4e37cf344d488249053
SHA512 b56fe49d76d76d1d0a994262afbd5e17a4efd448376d8d0aded389df453e423b59a9c1a818b9c2ab84c949ba89809cca7b1b74ffcd916ca17e187defcd077b6c
SSDEEP 1536:rtisHqdGn44JBiVsaov80umYJVKKg0nbS0dceC6q6F5JMhxOY:r04sG44uV3ov86zgn+PQXF5JMhxOY
TLSH
T14B93EF80DB1A403BEC1485BFB4955B2C2735F4214A599B5B3AAC04752DCB3FF2D0EA6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 63KB
SHA256 1230851e37d6290aba965553201fbfb0c16a74f40dada24d677caa70429c362c
MD5 f04768cc7c8d7aa61a34d3ab760b9977
SHA1 d882605ad685de623819fba92efe29a6dacff0b8
SHA512 08e2649c534f010fbf4fecde3990f3ab054ca37e00849f89ed1eb4aec39e71b62331f39c3e2d21335dba87d7671a80872afa923d6da6bfff3e346356b96cadb1
SSDEEP 1536:ttisHqdGn44JBiVsaov80umYJVKKg0nbS0dceC6q6I:t04sG44uV3ov86zgn+PQXI
TLSH
T1E5531144EB1A553FD86802BA9DD21B003F78F8895A0A2FA7375C54782D873DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fe8657ce2d968a2c815324d4e4db2bfeca94630fa992e010684c763c942b1fc2
MD5 8f7669cc7e37606df3f114c674516962
SHA1 e44521ffb2f05b314cee0c0ff29adfb7c72eaf19
SHA512 62148b4f8ef225a3517759c7bde2a16bfd9df35f5e69a3cf8d15f1fa8c4d80c8ea35d5694e88c40ef60fee4a1b2b41b8f38c4d0b4c5fef71635600f598d25036
SSDEEP 192:RoPOv5zbowbGv8yjvBcY1d66JozGzgCl6mc0dz:RogbowbGv8yjvNd66JozGzgC1jd
TLSH
T15AD10FA4EA28563FC404523BCCA61F400F3A3957D84E7F19319D65182D9B2DD7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 8e153e0b947b8fc569559a6c96b39b54a7da28d427ad1df1fcd3f18df8918f37
MD5 4d85e65087ae2858c72920fc2a3117bf
SHA1 e03e5baeb17f96f3c21ef9caa5647439b16f80a5
SHA512 fbd14c2fe6dd4c2f2dea1a4db7dac2fa31f53e3287c78918f2b5b551d1a7264cc7935159b4f428ade25380f8d8d07a56fc2e85ccacb7f7adc35bd518c1105687
TLSH
T14F619868F229463FE445413ACC925B412F343442E8AE7F2A35AC608D1E5B2CD76CD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c586b580e1a7bab2544c2b03c04b7d3df78649fbc461b793fd7961e363d37566
MD5 878a686720261079bba52072fa634629
SHA1 21ef06ab907f5e35080fdf0dd277dc774f321b40
SHA512 c1bc3d5309ba0130329f6040df17c9391af2a4be9ba50e38b55d906bbbdc7560846a0218a1d332ad81c3e681e84b2f9fb6b9dc88cfa53aa03e30dcb2479cb2e8
SSDEEP 192:Q1d66JozGzgCl6mc0dDoPOv5zboP6ZGv8yjvBc:Kd66JozGzgC1jlogboSZGv8yjv
TLSH
T152E120A4EA29563FC408027BCCA61F800F39394AD84E7F1971DD65182D972DD7ACD1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7ba825e38791c5109ed8afd809bcd38b9a6271b28eb28760113b2c705d5946bf
MD5 365cf159e3f8c0ccd151b77e2304778e
SHA1 56d0d676ee18933737be04905517f8e39cf6bcfa
SHA512 d5693c17b369d17a329e706cf65d6fadfea7861e542491c49c00cfa88801b02b7d01808d813f1e0b288e7a79f2c165eb8bb6c96ee300ff7f00c9e44ee2b9cae7
TLSH
T15321375D3AF98D2B998EE7EC744113CE57958F0B048B1D875D12DF8CCC81AD932AA528
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\events\events
Size 5KB
SHA256 d9527a7e4c37b1d3703b062dc55cce62bf25a6f058468a61233ce4f78a355fae
MD5 a8573971077d5692ca7ce9a70b5319a8
SHA1 6f56b5a553193505d4a753cfdee5583601eae7b6
SHA512 2ffb0eed60d1a659de6e018416e23a23ac99181268d1971f08f228db169dffa2df26480289f13df6e35f64589763aed4fd3f25adb90d0ebaddd31b8a2364053f
SSDEEP 48:YKczeisRx86AtnYdgi/XTHZ6ExrRzy0NOXZA4pAV0DvgqdGPmvYbqUdet0wgpX4E:w6pTNrGpA4ppbdhULdEXqzTPBHBeIA4V
TLSH
T1F9B1FE1D66B90CBF29DBD7ECB841468D43D98702848F1D8B5CDBDE49CC86689329F429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3520a45b-d125-4914-9e5f-487f8e50c14d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\3520a45b-d125-4914-9e5f-487f8e50c14d
Size 883B
SHA256 c0088f30b323426dccbb51e002e06ece540f93fe210244bd5f8e0a486fc4f943
MD5 e3dccadfb6bbfcf591aa598a8ad50508
SHA1 7daf2f53b8605f550dba8bfffc079b524f300192
SHA512 d282b412ed3bc195e37ba60b10f6cfdc30c87f1604bb48f323edcacc185f931c660e802c67100b31c897bbf42077306ed4b98e73503524e17ffe1f64005565ab
TLSH
T1B8110091AA723972CD68914BC5A137428BB87A13C0C699183DA61E140DEF51E83A7247
MD5 SHA1 SHA512 TLSH

Submit Download

77e605d6-f61d-4b65-86ac-5426f36717c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\77e605d6-f61d-4b65-86ac-5426f36717c4
Size 17KB
SHA256 35e3b5a30375db2b66e5fd8809bc2c5baf61983f6bb1217da65e993c307b9154
MD5 d4cb79614f1a649caa24ba9e515e3d0c
SHA1 7115cb0b502f19badb8532a6db3cf361d1a6f68f
SHA512 3974755daeffa50ec4f7c26bd8e56e4f9d14d76e536a713a9e7f511ea26327633516374717329bda4c2a73081d57c9b1bcbee1c2681c4666d225b4d0cb98c7e5
SSDEEP 384:9E9Xf/1QOXVWkQlKckedc95nYW/o9lDFkz9S8SyT6/A:9E9Xf/1QOXVWkQlKckedc95nYW/o9ZmJ
TLSH
T1AB82C8FDCD1240473E65E52EF2E5EDAB2057293209CCC79D6AFC483A26D69BB1127324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

828bae3a-3921-48e1-b98d-8b80c8914abf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\828bae3a-3921-48e1-b98d-8b80c8914abf
Size 15KB
SHA256 2fc0503c962d6401068905a132cd35ec92eb978bb28e153cad0c3b48fb3e5839
MD5 83181d88d09f1e05ace9a16a2fc0ee99
SHA1 1d0a8d1b0e8afd7457a506f953a438a0bf1c652f
SHA512 46b1e1c97678aff1a2997a9988b2b09c1ea16ea351d429e15a7e0895302578688b42c5368273d509ce576e8c4bc1336fe35627dbc7b3a03dc0498ca59e06a997
SSDEEP 192:4KJH5TFCRnFLGCzLRxhi2Kn2kVQg321PAuBOcj9lmuJeeN9+d89qElros:4Kx5ToRnFKCnRx42K29OIocXF
TLSH
T12D72D8562420597A8651E399D8FCBFC3E2F528CF4C418FCA9BE4BD085DDE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d6f01ee-6168-46a4-b525-abb25af85d6e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\8d6f01ee-6168-46a4-b525-abb25af85d6e
Size 235B
SHA256 4ea35377b580ec2c5ab4005df2fd2b320ab42e37363d023f4066ec3c5d2e810c
MD5 b05b8f76770c0d71657c52a25acbb93e
SHA1 497c0fa09ec1bc1542d1c81a0d4f658a114d5266
SHA512 7e293c364d857658c1f8ef284359bcdd2f10a4ce9417aa4460abc6ad8bd0e4506f16b7406b5d7b1940ba554e1537a64579f830fe437f0d7d761972df55719cbd
TLSH
T132D0978438E863AC08040F46F0B069C330464C3324B8AC20DEB006B48AFAECC5151817
MD5 SHA1 SHA512 TLSH

Submit Download

d95a4087-4376-4de9-8d8b-e91eb8a0da82

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\d95a4087-4376-4de9-8d8b-e91eb8a0da82
Size 886B
SHA256 31a380621457e636c43e42de675c8b3f17b74d2613d8beef15e6ae5d7c31d2f5
MD5 f95661a3fecc48584767897a5d5cd7d5
SHA1 2c05f348be862e5d5b63b588bdc26320fd1c4b37
SHA512 8ef66796046d70ef6a12bb41e8c93529f40eec8a2e91d09080af2e075bdcba7dae789dd4f2c868d0823d409b458c3c650943ef5072e6c1136cbf16901ce52cb7
TLSH
T1E711409099357872CD28D28BC9E2378187A47123C0CA5A183DD15F180CEB01E93AB207
MD5 SHA1 SHA512 TLSH

Submit Download

da30db0f-15fc-450c-be86-368aff291ffe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\da30db0f-15fc-450c-be86-368aff291ffe
Size 2KB
SHA256 4686ba7eeed676d0845d4efde3c2f136bd22fa78f3b29fad833109b9ceb70675
MD5 343116eaa628a5e4306e54a1838825e5
SHA1 711284ba8123490e702de4ef5b8f96b13fca9490
SHA512 9fdab3afcd3314ff16cbbdd8c914f171686d3531a6747b381edd7771920c1549ff88dc6f784a83dee2dfa35b75fc24cf087009acf55f27a5fc0efa30c04f60d3
TLSH
T17441545C79B85C779C9BF54EC182238D53B04E4340C62C836E92EE4C8DE665D337A56B
MD5 SHA1 SHA512 TLSH

Submit Download

db2a5145-3f98-416a-a39a-13c93a291583

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\db2a5145-3f98-416a-a39a-13c93a291583
Size 235B
SHA256 18473693e9993e633a9309cd19adc514fff73e05505c3d1126130b2f752151fb
MD5 debee94e42f90b8dcc5359f7910adcdb
SHA1 150303772488df208256b8d7a0ab2120ae778645
SHA512 6b3be57e14c92d4f842702a207057a5a8b138bb149f577a88d3d849c0715d904b4fe06410e367999deb00c012f7953dcc56b58920b7f2fa56482c3e462475ec9
TLSH
T151D09788A4C8636D08201F23F0B03CD232848C3314A47824DAB10434CBBAECC5251926
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\extensions.json
Size 16KB
SHA256 75d2cf52af87948130979286a7ff92167ee307d8181bfc3f844ccf6944871b21
MD5 8847504350a6be906ad3a04d7ad2c12f
SHA1 67e6bb2a104dff6b6737e23a5b4c66d48955b624
SHA512 0958c99674ae853cbdf2e6e4fab552b250f265503e401fec43288deb33754c3bbbfadacc526a0727cc04dbe02747cfbdf97ca27e7171d6c924fb962a258920fa
SSDEEP 384:xkI4vDUmldvmC8dhW294zK96oSL4HgL4PYL4HtL4H7L4HZM4hz:CI4bRfuXP4C6v4i4i4N4H4S4p
TLSH
T12F72521545049EB8294EA79AAA367E01C37D473B60845C78F4DD8FC802FB5B902FBA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\places.sqlite
Size 5.0MB
SHA256 4d9277fa7860b57a9869c0e4bf655644ddda6742fc8a1861118109bd34394f90
MD5 4cd2d5c5069ea41cf707dd88504d6f50
SHA1 ccaacc3ab6d7467c299abc6973dd0c131baa1cbc
SHA512 71a59b4e642606e82c86e9566ee5c6d5526b326c3daf4584500e59fa4f43639383821b190aa4d62cebd1d9e998d9b3bbbec48e61410d5f51d18d4657fcb220c0
SSDEEP 192:M8rJQaXoMXp0VW9FxWZhIKOoJLniPduL7eJNDactFLLuOvnrwoOm:M8r54w0VW3xWZhO+LilOyfZLpr
TLSH
T1BC36844F3A645195C4DA9232ECE31F19187F7116CA36B6823CA4652D4DE0B23F91DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs-1.js
Size 7KB
SHA256 f97d1fd84735edb8f7a59f961916e587d1256993cc0be606ccbdabb47e909147
MD5 d5bba565273aa96468a3375fad5850b9
SHA1 7b101019bb304bfac6a1dc698368456747a8647d
SHA512 82e0af65c830280a16ab445b61657cb92c302fc155f5620fddd9e3dee29ad217eaf7b1c444fe7c104aab5da0cfdbaf1034aea08018bb9d995d6dd8309a5f38dd
SSDEEP 96:xHrJUTUdGLqGq8f3/aNbzS/SSlSdv9jaunWHbQW/Bw88n8L4cnuVCL5GS:RJNGGR8f3/aiSSPxbQuBw88jU/
TLSH
T136E13F7895088F6F74B6776C6C6888715AB2013BBBBF68C750B994C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 6KB
SHA256 2787fb52acce1361b360a0797dbee1a79efa8b8b6a00ad4d7d8f5be91aff94a9
MD5 36e4d9ce863d55d8e93b429defb22494
SHA1 9b866da608c82387c866bce8f59b43261f3cc90a
SHA512 c3c91db37d564460ed1f18c797073b927cebb216383c1ae804e359e3ac5da0a03f339e62c27fff935f3743e26eba843dec672b459de1cf44d93cd4467adf5456
SSDEEP 96:xHrJUTUdGLqGq8f3hs1zSpKSSlSdv9jonWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3hscKSSMbQuBw88jUo
TLSH
T177E13F7894088F6F74B6776C6C6888719AB2013BB7BF68D750BA94C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 12KB
SHA256 18b7df050569b36bc1a1a0e55b70fb147b554be4ffdff54ede63a0b6ed4ed149
MD5 9036c187a61315f27829fcd46e6c2476
SHA1 ead75d4b7397f7ba613a0017d21ebb27eac616e8
SHA512 45b8bdb767f1f8a2d1592176d8eddccd0e523478a835d38ea8b8e70da8990ea3ca81c90089a05c8c945806f63607c65975548e2798423cd6ee67d0c6996258ad
SSDEEP 192:RJ+GOCR8fX/aiSSPrLRGQQKOBw88qgTXO7rod4/:R0Ge7RPQ9w9G//
TLSH
T1A142DF385245CE3F20BA72BD6C214AB019E242377A7FBCE645FD84D2085CF2541E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 7KB
SHA256 42ffdc4f6bc90993da178f4ef89e5430c9bd7f2931c56de2889ab4ca607dd397
MD5 3782a765ddd4d4ab29e530d877bd03a2
SHA1 a91b9d2e28c761e5d36ddc5b57b61cdc0d04de25
SHA512 849079f8edabaceb39d14c1fc3e5be782012ab465dea6ed49bc87cc9b1e45c173bd0ae74cf143d0c91f5c3c622c2763089993126efa90243f4707d321b1370fb
SSDEEP 96:xHrJUTUdGLqGq8f3/aObzS/SSlSdv9jaunWHbQW/Bw88n8L4cnuVCL5GS:RJNGGR8f3/axSSPxbQuBw88jU/
TLSH
T1A0E14F7894088F6F74B6776C6C6888715AB2013BBBBF68C750B994C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 8KB
SHA256 404eff61400ff8c68513a0c5e0038c80494299124776843dbbe2442351bf7212
MD5 de3992f08c78166d5e02e1953873a1ea
SHA1 8137cbd557f64398e71d536fff6cccd83d1ed6dc
SHA512 b9aee1ffe9ead2de18186245bdf395d9905e279643e45c4cc3afc25df307b184d81b9a5461078480b88d8b747ce69440c9ccbfb0d36f1dfe433622fbee813f72
SSDEEP 96:xHrJ1TUdGLqGq8fX/aNbzS/SSlSdv9jaunWWRGGHQWwBw88e4Q8L4cnuVCL5GS:RJ+GGR8fX/aiSSP4RGQQtBw88IU/
TLSH
T13A022F389144CF6F64BA77BC6C2489705AB2023BB7BF68D750B944C5051CF3446E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 6KB
SHA256 f7f264f42be462f4cf1ecaf220d925af7dcc6778c55324f177dccbd0d9d9d275
MD5 24ca2a5e74f5020707c430f2b2c50a74
SHA1 7dd2fc010a9c8a3e86f4daf92475a07d89b1f4d3
SHA512 70a03619b99225afeacd4dc7239932dfc82dd02d8d8c6df823fba3069dc1e2ddb512f06a02db6473b0db1af3cb220acdf6336185c0dfa761eb8d1eec6e9eeef8
SSDEEP 96:xHrJUTUdGLqGq8f3/a1zS/SSlSdv9jaunWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3/aGSSPxbQuBw88jUo
TLSH
T10BE13E789408CB6F74B6776C6C6888715AB2023BB7BF68C750BA94C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 6KB
SHA256 f551903c17ad8eb8a855a02de16e6f728efb4b8dbeb913d22bf0c266ec1b8ab8
MD5 aba6f23ae3b8529819432365a9615fee
SHA1 59719c2d083f79cede6ddcaaa3b5f2d53a345e90
SHA512 71a45b637be3fe1172d74fbf1271b0cc10204b03c4e27a8b20a1212ddb30d23852452128b4777c0e423cc957c9f2f3a0dabd9760f524e188c9133d45f81c63ef
SSDEEP 96:xHrJUTUdGLqGq8f3hs1zS/SSlSdv9jonWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3hsGSSMbQuBw88jUo
TLSH
T131E13F7894088F6F74B6776C6C6888715AB2013BB7BF68C750BA94C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 99b7c05e8ca9a6d0fd47de9cb8b33c1b962459d223edfbcd54475e9b7c224b17
MD5 f8595a30dbd935e72d23236ba02bd0fb
SHA1 16c5c09e10ef0fce85db255e7758cff52f83eaea
SHA512 1baaf2448bb03b20adfafcc06c8c743f6cc329cd97d208e15d2795207c89bf0d419b27fb6c54cc6125a0e247c1d860583f8bf3ca4da23a5ca3fa463403ee52aa
SSDEEP 96:RC2sJ2eaRVDsbht1lus4JLjSonx+inwc8Ryv6ag4RYt68xHheS4:gRhKDsHoZx+inwKCad78Nch
TLSH
T1BAA15B613D0F7DB2D94AA54544C83F88B96294A7D3AC58D8249F5E8238D0D06237F28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 08c6e67dad5576ec6f99e8cf416ad2320d3459248119a850ad45a4dbc2efc864
MD5 df58af59c7060e6359e1a74a7cc923fd
SHA1 a798f38146dad58378be13948aec090fe4173930
SHA512 3a6dc5e4c08147e83a7640f46ae136aec36f70ef26a3a8ca3776d4a5c5432e56075325b7588625f1652dbd22cee520a0bd5e1e8312651c2c3b4258df26b04a36
TLSH
T14321C683E93A1EF97D55A165D4CC8FA6C69C7031843454F0419E960664DC60E7786119
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 71cb8cbdb86e1c6bef69c42e63c7cbf27a6eae67f4a6df74c215137e9b66dbde
MD5 cd47802eb279d7428a6bad48b73d99a5
SHA1 158bf82cd033d6ce0de2f99c2e02891711e04738
SHA512 407888e7d7c967981188d351cde21b3c433c9458eee5f40e3fe8a6c2581402cd5952531b04c14639b8e193f4cc44d0ae00d7f811a889503fb51bac7e5d82c109
SSDEEP 192:8v3I9iCMiXJBHWBTrxvxYinwoCad78NfA:o3IICMIJJWBTpnxCadwNA
TLSH
T165F1B0737C4B5833CE7AD502ECC62E48E5B178DBD3E925D02065696A2CB871923BF316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 7851d681329492f49a264413a10bf65de8502443cd368112c7a44e8c8cd3aeb7
MD5 df8afbef633eeefddc4e16bad0c3ed58
SHA1 607368e1e5bd5db4548f82ab86139f942a4a1300
SHA512 679d1f29e73dee7374c7161a9a78bee2aac1ee4058207b66ae6b40c44d2c2d3a481ed839f56eba454a975d923da0b4204d75deacffa363c613ebc34e141e1d2f
SSDEEP 96:82g5xjHk9Xy4B7ICfhXeAHq5cg6TT/sxkWOLysnvxYinwm8Ryv6ag4RYt68xHh98:8v3I9iCMiXPHWwTrxvxYinwoCad78Nf4
TLSH
T1EEF1AF737C4B5833CE7AD502ECC62E48A5B178DBD3E925D02065696A28B871922BF316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.3MB
SHA256 f31905879fddefced5afeb85921cbc274517875dd3ced02c687dd66efe8b0866
MD5 fd3b6ec55d18f9e196ab695c6ac01ce7
SHA1 6449981ba0fb34e13fffae1952bcb335438bd422
SHA512 4537b352eb64492daa4e7462c8c674cc563af8dc5b4d15afd99283a433a0e19c34553baa57ad3e84c788d4621a439e1601c60348963cda3a7ab11de7bd44613c
SSDEEP 24576:KKkwFQR4c3XjK5Y8KYCAlMN40ubrs/e5Wi37XRdCP0CFRWQB70dhgCkLT4RLK:KKBA3Xu5YoN5Wi37bYlFRF07xU
TLSH
T162662AE860D1D243F3864073B64993EB21EFD00D5037DA0857A45AE9A5748EF8E27BBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hl.exe

Path C:\Users\Admin\Downloads\Half-Life 1.0\hl.exe
Size 1020KB
SHA256 bf2893f2f6c7affca1e9dc83a8f13491f1e9a1e41641377115d4d968850d9d34
MD5 f834683429ae19710fb5669873d98e4f
SHA1 eaac453e33fe366bd0c749421fe9eed71a633939
SHA512 a59d14e8af8b04cf4e12c388e861b31132b96a989a2c4c49fc55d33923495e8f8c01a76fcab983f719f51da0af3561a20f29203948d18d05f0ecefa054442509
SSDEEP 24576:wG1n08AVjI3vzwevIsVjHUWtNcBkCDubfRHpInlYuPW2F:wXYxwOZbfhpInlYuPHF
TLSH
T16B256BB1A951883FC7B9C131853573BD90B7BD22475218F363883DE91AF25E05A3A2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HLTV-Readme.txt

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\HLTV-Readme.txt
Size 12KB
SHA256 ce6f8ee920636570117d99d5b0149014c17ab3f6ef11777c38df53f6370a533a
MD5 9f27efc14cc4f7e10ff4fa1b3adf0d75
SHA1 da4fb25b47b5ad3b374e3c2187fa68a8b47a5541
SHA512 d86c177473e6d5439462b99dc2a8d871c70be1e69dca29b85ee6cf486f1c790dc0c99584416ed3d91a8695b6430f4bd6ec86de13585a3c6d7a6ca181732f1308
SSDEEP 192:toP4AqgI1b6yM5Nm6BGV1zonLgYXK5/HeAzW/a8hSFzReJOy1sqCB:yP4ADI85Nm6BG8LdKNHvjNeQy1GB
TLSH
T14242C5079E5CA3A71EB723A696B563E2731CC26D27322141B18D413D376098F87BB2F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HL_Res.dll

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\HL_Res.dll
Size 48KB
SHA256 b247cca70c521e2cb0cbf76d5bae949a00cf26fe4cb2bdacfb8b8fa647e487a9
MD5 9f18409367ef6eddb8ca88382737d891
SHA1 5616b36624e383614341069446303dafa055ba7f
SHA512 429f4371df396adaacc02e2940bb011553c137113a5d0d75cd6bd6b8a0de7b7db0cf34b6f8f30c52d04e16f0fd86a3898a1a9c554b1264f0c1031066e93a54c7
SSDEEP 384:XIn3RAtKYr9tFQOAFyZSdo4fEmkjXfTlMb3Z6D4aQhAa:YhAtKYr9tEMZmcmkzb+b3ZWQh
TLSH
T14B235451A3FC4618F6F73FB56EB916A00E7ABCA6EC79D64C0210614E1971A90DDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALL.LOG

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\INSTALL.LOG
Size 134KB
SHA256 90d4e755da677dcdb5de6d3bfe31378c21e52fe62a9da92488ad64bab7e64a8d
MD5 4d021d655e98ad4b3d2060ced7a17f33
SHA1 2db4359b46a142b7dde853e7d9b04dd17f1cf2ae
SHA512 d125b9fddcf7136407e3343665003fff1f42d81165884f0ee30f21f4fb6d7bf0855ccad307857bd110f2f2b1a938c34b311f438f52c0454c1af83e16879ea6ab
SSDEEP 768:lpm3J8h6bODlkZIwFaLZ+GmTddlQWN7V9VX3CoYSAafLO+x9Opk4pVbUcj7Unxr1:lpE8h6bODlkZIwFaLZ5+9y7Ex3pEI
TLSH
T1E8D30DCF736C1DA3BC690EDCF616DF59141E07036C5A98D61AF998C78341A9AB38389C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mss32.dll

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\Mss32.dll
Size 343KB
SHA256 fe62f1eb6ba407df77619d16927abbefad3c726014f6bd1f8c37a7c3d6b781cc
MD5 f520185e02e8a5d85860669176bc4adc
SHA1 cea8e9ff14994c89ad86cf891c89fea42a39250a
SHA512 b434e77a17cdac0109b698d0fccdd25dcdb15090a9fd0427504cc7f616673fa6c7307f07fb22cc2fc1e915887c0f9dc025aa8d38f51503f91df6a9ccee5ebe58
SSDEEP 6144:zP/1qeom4nrYNQvvHCkVvH0DMHvZW4aHrmtcitczJ3v:zn1qesnr3vHfdUDovbaHrmtcsS
TLSH
T1E0744B11B6C121F6C8C23E76E55AF337FDF9CB259A1940137288D99D0A67846B2CE237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamValidateUserIDTickets.dll

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\SteamValidateUserIDTickets.dll
Size 528KB
SHA256 d37e0bb231fd365fa5fc55c018ebe1bca1a449d6ed5873567a14c835da1424fc
MD5 706fb5ec59914b6bc32185eb11e4266d
SHA1 442c988bbbcf4581db8b1c3a8c9766b989493f3c
SHA512 e3fe5547a959178f2e031d4a1760eac2ec1987ebb88250f9ebea55126a21475892434cfa1126734d1b7a113745b8c408647a2f2eda9c58a14b6259215478d723
SSDEEP 6144:ZNqVyBFHYz3QL0/nhN37Y5b2Mkci0P6mTbZ0oRBiuAIeyahQzuf/i4b7Z2V3h685:ZNWyB1YQLiTY5bHnAIaqzuygAT1FHBB
TLSH
T1FBB49C51B6DB80F0D74C157014BEBB3EABB94DC68B688FD3674CEEAE98621D06037059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WONAuth.dll

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\WONAuth.dll
Size 625KB
SHA256 d75fa76830b6dc1856a2f99f90a37c9c2aa69a5dd8ea7a1af35ce7a125f4579f
MD5 f62ad97394368bcbdfb6eed6ea152288
SHA1 4d762663bb1bff1f87706821bd2be7e80b8f9eea
SHA512 d91b315449e987d0a5d27667cfc7c255dbe1bb0bc9c13ea66b45ebc11db7893a23c07f7cebf771a190fe55b4d4c70c0a2a3c9e8089aeff2860f1273056df740f
SSDEEP 12288:r5R1k79LabjCVyC0MiLCeyChezmgLGKbuFN+:b12qC0MiLlyckDGC
TLSH
T178D47C42F1E280F2F74C157414BEB77E9A7955CA0B22EBC3A358EEA958361D0A13714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WONCrypt.dll

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\WONCrypt.dll
Size 625KB
SHA256 2a44bad8935e407255333ce889917317206c8723b776e1097b706b8a6faa18e4
MD5 0e9bd53a19bda5aa7af747282933b7a6
SHA1 e32a53f17e2b032d3c3dae58c519c7904bd262c7
SHA512 b6867f055d41d3f2104e0a4cbeb15c77cb43d6e3ed571a16ddbcced6d61a45c9311432033ea920b474a5e2fda31de261a04436fa8437443fa815a192fc65a54c
SSDEEP 12288:/VMAD9+VyhkviJXcjpJbhLlxX3mrE40XpEsokrcB:/SAh+W6jpJbhJxHmg4wpY
TLSH
T1BCD47C42F0E6C0F2F74C157414BEB77E9A7959CA0B22ABC3A758EE5A98361D0603714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doorhitbottom.sc

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\dmc\events\door\doorhitbottom.sc
Size 15B
SHA256 8ec47772865732a79d1095ebfbc731b21dbb952e72767c7f5100a39c7448c07b
MD5 591bd5a451951246614bf03994816a62
SHA1 6f01763304149e0b57a520faa45ca7fda55066be
SHA512 0c6a9fccb048990c07502754bde1439e77493be0b340ac66699678952787d3316e1e3f991eb8948083113edc5ae4b3fe36c5a3823e098f6b656d564f5a56ac1b
MD5 SHA1 SHA512

Submit Download

liblist.gam

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\dmc\liblist.gam
Size 329B
SHA256 e409ea731911ffc3fcd6d8d422e6d2c07c7b68c7c864f3b81dcafeae67c09320
MD5 a27224dc55ea1cd12888d429e3dc07e4
SHA1 dfa2d03d919031c40cb899e1a74a58cbfb6d1060
SHA512 414e9c19a9c637ca6f80fdb8b11f1e6bee8e105d2a26f649c7caff4c4194565e15a7f620864c853bf78933d804ed9df562563ae0051de5f6fd3eed73a466d8d2
TLSH
T1EBE07D3FBB1454A789641236DFA3710EF8A732CF87947959F004B86E3484D6AE671391
MD5 SHA1 SHA512 TLSH

Submit Download

spotlight04.spr

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\dmc\sprites\spotlight04.spr
Size 4KB
SHA256 5603d52c5f089950f372e2b00845738746abebaa2796b0b3e2f6d8d2f4111760
MD5 30c0c19f5c5226225ac3959dfe1f1428
SHA1 5c7be5173586da26dd730a790a151b8a16611106
SHA512 c71799d84798c2e2a82dbde7ffa5a2c8698eaac615e77d337de7dafc9239c4b59bc2794b2ccd5740d3e19957549257bcd468660d0696f09fdca37485150c233b
SSDEEP 24:pDiIsQAQ8Ic44Yo4bo4Y4ofXQLo4LoXgMXI7gAgXIL/:pu3nfXP3nfXfX/HXPX/HX
TLSH
T1CDA141E1B3A9D163EDF55A384AC0CF618C81643438B30F8EF7672A986649F551D2D13A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hl.exe

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\hl.exe
Size 920KB
SHA256 6a41070753a1cf5801447e0c45eec52d6ba38e05be72cae8040f7c751ed451e9
MD5 fbbbebc702d160e1eded09e70952ccf0
SHA1 90fc4079889ded43ff5ee504a04a90951ad008af
SHA512 837a5eb387b47be38f4a3074e3ab832b49ea4351505274c0837783810d129b8ce61e3be04087c8158a8d44b2f8bd6e2a7ba351e684ec85ba5d19e29af0ece40e
SSDEEP 24576:pvciYs+yEInHloneO25G+gL4+IuWIq9VQKL5v:dVe/ne95G1vuH5v
TLSH
T163157D31B6C540F7CB66663009BA2736AA74BA994B304BC39354DF3D7932590AD3B31E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hlds.exe

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\hlds.exe
Size 76KB
SHA256 070ee1e43ac7e66494f3feb1410b6ca2776dabefe83f8e5893359dbcb990cfa1
MD5 f973f36e5c6ff780171db52a60afb4e3
SHA1 5803ea7841e84ca354ce99d20bd4335d07264a5d
SHA512 6784330732727ea6210b26b93a7c0dd6d57f28e522af70bf37066396f56cfdb35b6317b7a05b8d3915bdd081a4d3133e5fb85682bc64765503b7e1f527bd8a2a
SSDEEP 768:b2GOI9U3yoPfNP0xt2d658mZifoyTolA54UXDGYbBP0KmGiB9oFXLhXmPWoNT/t:aGUyoXNP0YiEoyTol4XDL0iXd3ox
TLSH
T1E0739F27BC61C473E9A0407504E69F7F9B7EEE03026299C3C754DD9A5D705F1A22A38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hlupdate.exe

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\hlupdate.exe
Size 15KB
SHA256 f1f138752752a56295179ed611fdcbfa6a3264828bfc5fb047f5e5f9835d1e50
MD5 1ae686da02c6d1b5560f6de8f5ea9e96
SHA1 2125b559b0e8d5857ece40eeef966fc0e20c6b37
SHA512 9d759b7963251f44a9948baabee8ee8b419741caabe4d9b2193021cd159037391dd9564ad7d3f34b1ce9b95e60cb4b9ba21f4327b88780b1d41a60b78e6c4066
SSDEEP 192:JwX+KiDy7niJ+RQalJQYD5tr3W5US5zQbudoCbsRlaRA1VvzGvi:JwfzJQnYD5trEzuudElaO1VvzWi
TLSH
T10C623B0BE8859873C0DA433800BA6FAB96BB69A537F345D3DA94747E1E311E06C3C356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hw.dll

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\hw.dll
Size 1.1MB
SHA256 d7506ef4b00e0845cb5849e28bbf6f06042ce07ad543e721f5314dc7472850a5
MD5 1d910e9ff0324af0440b43ba35276d6d
SHA1 65cfd99929acbf54d525b9916afa52b431696adc
SHA512 e4ee143381032118e1f0f7a86221777d8ea4122982ed696b395674b1302a1e9ca1251b5a09c2cd746f48441216d04ea6080be185afadee38752240a41a68c797
SSDEEP 24576:vtVSack6kCMBSzpA3xGMlHAGtr539AoHXLHWITy/WvFkBBlWkuId1NIYP8Fp8XR1:lHcJIApDm5PR9wBlLuA1NTP8FpOn
TLSH
T1113512C69AE86EF5031641C72AACD25E131590A3163BC7F8ECE362395428F5BDF2467C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kver.kp

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\kver.kp
Size 816B
SHA256 f7c6956084acebb7fb2b991eecfb3c2c394fa5ce63f8b4100042291fe6e045b0
MD5 f489a27400fce7f8cb0e4e51701c921a
SHA1 0066f390507cf91bd10c7a170389036d778d4a9b
SHA512 04bc0502b9fb6abf03b3b2c070954ff40235f57e8d42f2c9ee2a2173fd01c0254f4e6099d1f28f9ae3b9d4bf4f80bcef972fac79b27ba6bd7a5211b919d801f8
TLSH
T1520181A8B00E35813C400EA5238422B301F0ECCA2CAAD2196CE7B17C8380C5B9F263B8
MD5 SHA1 SHA512 TLSH

Submit Download

head_inetgames.BMP

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\ricochet\gfx\shell\head_inetgames.BMP
Size 36KB
SHA256 913fe0fdd4cd1c2b10fb2ad4b4bc47e491ca17798dd30f7926e30f22cf65aeb2
MD5 a831a0b935dded6fdb7f8c4ca1f548a7
SHA1 282a78b89d0ce6cd3110783dd6d54208cb081855
SHA512 60d6e17e5543acbd3889a6fca8e4f4fde17cd9e2de2a11689aa84b76897d0679dcf9fb007bed466b64c0ecdd952d1784c2ae2318344a7ad2953c03280b841cb9
SSDEEP 192:BF1nLjkulGGPmaY/m5CTZ3VcO+yCEDWvchaLZM6RHHdj/wnF3PvwKVsgSAkKGF0n:P1Ljz/mawm5wrCE6vchaLZM6RHHdGz7
TLSH
T12A032AD25AB46AE5E47BD4BEC2CF5A68DC45F0119978FCD64E000CE2126C6BAB93407B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

head_readme.BMP

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\ricochet\gfx\shell\head_readme.BMP
Size 36KB
SHA256 d850218c1401d50f8c7027dc87e6292b608093ece7b0d33cdee9b3983d16313f
MD5 b16248e53c0cadd816342c7db5601770
SHA1 1696cceb52c15f775b33e70e2f52a6147d8ff993
SHA512 8778d0fc879944804ee288f82a33849c1cc70d92d22105c92e906a864bf2497f9edbe985d3b2a7a9364b49ab5ec88863610dbe69895037bc84fd0b53f2a28197
SSDEEP 192:pL1nLjuAXaAC2LRusyE+blT77zjsGhvt7nofRC8:51Ljo2LY5EDGhvGfRC
TLSH
T18503FA922B0E3CF4D84EDB72836ADFA5B4CB3890956019963E6451885AEDEC2CD71E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

head_room.BMP

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\ricochet\gfx\shell\head_room.BMP
Size 36KB
SHA256 db1ba7e1257b3d1ee5c2d1fc1c53e0305f865b1180af88677b7756b640ca2d03
MD5 1bb2b52895105df4cbe105018b1f17bf
SHA1 b9b92fac6f30953a669bfa3bbfd313f183145ab4
SHA512 4048da4e897faacc671da1d7dc64afbb2b6d1e7c77acc9b964faed3cb8a513ae8b6c257ae176f32c3917a21c715b97a296424b81807a94026cf3a40b6a3b5513
SSDEEP 192:ZK1nLj0TVVE+cHH/Uk/G+Fj9fKpCpixw1zPm/:s1LjyVVE+0pfqQ/1C
TLSH
T11F032A71138EC544C8F311B7DFAF0C06A915B07D7A7A2E191A7E84B29CE30DF981292B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

head_vidoptions.bmp

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\ricochet\gfx\shell\head_vidoptions.bmp
Size 36KB
SHA256 f68bec0fd9e26d7106b27b7898303db849ef18345b133002945115b1dd4c80f7
MD5 62ceb734030d7532c67e48242616663f
SHA1 0893b965fd76d45e0abe864c411d6d9308cc832b
SHA512 121821ba1c75bf641fefbe5951099e9c1f64fe168fb8f13b9596747a2a4f170635057ab352d41a43e16fc474a57209bf8cbb78299ea79280f8dae1493e09cf4c
SSDEEP 384:A1Lj2tmVM97lGQRASxktoFd0B8M/8BXNUK:WLj2tmVS8QySWtoFSB8M/8B5
TLSH
T184031AC21D746FC0E8ABA87DC2CA0AF9D95AF0106475F5C92E231CE2042D4F7A93646F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblist.gam

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\ricochet\liblist.gam
Size 409B
SHA256 0dab0a08864d1dad75aed039e96b3357d981eaa38492f69b70b30b9de2d75501
MD5 b150bf02f569a2d91d69ef7d467fc14f
SHA1 6d73812d2627b5e3e0ebc3abf69bf082b2c97f06
SHA512 39f6c65e5f5ced9ce562482cf292f049f235fc2bb043ff014701ea0dad67b4fee61790cafaec7ab09e5a073a092e96e9859b45d4206195ef81b22e83b0b23af3
TLSH
T1A3E0AB0FB75502974F1590359613700FB1AD23DED795901A301040383081E9EAAB6622
MD5 SHA1 SHA512 TLSH

Submit Download

three.WAV

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\ricochet\sound\Vox\three.WAV
Size 4KB
SHA256 a517b8dafe030cd9608dd242636e7050aabd5b49ea498257723c356c2e8a68bf
MD5 4f386f62a4f64278c086cc92e791c3a6
SHA1 182789850bfcaa498f985e7923a6928d2324e4b6
SHA512 9914f11f681ba3f9ec40fa61318dfb88d34f3eaac4389cfb5da175f7d591bd766b4c49d9149b20fe2db4e5638c8812db93cab0838cb70db282e819ae591e4584
SSDEEP 96:sZ1Vwe72SLJ2zJD0iTal7f3/l8mCrRHdFucdncqQDOsaB/I:wz6SQp0VLvWvFu+0haBg
TLSH
T102A17EF2D0E2D9BB0206A2C3A939CD8CE143987DDBDF250E2654F45287D24B6C04B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sierra.inf

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\sierra.inf
Size 7KB
SHA256 7d4f12c3c2a4d560ff57327b2977da934e0f1320198a490fa12397da47bf8007
MD5 4e44ce655d351a117425b4c6167847cc
SHA1 b143ebeaa834bffbd863a9e11b7d2bff9925b551
SHA512 765999894d6a0d54bb6b6811615d6102ef05d271c0ae6fc8e269e6d6af7e739fbd8d4fad26af7c28863f0bfd9033584c8650f3ea954f49444046395036066fa0
SSDEEP 96:H2twwNDWbQNgeJ+0arMMwp2tqARiH7Wf9YQHQCY3Rp0Xbmn/zepUeP+88jY42Zf:As6b+9Yz2mHaYMYNn/AwFjY4K
TLSH
T1DCF196D92E8673B31A9AC1119B1D07A3FF238FED63EDA004345EC148135A41A966F9F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.dll

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\sw.dll
Size 993KB
SHA256 8564014a098ca6cc7aa9a9a1f9dedeefbb2ea4b6d4e1262f9dadd55ddf324391
MD5 3d4e013135d26750991016aea776e174
SHA1 84557bc249495de85b4468a6f44300b8fc1d2171
SHA512 c08cb8e81f6010d55d065040323ad595aef2a9e135d6804b6ec0c97c8612cbb994525a4839148061679f55569cb7288b3536bde4883f71cea742db2a81ac5ac9
SSDEEP 24576:QHP9ykrBcmCW74yGOjynY+TT7Wb7J8EhRVretrY3aXvTM:a9jcmz8yM1TnWbl82be57XI
TLSH
T1082512879BE878F6521519C26BA8E296135590E21537AFF8F8C376394014BDFCF30A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swds.dll

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\swds.dll
Size 1.1MB
SHA256 5d53bf034490ab7a36cd644e123f94fd312d47f4fe0d310780e38bc564f5f9ac
MD5 187a300a636d01a67918b706a5ef85a4
SHA1 8472803166e4528ff6f2abd40ed83a242c159660
SHA512 fded868a8dabbf7a1a8033261b7d11c2987cbb6a73295e51f3a1e58b2b56ebe5d7c1251ffc50d8376cdf316cdbb4261eeb9e2475762065b322ece5ebc318fc6d
SSDEEP 24576:J6LHfLy0ksH9AXuVCaAyUKqBAI6qtFVYqoX9ueBk1A7ilcvPDSB4O:Abfu07dvwaAhhAcFVDeBkSSB
TLSH
T14245AF32EA10C0B6D4E1C1B518EE773E9A3C6699931192C3A7C8D9D949B62F0771F34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tf_sniperhit.sc

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\tfc\events\wpn\tf_sniperhit.sc
Size 15B
SHA256 30ae8d616f3b576597606db88653b12baeb25c7a7398d03c7c08cdc394ce1e2e
MD5 0fb215eb8ad9262c22bb06f48a210441
SHA1 91a4d86b62801b643f491c580b294ca997a7adab
SHA512 763235f70c8afdaa6f696d676eda4a9c173ee7d15b9ed2f2656d2c5cc2dc101b7d645dde557972ebde328da9a4efda3d07090d3f81f4b3685bc3db42616d8afe
MD5 SHA1 SHA512

Submit Download

640_pyrored.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\tfc\gfx\vgui\640_pyrored.tga
Size 128KB
SHA256 9ab219b92e8e71fc5975d199ef796f834ca5daf2b7da45272a7d64c8c02865c9
MD5 2d5c3b4e8dddff81a522a25a75e94ad7
SHA1 7e2cba5ea145f6393d2f4dc4e52ef1f74b47f39e
SHA512 3a416fa949b4241dd8894a7b30db5f26e63e44310a2166469ab1662fc3e865d6d2da5f1b9387fb47e114645cfc1533466ece0f8b69b374e1d2936839f1649a51
SSDEEP 1536:JfMSbxnsOTXhbnNrGSUtADDTwEu23Y6l1G:PsONjNNU4Po
TLSH
T10AD33B2C0BB9D80BD3522B7D9ED0F738656987A13D2E8706DAA22DC57F24F8D6D84080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblist.gam

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\tfc\liblist.gam
Size 418B
SHA256 ca4e39ad63221047149fc2e35b2e37afa6ac54539d7af2f80dcfb03f5979650d
MD5 026adb95b703535ef20b9c76bf219e38
SHA1 33a9f0d40dae62626912e409b2772b3189cfe8d7
SHA512 2fc3ae6fd8e5979d6cec95ece8e4a8de046d232956dcbf3feb8a38971856981f93b53198ac14a3de6385e03613444c47052fb096abf8b22cfc94d65027ca5327
TLSH
T18FE0AB0BA6A85A73895590356B43704E7ACF31EFF790A117702440383481E2AAEB6728
MD5 SHA1 SHA512 TLSH

Submit Download

warpath.cfg

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\tfc\warpath.cfg
Size 21B
SHA256 23ca0bd6eb48a10587a7d11e60bd00e6b1df27ef463fea2d441e6720be3d6189
MD5 9693f6994d48acfdd4afc32417caa898
SHA1 002c87e73742f24c6963eb5fe507a1e7f97ae1b9
SHA512 542e0430bf9ffc83a80aba636cf1accac2589a1ccd81e45d575f4baef3daaaadb659873f091e30c76ac28a4ff227245992581069c2e02968d1ada650c1e35b6a
MD5 SHA1 SHA512

Submit Download

c0a0b.HL2

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\SAVE\c0a0b.HL2
Size 12B
SHA256 497f71cd5d814550c1b15dce262d5d43457c76bd02cf1f255ad31b3a808c4c17
MD5 71842d232835530050a4729b24fc7a7b
SHA1 cf5358acf10d6144ff285c43604e7e75b49f3626
SHA512 11c03fb83e4240a168884910bec60524519f74a4318fa01ae087b2d4d478a5c930673b398ba733ffbab1ce174058989d419c77c904395672ef20990d10d250dc
MD5 SHA1 SHA512

Submit Download

c0a0b.HL3

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\SAVE\c0a0b.HL3
Size 8B
SHA256 64ed86b909d6d0502b64b28db0ea1272ffb358e20e9b1d88b63ccb07fa900cf5
MD5 39d997ae6b77dab1dfbabb6cf0e4783a
SHA1 00e1c2d56fbe02fb8eac46e7693964fc5101a850
SHA512 2926cce8f45887d8d756cd6815358e17196933723a7c905f95efc2b35ecf26c661854803c246f1c8a45eef2cde90e908ff194be594dee90d886e723e9b68be55
MD5 SHA1 SHA512

Submit Download

config.cfg

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\config.cfg
Size 2KB
SHA256 7a6b5a43a81e318a649dbb65dd328dd17fcf025b1d63f9be38f1ffe3b404184b
MD5 8b0203dde354d876be317d90a93c4c2f
SHA1 58cacb959c0fc57658327c4e3dd420cf1a6efe9e
SHA512 1cf5a9954aa6a64f0053a293fedf05716aa1419445ff84cb3a708919cbd7f6bf98c06a4a176c5eb510b9b56dc28f356f1638dc3d68faa94eb5d2096ab449c863
TLSH
T15951CBB7FA116C15D1D74C83F6A7F202264EB01A45DBF05B5099C8F851FD6AB5B3AC10
MD5 SHA1 SHA512 TLSH

Submit Download

config.cfg

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\config.cfg
Size 2KB
SHA256 87b5441378c5542f66475d13c6c0a9cba44afc06f799bcf8ed29d5015759bcf5
MD5 dca03ae5dae7b323a5e6e65c580f4a4b
SHA1 adf711a442d61e301d478c26f5090e0b12e84ffb
SHA512 66ef92fa443f8243826f3ae3de64ed778563a590f19a77f9c81de72489fc8dd8011336af19aa28371c9fba80a7f76d1a8baac776f07a414bca5509f510f244dd
TLSH
T1DC51B8B7FA116C15D1D74C83F6A7F202668AB01A45DBF05B50C9C8F891FD6AA5B3AC20
MD5 SHA1 SHA512 TLSH

Submit Download

decals.wad

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\decals.wad
Size 903KB
SHA256 17726e8174729011c7ea4e1e37b4ccfe7a9aa4abb82c2aaca87872cbe0c106d0
MD5 72918552c9e1c8f19fb5667eb06b171f
SHA1 dfaae5baa75081f930e3dfed004e4a8efcc1c37d
SHA512 dd0b910a818d2558b1b7d39420c5edc0dde1a8849a3f46c6838ee56db1f3fdbb37d9800e517780787ac0f62bc1e3d1f6fdb35e756ecc3a47583b8903025498ed
SSDEEP 6144:9ZZwzemuvpt3fQ52b1g7BOdIT93Ju8ag2n:9DHfbslB39r2n
TLSH
T118154C93FF2D584EC64C597251AA032A2BB4740D13059B9F024478F9DEDB2C1EE9EBC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

delta.lst

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\delta.lst
Size 12KB
SHA256 bd567f5ec6da7138fe6307bd95ff5d46077ca14ee36a88ede3bc67a31e12a02e
MD5 e2bb42560f84420d5e5cd0cf01b73bde
SHA1 070dba2ab9cd081ad7e97c90b7d486c5deb5a866
SHA512 9604d08dca0a2d8cbe8af548224692a91478a98b58383e2f908d1386bffdef26fcd6b44d34f1749df5a5ff583269629aa30f268f74a0c6513d7839b7216a0164
SSDEEP 96:TwTRb0Mw+emPBEudmbO/TELdmTQ2UhLS+8ed550JW1w:G9fNmzbS
TLSH
T102428F2CB99D5C0B6A9ED39174614F37583B82E5AF0E56EB35F812796C72210C2783BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

egon_effect.sc

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\events\egon_effect.sc
Size 1KB
SHA256 2c7d43b8dc6ea01a32acddb7798b9dabf0ec44c7a6dcf75160539a7fe53e029d
MD5 8cfcc0a84d0b6b51995ce17bc9f194f2
SHA1 f86d5edad7e5a3e2d994517da5ebd7d748a8c666
SHA512 5f75243ff3e13b557859d89593432f5e29f014f2bc527bee363be3369e884feccb15ee593094c7eb0f8e4786b6a352cdf9fc6039636782cd23712cadc114ee1b
TLSH
T10431DF5E3BDBDB4C2D8AF248DB348A90B6EDD5C11107628977EC5B4ED25882C47B018A
MD5 SHA1 SHA512 TLSH

Submit Download

fonts.wad

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\fonts.wad
Size 101KB
SHA256 d6989bb9fc90c437f9957cc7bceb8f2550b38b8791df679753b7c08c98632b80
MD5 ffac10d555a864f16de86928ac5025c4
SHA1 3bdc2ba931a07052e1e5ae5aad30fe93e3f735db
SHA512 dc468aff83bdec609f6a54d3a57dc1658f621c2032cab87bd64dced9f2be7646a3d647869c5989933e9870a26158fa9310495ac68e4c34dead5d81473250b53f
SSDEEP 96:K1iUwZgnvfnvfvH/vHvg1IkgnvfnvfvH/vH6gnvfnvfvH/vH:K0n+nnnnnmMnnnnnPnnnnn
TLSH
T12CA37A42AE68D663F876023E34B348658D471FAC25E70B08FE6DBDCBA3F1644199D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gfx.wad

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx.wad
Size 84KB
SHA256 6fd53d6ef8d704299734018e3069ec12551e7fb2065804a1d4e5c936ac4033bd
MD5 4aa832b05c000366fcc03467a5875d44
SHA1 73aef47a6aa92390d1121adeb150fb4be877893f
SHA512 b5d0e825d28b88c52e4948a848971a0c8e317ff7ab92f6541d885a512c842c80d41718408eb77ce924dc17ce5a8d968d8dec658b91fb15c3670cedd982189ba8
SSDEEP 384:gMRk3II9u/l4MhM/lQ56MjMwNQa4xO/Kv:gMS4Ik/l43cNx4k/K
TLSH
T112838515BAB4EE06DC681A795CAAD1FD1120BD05DD02C38B3AC73F6FF8764E54BA2580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btns_main.bmp

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\shell\btns_main.bmp
Size 844KB
SHA256 3d019e2a8fc85bfb965c120f716557f085cc13475ed31485fb7fcfb26bb25f11
MD5 9dacebe102fb07863bcf58beed7c4dbd
SHA1 0b895d1bec498f6491efc06b5e7cb7e9b8ff1dae
SHA512 4363780a65dcf6a9aa99f2ead15ff6f90af665309f50301e8541403afd5de411c89da43eee770c34ef94aa6ddad2f824e0a242e288783179a6016a72256b5835
SSDEEP 6144:LYJkgXcDr5fecjY7gwakfv78UrGsYVFQbL:Pr5mqqZH
TLSH
T17D053AA634D24179D3289F7E9E14F9970CC67AF6581B918338DEA74F0333B160A97827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb_checked.bmp

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\shell\cb_checked.bmp
Size 1KB
SHA256 4d86a3362c721e0e63a1a5426e65d001945ad910e4450ca281c72c2eb3835b14
MD5 4a7b9e91a5e38b8dde19ac2e963cb272
SHA1 8e674bde0fe1d6b432b1cba7749fdf840367f4dd
SHA512 a67c27e847c6ceb4c2f537e29c54df8a874181e94e9d15a17f6743a8c307961a935dd34948fbe805708664780b558e8ba65bf62917962388a8957a10f6ec884a
TLSH
T19B31462306254CDCDAD8C8378A8E8CBC1434F44744D57AB5A3C18E1F5F27EEAE21222E
MD5 SHA1 SHA512 TLSH

Submit Download

cb_disabled.bmp

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\shell\cb_disabled.bmp
Size 1KB
SHA256 3733d610783c5bb34e00063746452037de0ac169ba9de932bfea59b351c3e4b2
MD5 5c434ea6404676511a7076ecb22cf60a
SHA1 5fc0fa9d7bc673642a4a8081b2f94b6dd14bc5eb
SHA512 c965551ebae4308649e8bdb2f8bb5e5bf757825590c5f83a42a366574ea45d0127c6cf8abc1e36e105aa56ccb5e505f0d0242b80be37e6396206b173c83f21cf
TLSH
T1BD31AF360665C89AEED4C836858A5CFC1424F83742967AB473C04DEFCE17DEAD21725E
MD5 SHA1 SHA512 TLSH

Submit Download

cb_down.bmp

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\shell\cb_down.bmp
Size 1KB
SHA256 5c6ec4c93db93690bcb1df918569afea0171cc276a26f6ffa32d77e8c07cd46b
MD5 35f15f0acecae155aa2cec0e209014e0
SHA1 720ebc5f64330d6a34b8ca89e160a6cabc1975f1
SHA512 679b31cf8c66047d3743d6515abe6bb88fc27eb902809232618ac7882544d014cc54ebd75f52ef8be9a0b38323b7d0e4c2729067078eefbef63890736a280f0c
TLSH
T1FC3126F60526ACCAEBD4C833898A5C740824F82704877AF853C04D1F4E27DBAD64669E
MD5 SHA1 SHA512 TLSH

Submit Download

cb_empty.bmp

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\shell\cb_empty.bmp
Size 1KB
SHA256 e7ab820798e6a0a93a7b9c3e82d192b5a20740495d18e7f4c634a57e7342d938
MD5 7ebd7c736b587aeca2b00047195c7482
SHA1 9e67feda369b85b682d8dc7dee66105adc281c6f
SHA512 95de5f96f8e3273e408e527f3fec66e36d98ef158cb77dcab413417d000aa116c970623d03763be7d8505e418ae3e51e5e9fac2f6715fca2bf598420fb92aaa4
TLSH
T168315C26062D4B88FAD4C836B58B58B41C27F81740967EB573C04D2F4E17FAAD2D525E
MD5 SHA1 SHA512 TLSH

Submit Download

cb_over.bmp

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\shell\cb_over.bmp
Size 1KB
SHA256 7647a8ec321f65fc937bf2cd2d772c6f9c4fbbb06aac62bf0b1dfb0aa9b60978
MD5 d7914d380977d4580d3470ff381d75d9
SHA1 a3832f52ca7e2fbab29bf995e83599292dfa28c8
SHA512 e7ebb3337ecd5eeac7d015c2e408999bb2ebd8eecf3fbf92dec531983359137d62c71882287e19d758d470e0874e2c5a1c4d8794fbf12bd4865b6951d6569dd5
TLSH
T1A7310736062568C8DBF4C832C58A5CB915B4F82B5095BAB573C04D5F4F17DEAD22429E
MD5 SHA1 SHA512 TLSH

Submit Download

colors.lst

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\shell\colors.lst
Size 262B
SHA256 f2c0923674e31c03d77f6687d8237f0c6e7b429c39b92cac5c46dd91297f6091
MD5 8a80db2debf523fb297fec76cef8153a
SHA1 9e41facbf73ce9ec6ca85ffd932702d62aa4f7ab
SHA512 e53267478b5ededef7a81bcc3e0c71a00f02fe506dee1f57f99af6dae2a763b0fa470e8efd860364ee63ea3b7750b412b8f96378997f9d8e99bc831517caaffb
TLSH
T1D9D0178E204D0D8A482BDC8F7088E52032FCB75800981A02FBE68384BD4432ECCB0E24
MD5 SHA1 SHA512 TLSH

Submit Download

kb_keys.lst

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\shell\kb_keys.lst
Size 9KB
SHA256 0817b5a5c8cec8894354207b8685de93e2cca8f9882632b048aaf2531a77288b
MD5 e2695474c78e05b7695abce361674de5
SHA1 3a0ed95a1592a09a7afb96814d74747708822e90
SHA512 90fd26b471ab19339089d0553665c08acf7adeadc6603ce6477a851104e2e52ac9c8b71dc515d4ef7dbdeac6acd2d6ff07b0464b4724a266f7543907a900a5cc
SSDEEP 96:iyLykypyqynyQyVy2yiZykZyJyByKy1ywyTyWyWyTysyxyyyPy4yT5yryuYyQyNG:I5ulGEp8gSxrKNsvktB1ItUq
TLSH
T1B412580DBBC91762C1A7A1C905B50FBA2BDFFE1718072884657437BFD0F92035B59AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unlock.bmp

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\shell\unlock.bmp
Size 1KB
SHA256 bcf5ed86e9d724e1601cb06e5bd8b027f9e215c42610b865e8101676c877a431
MD5 61c960e1f1ff6ff398b2cad0da1f165e
SHA1 ebc8424441d0f43cec864c9847c3f2debbb8748f
SHA512 dbdbdba1c154cedc52fb9a16c1545ca04d49de7033a269a0bef97c216815b829c592ffa9f360f4c8d990eb3a85962e86509ff27f7c12cff27692f2ace664a108
TLSH
T1F621D33607245888EA94CC3688898CAC1528F81780AEBED537C05E5B3F03CEED66115B
MD5 SHA1 SHA512 TLSH

Submit Download

320_checked.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\320_checked.tga
Size 1KB
SHA256 e56f4790aec83ac5f13e609e13bc16b4905e1e0bf45cba6f5965c35710eccb9c
MD5 0ceb72f38c5d7a96f57759590b2f9a8f
SHA1 d916aac4fbe8312e13f0264add4ee5208ec7cda3
SHA512 55a5c69f98a7d3ef571d2431bf4c04bb2bf604b1c37b7e31f16af316ad50d4c7590710557751293175ead836720ce30ce36f59f6140b31c43ee07f0674b3befc
TLSH
T1B111E2247AB11433E1257B3886E7D1FF34528E2B0BC29564ABB13C7B31C921127A3944
MD5 SHA1 SHA512 TLSH

Submit Download

320_unchecked.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\320_unchecked.tga
Size 1KB
SHA256 766e19d7a219aafa1a49036e54f754032f350ab3b63180c03471605676eda12f
MD5 b0ff1818daf2b5b9c122de82aad9e1a4
SHA1 8a7c35d78b99510b4595181ed8299dfcae0083ae
SHA512 252146e1c747b4a5be8633c4e69782eae19662188edc52e1f0c3d536642d5a746907000e692c651f8ef33cf70baec4d35b8abbe3faa9c71882452acaee7b78fb
TLSH
T1A011072139638925CC4425F58059C4C954147E2B17D099CFF8823EAE2615CCD5BA3F58
MD5 SHA1 SHA512 TLSH

Submit Download

640_banner.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\640_banner.tga
Size 32KB
SHA256 0692b049994014f43af78721b886de02221f4cd3429983ffac3a05593bd80c10
MD5 71f25f86ca0d0d988b1ca55eab861279
SHA1 9162248cb5e36d42a33954a96383a85df8555387
SHA512 d9e5257583c995da0d294248bd831d4ee92aaf52066abb22fdf96b39f5c81a4c197aa45d348bed6d196b313750cdbed942cfad1f9dd8b4c9a076ed2023900d72
SSDEEP 384:cr+ICSy/tMWaM/0yhuTW3uxauswAZxphaeefOR4VQclDyq:C+wcpZhuTcuxauaYUJcZ3
TLSH
T1D6E280719A8EB716D329DFB018C257AF612E7DAA1D0E418CD74B2FF8C897AD83150740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

640_timer.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\640_timer.tga
Size 828B
SHA256 67b34922a90dc6a10f99e23539f4a0bcd1458e103b79ef1a78d5718e4ccb033d
MD5 a8dea2d565db9005ebae0ff9c8627c08
SHA1 18fb8e681836759fdc8f132c3869747d06ed4904
SHA512 8ebd9eb53b70ca82308f200398a691ec68f9d3d86c24e8954c4096f0054be85c05ede25b6e0eeee9080b33eb913c38b9e5d1e7504d669d179616bb60d9594c02
TLSH
T15D016D473EBD0C00DD04BD62862DBDDD85F15C92E23BD563867E3DAA331356A22B0028
MD5 SHA1 SHA512 TLSH

Submit Download

640_unchecked.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\640_unchecked.tga
Size 1KB
SHA256 8d0abf3ab748b5035a18d041f8b8baa82d709dc5b1124ef62ec6ec9f6e0d713c
MD5 ff766a85710836d5ce980746349d873f
SHA1 ca3789878f7f6b04f04a420c66f33ee8866b2b07
SHA512 5cae7b07d3a5c57172df8e78d536b16f7619ec8ee083c6dbc6916b59bdb9776de97f776e3beb9e7e1931e1e1b86bd0a73db56a88e74f30e9f5c234163fad00c2
TLSH
T13911050C3D624135CC47A5B5A15584815BA47E29169203CF66402EBD2625CDE72AAB6C
MD5 SHA1 SHA512 TLSH

Submit Download

1024_Team Info Text.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\fonts\1024_Team Info Text.tga
Size 42KB
SHA256 a67f1e75f5aa512cd92482485cfdafa0e46025e2b24cea5c8d8b0f2814655fb0
MD5 da94597f8fecd4665a5b7402c2690c00
SHA1 a2cec1d5a5b7d99a441146b52882513273141e1a
SHA512 6f3c6c42291e9b9b0029374200bc3990ed14f79debe6b121598871d6b095ee6e5557d00ca2231413168792816da23a6f70da335f9144f2c3895cb4308bb9048b
SSDEEP 192:LWcbpMc++bCXe/2FZLxPZTKbAG1tbkvO++kI:LWcbOVu/2FZLxPZTKUG1tbkv9I
TLSH
T19713CE743E3BD531C2F9B97020A64F661D19B684CD881D27FBF147BE1A183A770521BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1152_Scoreboard Text.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\fonts\1152_Scoreboard Text.tga
Size 45KB
SHA256 e956d82626b7f302431eb45478894fd7369fa10fe19d664104d0f8c12b2e7ac1
MD5 15e6ec2a0ecf7bddbb91f3896909e65b
SHA1 c84f6365de27d65858b775f0b5a922be0fae969a
SHA512 567a8bf6266fdc33a48d4b9b5ee20d451422b9593e2d72cbe6e7044b3064bbb6571ec688bb90f6520825cddc091254d41f92176eb51205b487d61ad92b24ede4
SSDEEP 192:a0NMiNB0KXYnhB3lCssskQ8a6qwi5Sd5gysssM0s5dl16ybRlLU:a0WiawQSbz0GllLU
TLSH
T11E23B7283E3AC923F0E52DB420964F760F1D3494DD78591BFBF19F6D19182EB70A216A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1280_Briefing Text.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\fonts\1280_Briefing Text.tga
Size 51KB
SHA256 a0e76c8b3495fca1cb0dd87b90473ae3fbde0b44b322aa040347d7cff880faf3
MD5 7a3f838e2e28b41812a3f8251753e443
SHA1 7a2d02e846d47a3c4022d9184c3e78fb8b94df91
SHA512 7f1f0f37b17e1a189c8fe80a6b874f0d62d01b123ac5e37b1dc39c6e61f12c07757b3a43ca78cf4f5b0963f23fb6796db377711adc49d9c865d35213656cf7a2
SSDEEP 96:KY4ahGSHF+Ybp5bwGIWubA3NT9BhJfv3E7X8lmYIUx7qzqhuH6OAjVejf0+cE1K9:pwYebAFDasIhzFGUA+pJwzN
TLSH
T1BC33D6903F2BC833F1E9297420654F960B1D7998DCB4591BBBF14B6E06982EF30B516E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

320_Primary Button Text.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\fonts\320_Primary Button Text.tga
Size 14KB
SHA256 3d0093ba3db056e172bfeca7fc95d8b45970542a930c7fe1f458abaff1d689b0
MD5 992b399e53105ecab86f55785fc9af46
SHA1 70050f9e62579f8ed83bde2584d528fbfd761456
SHA512 64853327108ba51050000598621b1ddbaca4892bc9a93a373ed6880c1f976a3fd5156d67b11a4dd37d6dad78f654a1d9c4f2ef1300020b76728d02d9e367305c
SSDEEP 96:WJHa8pf3o9vZ4ppppppp8ppppClBDppppqpKIp3ppzfppuwMbpxTfaACKZpppppL:WN1
TLSH
T120622C647A76C632E0EE5D7814DA0F5B2E3A35D4CC289817BFF2D75E0D2C29B3052268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

400_Primary Button Text.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\fonts\400_Primary Button Text.tga
Size 22KB
SHA256 2e5fcd0992f502cfbacbbfe73f9b18a73b9684f9630cb690d471df8fb14f533f
MD5 3b8814963239105dd8074b676aa50631
SHA1 748764befb5264887cd05d4caa93ebbdb06081ae
SHA512 7b9e7290156cde5c59c0e678de2b71594b3ba23c8c0809bc3e147d085eb515578e4cbb789e76eeee640e71a394f8ba2f66bfc429965d3eae4d9fe8029d7cf88f
SSDEEP 192:e6xnnnnnn9onnnnnnnnnnnnnnnnpsiyC++guZBnnnBe4i5znnnnn5+aKM3nnnPTq:e62B
TLSH
T18AA2B6143A35C631D2F9ADB4208B4F671E39BA90DD945D27FFF29B8D1E182D73052226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

400_Team Info Text.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\fonts\400_Team Info Text.tga
Size 23KB
SHA256 9f21879d4a989c2f7c081134134568ff489efa6f773b498f3a6156f3799418f7
MD5 1bf90f34460867fbb78ec743425e62a9
SHA1 1149d38fe5e8467653683e92ec1f191f2fdb582a
SHA512 1361199b1be5a81f24edde71e7da3ea8fed481968ca63ecb73f5ef637f8e8b0090ee19857265235e7250a527fe93eb37d105666ef8db217e1feb619847b9ecb5
SSDEEP 192:JFq/Gs3FtU8EnnnZgVNqgxNnnnnnnXW2DqgnnnVakkdOMsdKuL5R9nnnd:JFqXNB
TLSH
T159B2C6243E36C621D2E66E74208B4F1B2D29B5D0DD985D17FBF2DB4E1D28297315323A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512_Scoreboard Title Text.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\fonts\512_Scoreboard Title Text.tga
Size 34KB
SHA256 0c97c5569772742bcd26d3d6c69b153d20628db5f17b0de5cac51bbfdfdc088f
MD5 6c78ceebe6924aea1a2d944af822de8c
SHA1 0e7d4d6c6a4ef97d0b6ca1026bb5898ce0bc536c
SHA512 65db047b8fae8f9206980649634f6d5307c0418d5d9dd6fde160a4b4411e5d72f4f084abff79a540d1d31de267063a108e51ed0cb557b1eae64f1f67eb8c8c89
SSDEEP 48:dN6p7eJ0P1olcoBGGoNoB8or513lcGWnu/wwKS9qrMXOOaODVOOOOOOQ1Iq2222n:01Q//pjdB2Oh/pI9Uq6cNeoSgwK
TLSH
T12CF266643D37C931D2EA3C7420AA4F562D2D7488CDD45C2BFBF2875E1A5926730B222B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

640_CommandMenu Text.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\fonts\640_CommandMenu Text.tga
Size 27KB
SHA256 b8a98520c0c6853b9faa52a87c4db5cad47a2b472acfedbab6f54e731e4997c8
MD5 d8be41d144637fcde27c4b3d3371b5af
SHA1 9765a21454695d13161738ade79e511dd29984a9
SHA512 39cc9f7fc058f8f2d67d3da6377c663a14567f0bae613fab40f0dfaa7ce3c9f1b146a7024acdfefe45628f70aa41f7335c103e43801f8f6a657b54139e2981d9
SSDEEP 192:vekbTIzmkkkKkkkQkkktj4i/C0MMEl0E+kkkkkwkkktkkk6G0twjakkkhJd:vWVa0RwzkJd
TLSH
T142D226143E26C631D1F99E7420CB4F5B1D2976D0DD585927FBF28B8E2E282E73152239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

640_Scoreboard Small Text.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\fonts\640_Scoreboard Small Text.tga
Size 19KB
SHA256 123e5d33c4f9ade6aa06d4f754a5df4ff933a97e825ee17dfe1495ddfe552cb5
MD5 0b5c148725771202f66a54930fc2774b
SHA1 8c7bec83b3c818bb693fcef10182c59f2198ebc5
SHA512 db1b553c3aced1b0b4a7b0c78b82792d7acec8dbcb0e4c2b23a85b6e33015de5163d6b7796b1de8702c75c29116ae22cfc0326c44dea6966daf083edfca30886
SSDEEP 48:fXorISgfzizOGfo28WTTTTTTFUTTTTTTTTTTTTTTTTb41b91VgpbwMc9CBbE/bkg:gm0wSAWd/vmiF
TLSH
T12C9261343767C612E0E79E74245A4F163E1E3690DC64992BFFF29B9F0E182D730A2225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

800_Primary Button Text.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\fonts\800_Primary Button Text.tga
Size 42KB
SHA256 87ee0842512a0456af07c374a8ae6cb85f95d7c1f54367474c00def78b575b1e
MD5 213aa4f7ca8828d01a21b24e2f692e53
SHA1 5bc2a5ef766f81acbe38b04cea06383333214b70
SHA512 e6b52345f9efc99063abe8560cb45394467355ed8cd9882c00a94d5a07d6942fe42e8751d08f9eb482750ea3efaeb025607c6941f02cf212e3f7daa67a3f32df
SSDEEP 384:26hOqjBzNrOMnCEcXx7a3muG+4Hh5INQDoI:ZhOqjBzNrOMnCEcXx7a3mz+yS+T
TLSH
T1281386783F2BC925C1EA2AB030A74F772D197484DD585A17FBF2CF2E1D182AB70911A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

800_Scoreboard Text.tga

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\gfx\vgui\fonts\800_Scoreboard Text.tga
Size 30KB
SHA256 307419f8610832eb1b2c737c56c818b1451682a2ef1d89d24337cdb1b95f3b9d
MD5 f25d3135b484e3a2bce8e915d7489b7e
SHA1 067cae5d2ddb6254c5991daf47df171a9aad880c
SHA512 a08078a13e0e94c90166871cbf1127c6e6eb2704a955d5fcd07c38398367926de428540d140b3cb0c3c7e29f9de948907ca792a0e78e13e4011d0ecd8c511dd2
SSDEEP 96:FCEn5MAbYnnb43vupoSHBwVJA2xU3RPGvfpyOGZ0hdaZXZQv:EoMHnb4/ulmVC2Eyf0FqGh6v
TLSH
T1D7E28B943F26C631D1E96E7420EA4F5B1D2975D8DD98181BFBF28B4D1D2829730B223E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblist.gam

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\liblist.gam
Size 247B
SHA256 3f7a7df28391d10e106665f54f886f0c3ec365065d867c93e518223a71421d9d
MD5 bc17b4181180aba2325a9ed92d2e49a5
SHA1 5c5fabd2850299c91405d47c0c62c84d31e65947
SHA512 1a3efce764d4101ff9076787ae1d6ca6fcbc0d9af94abf538d624c5aa0ae06476f9a8f23971655d450931f9f451516871fe9cb0117fbbf4a9b8534c6c6314d85
TLSH
T199D095BF3F19410245F81C7F7541720CFC7713DF4512550BF040C48D6083D567165580
MD5 SHA1 SHA512 TLSH

Submit Download

launch_select2.wav

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\media\launch_select2.wav
Size 17KB
SHA256 bb580215824dd89825f114f4fbe5514f0e9783a1ca7bb7aed2376fadc349b6aa
MD5 ba95b09f6c80b6d4fcc218a4009c0ace
SHA1 485f01c9583afbf375083096e42da24bcba873dc
SHA512 d962895d9d776580d2fbbd157ddec4bf57fe1f8c0c8dd3a9a09a69d88bfd815d75a40e74973b15c485cd2a706706004e88e7a3a426cbfa7783a6fc163b0e57e6
SSDEEP 96:+QM/9cv8Fi3/nnv0s0NnfS/Mdytl8ivvHkN8jDkccPaE1H3q33PkKX38nPC8IrH/:+QM/fmv0kMU8kMUPjbPrD/Xff7L3
TLSH
T1CB82A9A3B0522C21C40E5B7A5D52B3715335AC6CFBB747612AC89E62BD9EDE03A443F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

woncomm.lst

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\valve\woncomm.lst
Size 607B
SHA256 c1470bb28cab77acdd3beecb02ae96d7eea9acbd4ab473cb5873760b39aa2c13
MD5 8e928f1cb475a11bdac9f527f055b37c
SHA1 50c1f71ddcf34bee59c0fed7bfa34796e1c3a962
SHA512 57eed6dc8ce70ce5c9c0f70c0f6a4f110cf8b0d08285dd060c01a1eaada94b9b238b6c97473139f4bd8ce39041e17ed6c9bae1d2de495929a2025985530ae827
TLSH
T136F0AFCE740B896A4AD6AE081B336481A1CAE0FC5CBC49D8BD6A65CB37C3D5CF185019
MD5 SHA1 SHA512 TLSH

Submit Download

vgui.dll

Path C:\Users\Admin\Downloads\Half-Life\Half-Life\vgui.dll
Size 360KB
SHA256 d15db640bbdde37d6d5c002d33c066d28f5bc04bd089581089c9bf6719eeb2f8
MD5 efdf51ee628ecefaa9dcc55410ff13f3
SHA1 39f25c58ad98f8c51a5825842b273915bc2ef3d7
SHA512 c0fc4afee827966219fd62efb1b827428c3ac6dbda46f7e8ce883f79cee408710fee9efd203fb9cf76759df5dc55ed9d815b5f072e66fcff89b4947436424270
SSDEEP 6144:frXaVHOomCKuurKkOi4feh11CSUWnEsCuGMbu7dy40aY5gf8:frNK8C7z23
TLSH
T1A1741A91B5B201E6CDC9CB3818DD17BBF93E93A9C16653C3A65CD99406F32D0C90A3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2360-3785-0x0000000005C60000-0x0000000005FCA000-memory.dmp

Download

memory/2360-3782-0x0000000005A70000-0x0000000005B11000-memory.dmp

Download

memory/3824-3749-0x0000000005D90000-0x0000000005E31000-memory.dmp

Download

memory/3824-3750-0x0000000005E40000-0x0000000005EE1000-memory.dmp

Download

memory/4476-4401-0x0000000002150000-0x00000000021F5000-memory.dmp

Download

memory/5484-4408-0x000000000A550000-0x000000000A930000-memory.dmp

Download

memory/5484-4406-0x0000000001F60000-0x0000000002005000-memory.dmp

Download

memory/5856-4423-0x000000000ED20000-0x000000000ED4B000-memory.dmp

Download

memory/5856-4441-0x000000000A3F0000-0x000000000A78C000-memory.dmp

Download

memory/5856-4450-0x0000000005B40000-0x0000000005C3D000-memory.dmp

Download

memory/5856-4447-0x000000000B0E0000-0x000000000B123000-memory.dmp

Download

memory/5856-4443-0x000000000ADC0000-0x000000000AE06000-memory.dmp

Download

memory/5856-4442-0x000000000A8E0000-0x000000000AC28000-memory.dmp

Download

memory/5856-4419-0x000000000F080000-0x000000000F105000-memory.dmp

Download

memory/5856-4411-0x0000000005DF0000-0x000000000615A000-memory.dmp

Download

memory/5856-4409-0x0000000005D40000-0x0000000005DE1000-memory.dmp

Download

memory/6060-3816-0x000000000B4F0000-0x000000000B5ED000-memory.dmp

Download

memory/6060-3803-0x0000000005B50000-0x0000000005BD5000-memory.dmp

Download

memory/6060-3809-0x0000000005D00000-0x0000000005DA1000-memory.dmp

Download

memory/6060-3796-0x0000000007DE0000-0x0000000008B92000-memory.dmp

Download

memory/6060-3806-0x0000000005C50000-0x0000000005CF1000-memory.dmp

Download

memory/6092-4404-0x0000000000920000-0x00000000009C5000-memory.dmp

Download

memory/6356-3818-0x0000000000880000-0x0000000000921000-memory.dmp

Download

memory/6548-3822-0x0000000005C20000-0x0000000005F8A000-memory.dmp

Download

memory/6548-3820-0x0000000005B70000-0x0000000005C11000-memory.dmp

Download