bcab8306cc047aa32490f63f3e6c885c36160fdccec0de2cd999c88232259641

Analysis

user interaction
yes
max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OSForensics_v10.0.1016.exe
Size 241.0MB
Sample260925-xffetaxwas
SHA256 bcab8306cc047aa32490f63f3e6c885c36160fdccec0de2cd999c88232259641
MD5 4c136e6eadd949dd5ede2fd0dd696b2d
SHA1 b36ad465262bdcb403835d8ef5fadac85a887666
SHA512 8e87565d9d8e66e6939e1ed58d776b8f5ce0fd9548f620d6b0c142bf7a810e387c989d9f1c3d4868b542e2d80e1b66a77403c8dbbf30e179a94c6455966bdc75
SSDEEP 3145728:nftTD2oRtyLMcu/qR/aCjZVMV+mThdFoaiTvPU6o7w5/VSLvWMm7YOr8k3ffwXNu:dVxqR56dILPU6J5tSLveBgWfOkMe
TLSH
T16BC8335EB2A459AEC0B69B302731460469FF7D94715F00A74BF9F18CDBB66B38C39206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery installer

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	osf64.exe
File opened (read-only)	\??\I:	osf64.exe
File opened (read-only)	\??\N:	osf64.exe
File opened (read-only)	\??\P:	osf64.exe
File opened (read-only)	\??\R:	osf64.exe
File opened (read-only)	\??\U:	osf64.exe
File opened (read-only)	\??\V:	osf64.exe
File opened (read-only)	\??\E:	osf64.exe
File opened (read-only)	\??\J:	osf64.exe
File opened (read-only)	\??\L:	osf64.exe
File opened (read-only)	\??\O:	osf64.exe
File opened (read-only)	\??\Q:	osf64.exe
File opened (read-only)	\??\S:	osf64.exe
File opened (read-only)	\??\T:	osf64.exe
File opened (read-only)	\??\W:	osf64.exe
File opened (read-only)	\??\K:	osf64.exe
File opened (read-only)	\??\M:	osf64.exe
File opened (read-only)	\??\X:	osf64.exe
File opened (read-only)	\??\Y:	osf64.exe
File opened (read-only)	\??\H:	osf64.exe
File opened (read-only)	\??\Z:	osf64.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	OSForensics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	OSForensics.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\OSForensics\is-OUPMV.tmp	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\FireBirdDLL64\fbembed.dll	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\OSF_Help.exe	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\ffmpeg-win64\bin\is-DBSNE.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\is-G1FTD.tmp	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\ffmpeg-win64\bin\avcodec-58.dll	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\OSF-HTML-Editor\OSF-HTML-Editor64.exe	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\OSFMount64\OSFMount.exe	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\is-BTN62.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\VolatilityWorkbench\is-4C1C4.tmp	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\VShadowVista64.exe	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\is-BB91I.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\is-A80EK.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\FirebirdDLL32\udf\is-FKOK4.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\OSF-HTML-Editor\is-TFTAA.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\HELP\HTML\is-9A7NA.tmp	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\VShadowWS03.exe	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\libheif\x64\is-PFP0B.tmp	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\ffmpeg-win64\bin\avfilter-7.dll	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\adb\adb.exe	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\is-9G1IQ.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\ffmpeg-win64\bin\is-N0CTM.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\OSFMount64\is-TFHDB.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\FirebirdDLL32\is-9STC4.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\FireBirdDLL64\is-DQ6HE.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\OSFMount64\is-F90RP.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\HELP\HTML\is-HSBGK.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\adb\is-LGR9C.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\HELP\HTML\is-UF33A.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\HELP\HTML\is-7MNGF.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\Scripts\OSForensics\is-84MQN.tmp	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\libheif\x86\libheif.dll	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\HELP\HTML\is-VT03R.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\is-3OGKQ.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\HELP\HTML\is-2D9TP.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\is-PDTEE.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\is-LRKFC.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\is-1N7SF.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\ffmpeg-win32\bin\is-TPVS8.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\FirebirdDLL32\intl\is-9IC5K.tmp	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\OSFMount32\osfmount_Help.exe	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\ffmpeg-win32\bin\is-1IVFE.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\OSFMount64\win10\is-0FHRH.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\HELP\HTML\is-0QI11.tmp	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\FirebirdDLL32\icuuc30.dll	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\FireBirdDLL64\is-L57NI.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\Scripts\Default\is-A638A.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\ffmpeg-win32\bin\is-24R5R.tmp	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\adb\AdbWinApi.dll	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\unins000.dat	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\PsTools\is-7LGRA.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\HELP\HTML\is-HTDDB.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\FireBirdDLL64\intl\is-9RADI.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\HELP\HTML\is-KPBSQ.tmp	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\FirebirdDLL32\msvcr80.dll	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\PsTools\PsExec64.exe	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\ffmpeg-win64\bin\avdevice-58.dll	OSForensics_v10.0.1016.tmp
File opened for modification	C:\Program Files\OSForensics\VolatilityWorkbench\VolatilityWorkbench.exe	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\libheif\x86\is-RJTB2.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\OSFMount64\win10\is-8BEKD.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\WinPEBuilder\HELP\HTML\is-E1HD6.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\is-KUOJV.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\is-1NTAG.tmp	OSForensics_v10.0.1016.tmp
File created	C:\Program Files\OSForensics\FireBirdDLL64\intl\is-GD204.tmp	OSForensics_v10.0.1016.tmp

Executes dropped EXE 6 IoCs

pid	Process
4516	OSForensics_v10.0.1016.tmp
2380	_setup64.tmp
4360	OSForensics.exe
2984	osf64.exe
4148	OSForensics.exe
396	osf64.exe

Loads dropped DLL 14 IoCs

pid	Process
2984	osf64.exe
2984	osf64.exe
2984	osf64.exe
2984	osf64.exe
2984	osf64.exe
2984	osf64.exe
2984	osf64.exe
396	osf64.exe
396	osf64.exe
396	osf64.exe
396	osf64.exe
396	osf64.exe
396	osf64.exe
396	osf64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	osf64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	osf64.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OSForensics_v10.0.1016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OSForensics_v10.0.1016.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OSForensics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OSForensics.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/1736-1-0x0000000000400000-0x0000000000508000-memory.dmp	innosetup
behavioral1/memory/1736-7-0x0000000000400000-0x0000000000508000-memory.dmp	innosetup
behavioral1/memory/1736-10326-0x0000000000400000-0x0000000000508000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4516	OSForensics_v10.0.1016.tmp
4516	OSForensics_v10.0.1016.tmp
396	osf64.exe
396	osf64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
396	osf64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4516	OSForensics_v10.0.1016.tmp

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 4516	1736	OSForensics_v10.0.1016.exe	86
PID 4516 wrote to memory of 2380	4516	OSForensics_v10.0.1016.tmp	99
PID 4516 wrote to memory of 4360	4516	OSForensics_v10.0.1016.tmp	110
PID 4360 wrote to memory of 2984	4360	OSForensics.exe	111
PID 4148 wrote to memory of 396	4148	OSForensics.exe	115

C:\Users\Admin\AppData\Local\Temp\OSForensics_v10.0.1016.exe
"C:\Users\Admin\AppData\Local\Temp\OSForensics_v10.0.1016.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\is-Q38IK.tmp\OSForensics_v10.0.1016.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-Q38IK.tmp\OSForensics_v10.0.1016.tmp" /SL5="$301C4,251411739,1027584,C:\Users\Admin\AppData\Local\Temp\OSForensics_v10.0.1016.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Users\Admin\AppData\Local\Temp\is-VLLIO.tmp\_isetup\_setup64.tmp
    helper 105 0x444
    3⤵
    - Executes dropped EXE
    PID:2380
- - C:\Program Files\OSForensics\OSForensics.exe
    "C:\Program Files\OSForensics\OSForensics.exe" /l en
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Program Files\OSForensics\osf64.exe
      "C:\Program Files\OSForensics\osf64.exe" /l en
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2984

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x150
1⤵
PID:2184

C:\Program Files\OSForensics\OSForensics.exe
"C:\Program Files\OSForensics\OSForensics.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files\OSForensics\osf64.exe
  "C:\Program Files\OSForensics\osf64.exe"
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OSForensics.exe

Path C:\Program Files\OSForensics\OSForensics.exe
Size 445KB
SHA256 b41d4044b4cd1b6f5339bb870860928a26f40713220546014d4766984be23602
MD5 81b795ecf9c66bf044d7cbb727dca1ab
SHA1 d2092ed7b67f7262fbcc11179125d4c89d5e4190
SHA512 2ca5aa38b7afc93cd3cedb9a71984a1c6730f2e2a7a3ec91c07ad13424aa28c34a9beb0694fa3c9043f803f71ea4764612645f305c87be5c1800ed1a216bd2c8
SSDEEP 6144:iHGyYmj8GBOkvqTv9jp76GFsDJBoNkz/dZ/4GDHkawEBQ+9BB:cYmjFs9o6sDTqc/dZ/4GDnwx+PB
TLSH
T1D4A4BFD1B4948479D87706320BE88AB31E7FBD704BAC19CF2398772E4E712D25236967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Categories.txt

Path C:\ProgramData\PassMark\OSForensics\Categories.txt
Size 860B
SHA256 d3b90a6872d89d8012b66f1e72c523498672c24aae1528170003f7f40850ad5a
MD5 a52497eb780e643351b0efe9ad18da96
SHA1 1b54a157017d9cc6cb8efdd3d649628a7ce158ee
SHA512 f9aa872c9ec3fa9fbbc76b54a22b38e984b1fa4c73df971c91f26f7f0179e8f587b74c09920258e7992aec86e9447e7440e5508341f177629a1140b6337b16a2
TLSH
T1B211045367FA4408F0F36E502B7066B50F32B962AD3CD41C01D9464A4AF5E64ED79BE3
MD5 SHA1 SHA512 TLSH

Submit Download

DefaultTemplate.xml

Path C:\ProgramData\PassMark\OSForensics\CategoryTemplates\DefaultTemplate.xml
Size 1KB
SHA256 78e6117e50d6db55dbda24f973444cf7fb502c9d3a39717a155c9c9981d79e90
MD5 458d0a2bc9e207fdab7524aadd389df9
SHA1 6479998dd9a862de990bddd33aa1b4f0380bac66
SHA512 87950470263f159020f3c0955c53b07cb8780ed8e68fbd578dce7beb58c6058145e28183be3620382b45902eb6501f4783d0d2a6b0b3c618c2d77603b75ba9c3
TLSH
T1B331AE0C67ADC98E51827A3A8FF4196EFF839257193D49FCF64EAC2489C01920D09876
MD5 SHA1 SHA512 TLSH

Submit Download

DeviceConnectedDisconnected_1006.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\DeviceConnectedDisconnected_1006.txt
Size 333B
SHA256 375d9b0467c3baac2a25edd2b8be8d7c419730a497eb931006e493282bbb47b4
MD5 49dffbc30689e875779fd5611160d351
SHA1 0bd2e6134f69a3031f7bf9b0899920fc278120cf
SHA512 eb88849310a3d966f2da539cbc4cd180a6392464cb317ef8edabcca3643b81b2e69760b2f60c72ad7be763ccc2044ffadf01b516d5bacd0e7a3204c00cb8daf2
TLSH
T136E0C21CA1D0A93233C80711FBB0541497F986DF95D0101C74FF597A5F5BA88DA2A3F6
MD5 SHA1 SHA512 TLSH

Submit Download

DeviceConnected_1006.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\DeviceConnected_1006.txt
Size 508B
SHA256 d33255385eab300f9932caa6b6cf11bc6d6a702ea4e95c9c2e08f4a34e519c1d
MD5 dbdf107ddd93a0c122ec08dd785b20f3
SHA1 4f82e3b022af5a731fe917380cf574d94c6b514a
SHA512 64654e81ef2e3bdbe8643d9d4d577c352e85ba246c7becc446cb7e4b681e122fc23ecdbbd7c4345944f0704142d8c0597991765bb5a261c9950b835b8323b941
TLSH
T1F2F05C1C66D0A9B223894A11FBF0540097F8C6DF56D0501874FF59755F07A88DE2B376
MD5 SHA1 SHA512 TLSH

Submit Download

DeviceDisconnected_1006.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\DeviceDisconnected_1006.txt
Size 848B
SHA256 39353eac2829486cacbdb1ab3adb09e14cc4457a2be2865933153a7a997041ac
MD5 ea09435886ce23b1b895c5e1661db364
SHA1 d6e83d38736bbd05f1dfb0b5c425e6ae415a4072
SHA512 c7d7243f343e7f9b1ab252daf9989997d363e11020c4918a66dcac51997e9543d434ce32c922fdf6d1b233903664d3644572650c3ffa9bceb3bacadaad1322f3
TLSH
T1CA014E2C66D0AAF6238E4951F7F0640046F4C6DF5AD0905474AF54755B07A44DE17736
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstalledUpdated_20001.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\DriverInstalledUpdated_20001.txt
Size 334B
SHA256 6d39cda174d86e792bc1d0d32ef4753c05ec78e1b059182576f20117d42c4b66
MD5 3c45d02820975c6667ef0ae7dd94e7bd
SHA1 013b39725792078b21742b6f008d35aaa30631c0
SHA512 3329c7fbb5ccf86d3238c8f4b429e15bd63277b117abd8e71995bc3898060e31d437bd7c0b02ddbb2b7a5661346d5f8e90062a529bf1303a9fdb3be0f5ad0969
TLSH
T1D4E0C20CA1D0A93233C84711FBB0541497F88ADF55E4101C74FF593A5F5BA88DA2A3F6
MD5 SHA1 SHA512 TLSH

Submit Download

FailedKerberosPreauthentication_4771.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\FailedKerberosPreauthentication_4771.txt
Size 333B
SHA256 ea3c3cdd77024e8c6c698106364e9e4966a656ff14efd6e90aa8311aab4f0163
MD5 3cf4045c1a67e9f4b27e7b62dcbf6ce1
SHA1 c322feac2afdb7b7f80cbe9d7dc9a650dfc27a11
SHA512 4ea284f50cb3e17af3ad5f99d8d104b9927fa3a8853bd3fd7a74f7d4e6e8edd6fea22f7e3d1390e12acff4ab67984b62d8ede808c69e8b62e2dfc0648c7e817e
TLSH
T147E0C20CA1D0A93123C80701FBB0541497FC96DF94E4105874FF583A6F1B998DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

FailedLogonAttempts_4625.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\FailedLogonAttempts_4625.txt
Size 333B
SHA256 d30e1e66cb2d5518cc5b0eb680b6f167bafbcf018dd79f458228305023435c90
MD5 50c33283571721d390c0b025f7dcce32
SHA1 513e4cca045cbc6c8c69f4984cfb5b8a1d3379ed
SHA512 eacf02e9dc1fd5ba1893aba80d8f10aaaad164273ad2d09030716477fc2921edc1ed4fd4fd22b430050fe4b5ab8d642e6dc2d4148c76f49bd6600855d198ed0c
TLSH
T15DE0C20CA5D0A93123D80741FBB15414A7F896EF94D0201874FF593A5F1B998DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

KerberosServiceTicketRequested_4769.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\KerberosServiceTicketRequested_4769.txt
Size 333B
SHA256 5b3db56bb0dcb0833c3aa7bdbdf2cf772475a5d879af8b863206b9ddfc9113b5
MD5 e95ffb4c9857f36a7806b9bbcb3a022c
SHA1 4a8836510d145c8e8b752e08fa6478641c46a234
SHA512 e97dd3c720911ad6abb973b43ae5ca15ef176262f217106093fc770db8240110bba6585da86b9c592f21c5e629d1b8ec6a8a7665f49a92ea84a650251d90ceb6
TLSH
T135E0C20CA1D0A93123C80711FBB0541497F896DF94D0105874FF583A5F1BA98DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

KerberosTGTRequested_4768.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\KerberosTGTRequested_4768.txt
Size 333B
SHA256 14988817444901f6f9b15753cb2e623dfdeb2abab77188b4771e0bcddec09372
MD5 036c98bf9562f3e533805bee3f982b10
SHA1 7c77b3ef6fd19410d189616c5a67898895ff7058
SHA512 d53bfbeba588751c3346bff333a5922e7b04ab6bdd5b276a15af97e066f99758f445c2550b046ad166b70d9afec85896cf19a6765f76cee63664c3fc052ffa69
TLSH
T1CCE0C20CA1E0A93123C80711FBB054149BF896DF94D0201874FF583A5F2B998DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftOfficeAlertsLog_300.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\MicrosoftOfficeAlertsLog_300.txt
Size 332B
SHA256 2829791cf01398ad6248b6ae139e950f10a852c8d2532fb0ea611772796d1e4c
MD5 5b1deda46a934898bd1a44c9c970e248
SHA1 55519e93d5fa37d4c830a3ad0710661288bcc2c0
SHA512 8b9d17ae46effac66589598f5e09b8bbc805b17412a8106e94d113508640b3de34c262fcd4214226475e0c04d5305233fd12fa55ff5d8360e9f9505332e5f759
TLSH
T16DE08C08A1D0A93233880751FBA0541497F886DF56D0101874FB993A5F5BA88DA2A2B6
MD5 SHA1 SHA512 TLSH

Submit Download

NTLMAuthentication_4776.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\NTLMAuthentication_4776.txt
Size 333B
SHA256 5d315aeb5e170d6ea8d0214509ad9ab94af2cc7e970da72bf7c902a7c988ea4e
MD5 484cd55439c129637fd718471445f2ad
SHA1 b1fedc98efd22ea5e5204770e07e15a5807ee8c7
SHA512 b65df9e5cd7f06ce391917420285859518fbbb3a7c2d7de45e26b9bdaf5f238e82e0f7af8c6a2c78915c85ea1c71f4cbe67d3bb3fb11a26ddcdb9c2704fe6c4d
TLSH
T13DE0C20CA1D4A93233C80701FBB15414D7F896DF94D4105874FF583A5F1B998DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceInstalledUpdated_20003.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\ServiceInstalledUpdated_20003.txt
Size 334B
SHA256 59d72c3ba8b5986a8cf9e19933ada9b998dcc3e1a5f96034e5b91b9f546808d1
MD5 267397423220a4dd6bf3202dbebbd235
SHA1 660729745be751cf89d4ddad8f7abfc2db87e8e4
SHA512 5298c4c9339d67eb947a6afa79e9f8b0986ccb8c6df642f4e4fc98a6a57e03430a00b8fc65028b012afdbe3b9a4568703905059b11287c988a3207c112ab5572
TLSH
T167E08C08A1D0A93233894711FBA0541497F88ADF56D4501874FB593A5F5BA88DA2A2B6
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceStopStartSignalSent_7035.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\ServiceStopStartSignalSent_7035.txt
Size 333B
SHA256 c687b92e7a89d57ce101f25efc72f0fb6101dd6f2dd1731107a64e86ec137c3f
MD5 61ca7c6fa216f3928f8cb7c65f2eef7d
SHA1 8f8203fc6d599a4c6110a10c9faa50b2d343cb95
SHA512 7fe3c279bb9fd1a7fe645c89a3783cbbf30387933aa95ad24af9a91caf4f2a5619f97ba4ae8e9be14eae106b1bd55b79431f562ed57f92ef2ae357c8129bd9a4
TLSH
T1AAE0C20DA1D0A93227C80711FFB0541497F996DF94D0201878FF583A5F1B988DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceStoppedStarted_7036.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\ServiceStoppedStarted_7036.txt
Size 333B
SHA256 65f6e3a21b14dbae9d2dbad16bab00ae5fe8d76144423a1abf255da8462ebd66
MD5 3be78b17e70a1b9410211c738f041124
SHA1 ddee2ef336635b61eb0aa643d0946fd626c10c4b
SHA512 11b32cb00ea1e7c64d3c8ec9a52ea72c4399fb9591491059e207e27a87971f72f825e181776d6f118a52235fd8665135af6a2e8db6eab4556e19339a07f10409
TLSH
T15DE0C20DA1D0A93223C80701FBB05414D7F896DF94D0201878FF587A5F1B988DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

SoftwarePackageInstallationFailure_11708.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\SoftwarePackageInstallationFailure_11708.txt
Size 334B
SHA256 7e68040e871199be765f3e5fd5a41a400ac75852bad668677d3877e919203f67
MD5 8536820fba692a04fc1c78ab970702d7
SHA1 cf2cf178d085f557544e48f87c0cdabf9f1f202c
SHA512 32abd8f51fcc12fd7295ea1426e255a25b5377f5345d5fe0a5e2172a76a7a58430a3086292fb56ce4af653258ad53b79860e70e89f15c642e126430dc3653986
TLSH
T1F7E0C20CE1D0A93233C80711FBB0541597F886EF55D0201C74FF593A5F5BA88DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

SoftwarePackageInstallationSuccess_11707.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\SoftwarePackageInstallationSuccess_11707.txt
Size 334B
SHA256 10c78d60c671369456278fd5ffefb0e2f38fd9944775933bc2e837bb5df78ae6
MD5 7ce109c1280a1ea02335d0b5be55ae00
SHA1 e5cfb5eca161c35378bf45cf19d0b7090b076090
SHA512 9c28bb421705dd350df39a3457b9710d8d324640b2be7ccd6664bc24bbf00a5afbe0e82c5b1a28f2fc56dd4c033d7b05720443664154a1a0ca89d57f6134cfd4
TLSH
T1DFE0C20CA1D4A93233C80711FBF0541997F886EF55D0201C74FF593A5F5BA88DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

SoftwarePackageRemovalSuccess_11724.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\SoftwarePackageRemovalSuccess_11724.txt
Size 334B
SHA256 343a60271812f95b2ec0607762ee2b81a3f63ce097f2beae9899cb4927c81e57
MD5 6263d2d00f5517167735cb82a4cab801
SHA1 bd7e7a3f8dc253ee8c911728e21bb06c76cb1cab
SHA512 e07a7feb2cb4806759f1d60cdbfdabc6186f6c075bfb189bda30a409208cc4e349918fde62c29f751dadf28e69416b8fe34e4381ef02c89ac2de0014e118f771
TLSH
T138E0C20CA1D0A93233C80701FBB15414A7F886DF56E0201C74FF693A5F5BA88DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

SuccessfulLogoff_4634.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\SuccessfulLogoff_4634.txt
Size 333B
SHA256 baa5cd35bd601ede26614042fc062eb976cab54371777e4bc10b264b150649ce
MD5 ac5cb62ff3fcff976012fefe11286774
SHA1 015f53e5743005427c85fa19cdeb9ee30addc04b
SHA512 be931ff6d8057d21d9632717125bd94e9ee7905baa41ebcddd24b6f38f35027ecee8cddd3d88f02ad7e75ae86197428f6ece79fe4d95cecc0b494410c69785b6
TLSH
T192E08C08A5D0A93123880701FBA15414A7F896EF95D0141874FB593A5F1B998DA2A2B6
MD5 SHA1 SHA512 TLSH

Submit Download

SuccessfulLogon_4624.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\SuccessfulLogon_4624.txt
Size 333B
SHA256 d69dbd9037701c9c685e670e9ca3c4e1c3b084f54a36b9fc5593de20b422173f
MD5 c6f5e48e4d40a2494143da7a24491f10
SHA1 6d2c50db643b96c8e4d37b281589fe990679a222
SHA512 3778b5cfa3044fe6675b9738c4f6d7440a365099bfbefabc44ef066064d917ff43653b80f0d34e4de6b00a4a9fd39590fa0d56d4c04fadf13cb00e801c8655c6
TLSH
T10AE0C20CA5D0A93133C80701FBF15414A7F896EF95D0141C74FF693A5F1B998DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

SystemShutdownRestart_1074.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\SystemShutdownRestart_1074.txt
Size 333B
SHA256 b9e55403e064fa5ef2a627fe20eacac9073dca67d66c3494dc065dce7a6bc3b3
MD5 2b21e8a675d2979d263bc5b6631efc1d
SHA1 deba52bdd364330f16828129c778f5f08a710d41
SHA512 b9f4dd160929f77c7a2316be0a0d3191b4595bbbc5a9eef2ec18c742ede4236e9174cb0e3527ec63581564afaeefe7aa657203f19fdc52d2aa7b4537067e951c
TLSH
T198E0C20CA2D0A97233C80711FBF0541497F886DF96D0501C74FF593A5F5BA88DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

UserAccountLocked_4740.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\UserAccountLocked_4740.txt
Size 333B
SHA256 4c52f15c08b61f1ac8d736178d2689f153d6bcc04d81f958859c85aeb04861cb
MD5 d126fdca73f208ebb352bc06749cde36
SHA1 4d42eeac83130827c59d7690dc3500cec8f816e9
SHA512 bd5be9333f9166172a4d61aeb6936d562d4a93d63df673ac6f8b1a96b5f159f0904c765fc7454db1d52f74a419cf9d43206fb11989cc5c4e8ca0550a079b39e1
TLSH
T1F3E0C20CA1D0E93233C80741FBB0541497F886DF55D0101C78FF593A5F5BA98DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

UserAccountUnlocked_4767.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\UserAccountUnlocked_4767.txt
Size 333B
SHA256 7d0dd34aadd79d81061fbb1e22725d301bcfc0863b9ca99ae26f18cd5a92b004
MD5 b886daf5bb4b5bac05769259a627394d
SHA1 1dcf977546c2507107cfcbaa75a8887b01553cd2
SHA512 e9e84b5988e1c79b9c8b730ea5ca8637f80bc796591494ac7e66786149b8d885fd0f60a78ae4bac7c953b40e2bd8c6924dcd0c39766e9514fdbf31dd21b597a8
TLSH
T1C0E0C20CA1D0A97233C80B11FBB0541497F886DF95D0201C74FF593A5F5BA98DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsStartedDownloadingUpdate_44.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\WindowsStartedDownloadingUpdate_44.txt
Size 331B
SHA256 77d9d566d4ddf928943873e8b15e29c558023d1d900b91d8de88db5992bcfbf4
MD5 246d99cc61f835853103c0d18a1cd972
SHA1 41e953fcb7e36a3e00a3262a000fddac885d7be2
SHA512 1758b3fbbb7e986c194b29048363e2507b705ba37ce3c00082e764a5d999c703e08edf61c6d7e5f31f0ff8eb119a02fffea5e3128f34d68c65fd1b7f01d9bf35
TLSH
T1EDE0C21CA1D0A93233C80711FBB0541497F886DF56D0101C74FF593A5F5BA98EA2B3B6
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsStartedInstallingUpdate_43.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\WindowsStartedInstallingUpdate_43.txt
Size 331B
SHA256 ea2d1329c00bf711b2f4335551a6758dd8fbc3663b34179a26a0df812a327d40
MD5 19b3d5189f23f3c62b0b8ec131e7e513
SHA1 82de4ab10275bbbbfdd66db63123462b8b237e21
SHA512 cf2a8cb01c7548d23be84d83f66eef47504bf52eb12751b15a47d32457d2478117bd29c3f16d197f3fd6fa93aec8e4594fbaf91fe9a0335097711d28d6e8ae06
TLSH
T13FE0C20CA1D0A93233C80711FFB1541497F886DF55D0101C74FF593A5F5BA98DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsUpdateFailure_20.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\WindowsUpdateFailure_20.txt
Size 331B
SHA256 26a5a77ce45f8f3676932c96136ced5a08c6440dc22156565311469fd4e0e375
MD5 16241063f38f8051b1486e06005c0e33
SHA1 8f36bd300151f9aa73a0ba17b65d039bf6eef36e
SHA512 06e560700fa5a3429530bcb9dc343669e64cef38fcde010b558dbd8ff2870bcc46b4fef374765b9c6e1b4848ee71d82aa165469c9a9e47257daf82b776be0d55
TLSH
T1BBE0C20CA1D0A93233C94741FBB05414A7F88ADF55D4101C74FF593A5F5BA88DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsUpdateSuccess_19.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresetFilters\WindowsUpdateSuccess_19.txt
Size 331B
SHA256 610a8d8a16a0ffb2e38c4438fbd6e14fab164b5c064335b36b311d83c1769679
MD5 40e09c5973f9d21712d83737ab8ebb3e
SHA1 f7c4ce2e907309cf7863f781ed7e43d07e92cef6
SHA512 25291f85479e7b770e773f683c48be4df879953842fe12fec74e2ca7b6d8797efcb34399c76f921141938ea3fc7c550ea854483704cdf55cae39fd0df6205950
TLSH
T194E0C20CA1D0E93233C80701FBB054149BF986DF55D0101C74FF593A5F5BA88DA2A3B6
MD5 SHA1 SHA512 TLSH

Submit Download

EventLogPresets.txt

Path C:\ProgramData\PassMark\OSForensics\EventLogPresets.txt
Size 4KB
SHA256 47a2e03d25fae602e483bdfe419bee1743210661b1e80b82aef96137b47fa389
MD5 540d5bf945c46e43493dcf5bba8d1887
SHA1 747b6dc7db87f9d10aeb7d0b11887d13903253d5
SHA512 10abe98efaf647ce49a6f459ceef4c49e64e6a33222aaa4ace707f2aece0651e12fa7cf4e526a03d3943f0ada00fb5a4ea99d8a1b7b885784b6d31223a01efe9
SSDEEP 96:vM9/Irq4X7Uv7jUUZLlhs1hs9+hs0jcusucjYac0mPtSgjN2qSWVe8FE:vLKhs1hs9+hsIZSABord
TLSH
T19B915C43AFF90648F1F32B54AAB555221F7ABCA98C69D64C61A0514E09F3F10DDB0BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

res10_300x300_ssd_iter_140000.caffemodel

Path C:\ProgramData\PassMark\OSForensics\FaceDetection\caffemodels\res10_300x300_ssd_iter_140000.caffemodel
Size 10.2MB
SHA256 2a56a11a57a4a295956b0660b4a3d76bbdca2206c4961cea8efe7d95c7cb2f2d
MD5 afbb6037fd180e8d2acb3b58ca737b9e
SHA1 15aa726b4d46d9f023526d85537db81cbc8dd566
SHA512 aade5e3216a9b86413471a1a93c80b753ed898aa96b04f60f0e9e5b2a34414470c29ae5ab578ff1bb6ce37c806ea46e3c1bfe7b4197b3f609197f0f9d278269c
SSDEEP 196608:gveKuVB+bDVirPZZdg5ca6DWOvJ1bDw+RYHCwFOppL+n9u2LFbk21BN6oi/+NWG8:gveKuEwP7Y4Lv3NREup69uJkvU6W+6/P
TLSH
T1AAB63390E136C505853D431CA3D0CD1875E269A859A77D3B6C0A74EC8F8DF8BBCEE1A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

res10_300x300_ssd_iter_140000.deploy.prototxt

Path C:\ProgramData\PassMark\OSForensics\FaceDetection\caffemodels\res10_300x300_ssd_iter_140000.deploy.prototxt
Size 27KB
SHA256 f62621cac923d6f37bd669298c428bb7ee72233b5f8c3389bb893e35ebbcf795
MD5 bf7a2a8de014b7b187783f1da382485c
SHA1 006baf926232df6f6332defb9c24f94bb9f3764e
SHA512 836458a7626bc7019d5c0477121a032179a4f60af9295f5449ca1afbd18d82a9cd8ca4e9a5cfec8664f9489b4952e6f09eb3f924ee1607daa9e19acf235bc6d8
SSDEEP 384:CDfi2eHmRe1aZX/QYklBG81sPp6N8sj2BgR1lOz:baZz
TLSH
T133C279695CB10C91005FE5E81165B526F750D183F78C6C32FBA82D78BFEF6B4A58AB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

haarcascade_frontalface_alt.xml

Path C:\ProgramData\PassMark\OSForensics\FaceDetection\haarcascades\haarcascade_frontalface_alt.xml
Size 660KB
SHA256 6281df13459cc218ff047d02b2ae3859b12ff14a93ffe8952f7b33fad7b9697b
MD5 0d8d5f4c7c2c2861172d3028ad04334d
SHA1 1246a90d1f7d2d522aea89e93ed0fa8a38d993a3
SHA512 ae50bc78271fe5508c39e528c954177e0e4cfec2c549279b641c1eed7d4c7565ad1873282041b78a9f2aa211c473a83e08f5373185b11d135929d154ca927a57
SSDEEP 3072:agGXVvFnJGsKWeU1GTMhg7Jc48Vjj51bQH:0vXa
TLSH
T1EDE4F137A8F3746315DCE13E99C6F0A65C083AB3138E765436CC4B659FAA40DC69FA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

haarcascade_frontalface_default.xml

Path C:\ProgramData\PassMark\OSForensics\FaceDetection\haarcascades\haarcascade_frontalface_default.xml
Size 908KB
SHA256 0f7d4527844eb514d4a4948e822da90fbb16a34a0bbbbc6adc6498747a5aafb0
MD5 a03f92a797e309e76e6a034ab9e02616
SHA1 7135c1880e167493a7b8d802c6849ab04843341e
SHA512 e6a7f955e03572cde0543eacebd60e0929bc4c9114a7cc88eba0eabaad4f87a19b7086d554cbf308da3153a8918a125762365bfdcc035b0633202cf56fb60072
SSDEEP 3072:SEx13DougVzzV//oNkrz5aoM/4Gqoqgl9NKP:fx1s
TLSH
T10115DD37A8F3746325DCE02D9AC6F4A55C083AB3138E755076CC4B659FBA80DC69FA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

haarcascade_profileface.xml

Path C:\ProgramData\PassMark\OSForensics\FaceDetection\haarcascades\haarcascade_profileface.xml
Size 809KB
SHA256 b39a4a3be45539db146a7fc1d3e761a292c196eb88421185e6a615b3055e612d
MD5 8051ac0e7c7d1171e9e0af71c2c3bce1
SHA1 c4961a5540a3be71fd41a2417c26485c675a0e95
SHA512 afab552b4b01876b5aafda21ed5e425e9c23a96c850c46340994dc041477bad2c42302f4619eba783fdb69bb13f31389854bc49b1f71f81c3b723da0da343324
SSDEEP 3072:8n1hTCxcPABX7hWTpyZmx3ac6jZKUQ0Zp+exU3bTnjOrOFGRI0:Q1hTm
TLSH
T1E605D237A8F3746315DCE1399AC6F4A65C083AB3138E756436CC4B649FBA40DC69FA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileNameSearchPresets.cfg

Path C:\ProgramData\PassMark\OSForensics\FileNameSearchPresets.cfg
Size 4KB
SHA256 0f765cc0f6bd5c232f0115dface383f05040c6e9c030df81a6f793c9754c80b6
MD5 4b660493df6c35bedb79a1a33b054fd1
SHA1 886ceca075dc7158762f2c58d018090ae726efba
SHA512 d655d50da91c5a0b18e3e8e87468d38cbf1093fcb1dec7d172d149c889cf87ffc6a5d38a72433293c9eba8664041a849ddea2b0a6aeb9a9fe29741d2c2f6387e
SSDEEP 96:uVinpG+ecwePNgRONYRNjW6/xU6OnbaAkob1tN6PvYmvHCzR:7tYHCIxU6OnbaAkob1inTid
TLSH
T10C91ADAC7081600BB9B1C3368C7121C81904C2E74A29C1FFADED501D562E9871E8FFBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSF.mg

Path C:\ProgramData\PassMark\OSForensics\OSF.mg
Size 522KB
SHA256 dee7326fc6390a3f01f2cd32bb0ead5aec5ac08104de3bf8b369e524d3412ca8
MD5 ff6ad9524099cffbf14f7b81c33f8307
SHA1 c62f5ff3c43e36e0dd73130e671114934e2cef6d
SHA512 5ace96d5f9fdaedf54f98b87fa8a30cdf97418862d1bfe55ee94fc4a60e134f06c88a0307c23a20d5b7dc78a448d770d1c8a293127eccc653f8059f6b08e7389
SSDEEP 12288:dxbvegPUh73qaILrTHTq/jyjhfLdWhc+cTZM:f3PM
TLSH
T15DB4F94C9FB296A28D9AD97D1EC36649F78C7C1B5AB1B4F7F8CD810C23A184612FC560
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-HBNPT.tmp

Path C:\ProgramData\PassMark\OSForensics\Python32\Lib\site-packages\setuptools-49.2.0.dist-info\is-HBNPT.tmp
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

is-EEQ26.tmp

Path C:\ProgramData\PassMark\OSForensics\Python32\Lib\site-packages\setuptools\_vendor\packaging\is-EEQ26.tmp
Size 562B
SHA256 e9e9dba795e045f8c18ec23df9b9f4d078c77f94c7db53c330e2a4256f31c3ec
MD5 2eed0787819307cc2e25cf45a4a9b5ad
SHA1 74e5f4a45cf9a2e4e3e1f66456676bc7c49b2fd1
SHA512 3dbe5d38dfbafdae2bd2d0bc621996e3b5b857e714bb2f24264a88d929349255f9332256ce01121b8e19ba9f2ace51d5da9db3898066f43ad2f4975ed2692537
TLSH
T171F0BE1698497E724655C4DA960AC0ABD336214F0E9E391676900AECCF2B92F46F455C
MD5 SHA1 SHA512 TLSH

Submit Download

is-3D05R.tmp

Path C:\ProgramData\PassMark\OSForensics\Python32\Scripts\is-3D05R.tmp
Size 94KB
SHA256 03cb000b9d999fe7aa727af79446cbe92002f07476a52d7fb08425c67a52ac0e
MD5 63d46178685ef39ead4f3f9ea2667e44
SHA1 7b6afcead7a512fa7db903681fc112612a3f412b
SHA512 4ca8e03a0499ea3287779b9d0411d0e7b0eb740e28c67454993b4c03a1d4586f32ab098dfefcf6eb091a7880a0a35900e3fe3c9b153994881598be554b683403
SSDEEP 1536:WRCgEoP+G7f5G+OISw7ehlGHf5KOdT+m3jM97/TuF0SqfuYFfHYToxsIG6:WRCg9nxGjBlGrdTd3wL2qfuCfHYToqJ6
TLSH
T1D2938D217390D076F06614306D6AC2B24ABE7C3285B8894777D47B3E1F713C1AABAB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-7MGRJ.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\pip-20.1.1.dist-info\is-7MGRJ.tmp
Size 110B
SHA256 9064fbe0b5b245466b2f85602e1ebf835d8879597ff6ef5956169dae05d95046
MD5 d2a91f104288b412dbc67b54de94e3ac
SHA1 5132cb7d835d40a81d25a4a1d85667eb13e1a4d3
SHA512 facdee18e59e77aef972a5accb343a2ea9db03f79d226c5827dc4bcdb47d3937fe347cb1f0a2fc48f035643f58737c875fdf1bd935586a98c6966bfa88c7484a
TLSH
T1CFB0122403408EFA4160FF434038E9351270CD0A9CDD5136F44B5180D90BD4A1AD9E6F
MD5 SHA1 SHA512 TLSH

Submit Download

is-SQ17L.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\pip\_vendor\chardet\cli\is-SQ17L.tmp
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

is-H5412.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\pkg_resources\_vendor\is-H5412.tmp
Size 226KB
SHA256 b66ae9fa5bbea8ed62ef967320de40d769ca4510f50a6e15a64fb92d1f6b8a6b
MD5 fc9c293f584c3bf6de629ac89e5a0e83
SHA1 6823808a8e61fd3e3ec722ef45ad6cf1b4bd9aa2
SHA512 1d037acba4b9362a24f2e8867fa5b85fb1aab1cf121dd0054ef7706e643e0d9d989a7cc202d04c5e9acee4a73d1af08e082ca19d9c34a9fc04e4e9b001de42e0
SSDEEP 6144:Nk7fj9Cr2dr4a4Nx+cOgq0emJ2gW6YnqTX8meDeJZOtxjK5cbE/NbE7EVkAP:KgOE5
TLSH
T15A34B523AD4725210877C92E8C96F456E72A8223522D1663FCBCD1943F71825C6FAEFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-UMMI1.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\pkg_resources\_vendor\is-UMMI1.tmp
Size 29KB
SHA256 03a85d259563237b7f81e79b67d07352fc11ac85e8d257f0cd094cd8b70ac9ab
MD5 f01049871bac643b4d7221f6c5cad17a
SHA1 5f07d285085b5b61e121f34730b6838f597e43c1
SHA512 d0b75240aeb5c8f34d165a659680735c3d785d72d92e3903d31e59d688daefc1a6ae2ab86ba156c6ffaa9ba7a899830178b82e94383a3c25fbfaf5c2a07bcca6
SSDEEP 384:gjSMJVrmfI/KiYG8VKLll2tP6xYZLylI0lxrDNJOhG/1S5Qqdtltq:CSMJVt/KiYG8VKLll2tCxSEy5D3lM
TLSH
T158D26339D4252923BED77858DCBAF4816E8C6C1BD60121743EBCC2D56F4DC38A2B1D9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_structures.py

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\pkg_resources\_vendor\packaging\_structures.py
Size 1KB
SHA256 a5577dd17717446c2965107fa9d16e54489b8421e95ff6cbe7362bf7e37499cf
MD5 b79728011c523d790e1c4b865cbacb76
SHA1 be93036f1cf971607f07b63be21d98927b772003
SHA512 c7534da7d51bb7b4b6939ad53b5621a34ed96ef2ac2cdb6937d9e030e856224e8b7bdcab8b77b20bcdbcc0f5260bc5e64c4f9912a6ad30108c8550c0c21aae60
TLSH
T1A52109A43B9BF492D34FD03A4653F883A24D3D87852E2028B4ECB460AF73924CAD04D8
MD5 SHA1 SHA512 TLSH

Submit Download

is-170SE.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\pkg_resources\_vendor\packaging\is-170SE.tmp
Size 27KB
SHA256 d19cd0a5c527beb43a2e347e99044bcccafc1ba85d46ffa66345527ff6a616d2
MD5 7d0a4c4e37ccd233a3cc846212190cf0
SHA1 5abb695480f361a365592c1d7c42f966f7024bf2
SHA512 b0c9fcfed36904ed180c8f84ef0763a309d49a3ed5c3ed76c49a8fd5d4cd760a33dd8b0abfc662cd7ef181c85e9e1b1ed26d74fa5f576408522d33878cdb28dd
SSDEEP 384:F9JKfiBVQ9IEfRaYuhdwhOuh/F/VI1ZliG36ERZaRnKW8cIptNbxs:RK6BVlEftuhdwhOuh/F9ITlTGth8cuds
TLSH
T10DC2646B7786962D92434239CD57E082B70ED9DF8248A27D75FC802C6F0753D86F39A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-39D0C.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\pkg_resources\_vendor\packaging\is-39D0C.tmp
Size 11KB
SHA256 3697709dbf0e1de763ff62fceb2894aac72e8dbef0fe2e609922b53e13801738
MD5 75bf51bf7a1b52df02b1a230b445b9ec
SHA1 14b290d57c0631aba7abd1c87752708fba6895df
SHA512 26e0d9365605b9abd22512fc4a23c1f57a939c73d7f16a3f44ce4f1bde388a19f7d7921e7073c9ac80e08f12dac3acfa294d3bdbff863f08bdebc8a4befebd02
SSDEEP 192:FtZ0NRQcrXO1gEOvEYj7PWfpshvX8GhaDlrr63QSUHt6+Zz7:FtZ0NRQcDOjOvEYj7PWfmX6lrr690
TLSH
T131327428BB57D467D297476C888BF143BB29695B055C612D75BCA0582F03EBCC2F1CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-64GT4.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\pkg_resources\_vendor\packaging\is-64GT4.tmp
Size 12KB
SHA256 10f2d784ee864c3effa225843b55349743e47d1f11ff18afa4c0c75e7b1396db
MD5 0a49ca8fc82cc621be2723c5275e50bb
SHA1 cc088276318648a92c9444fcfa0aef153a9a50f0
SHA512 84826b62322ca1c520515b606fe89dff796f44e72409fdb44d5fc04802a18b17ea47e25953230597a5f144c4d01aded6e5306b054bcebbaa343bf2a8eb1a7e31
SSDEEP 384:FxdlUPweyX4QIGNhRBHA3NoQYKMKEp9x9zOlpCup0AkCDC20cNs7:TdlBh4QXhRBHA3NoQ3D69x9zOlguXB+H
TLSH
T1B04275558692ED3793A30E7A1CC7C151273C2C275E56622CB9DDC2685F12CA8C3B9FAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-BCN4P.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\pkg_resources\_vendor\packaging\is-BCN4P.tmp
Size 1KB
SHA256 55a4c2d048bbccedb197d0118969b3d9814b16df3d3eeba12db0255ccc801a6b
MD5 71c69026e5aaf5687a034c48ffc7485e
SHA1 59eabda06f3273b5a420c5fa1d129ba7e8f6acb7
SHA512 b033838d5454f307c7742a3c765b427a44565046cb36d1e62ce4d4f56fdd498db5ea21d26410c81414b4c57a2985a384aefcb765f1a2b28f025c20800639abe8
TLSH
T11A31E04E9AB3C1FB830587AD48EB62813374AA471A49873D758CC5682F42D7F43B1DD8
MD5 SHA1 SHA512 TLSH

Submit Download

is-EOJKK.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\pkg_resources\_vendor\packaging\is-EOJKK.tmp
Size 865B
SHA256 520766faa7277927215b6e49aed3082a05317c4101702033e96ac47977aacfda
MD5 20333ac41bb96ff9d087eee5321b9cae
SHA1 3ea29b2d3540bdfa5b8e33dae8db68835a7ad2c0
SHA512 fa2e4750896a4f0a7727340d9ad8bb526068f14bde24a6ea8f6225fecd86878c127a209a1681c7738ab418194cd81db93d85f7e4bc22728c9e765b364007ca9b
TLSH
T1DB11120589813E7E068B816EC48B91853336B51B8526651C7CFD43781F1263F92F18F0
MD5 SHA1 SHA512 TLSH

Submit Download

is-JPB78.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\pkg_resources\_vendor\packaging\is-JPB78.tmp
Size 744B
SHA256 0a9b8c4b287557b69dc3c40c8d62a46372ed76a4549115f832027a9c5e2cb4cd
MD5 cf9a8024d563a4a8fbc5332625f6b6bc
SHA1 b51446927c352ad1c7de49f0ee6b71d4e367c435
SHA512 be75c4fc8684d3e350cf0d89c7c1be191fe36803dc3736403b20474d1116223947a583473f8d1c339ac4be916c1583363e40918fd5737ddcbb10aa8f0c7b4dce
TLSH
T1F401972688181E714B8488EEA40AC48BD375112F5ECA351BB3200AED6F12D2B03F9048
MD5 SHA1 SHA512 TLSH

Submit Download

is-2BNPK.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\setuptools\is-2BNPK.tmp
Size 64KB
SHA256 75f12ea2f30d9c0d872dade345f30f562e6d93847b6a509ba53beec6d0b2c346
MD5 a32a382b8a5a906e03a83b4f3e5b7a9b
SHA1 11e2bdd0798761f93cce363329996af6c17ed796
SHA512 ec87dd957be21b135212454646dcabdd7ef9442cf714e2c1f6b42b81f0c3fa3b1875bde9a8b538e8a0aa2190225649c29e9ed0f25176e7659e55e422dd4efe4c
SSDEEP 768:2jfnJFqNSkejOy27eW2Vef/7yX3jFICnFfvoUs49RsS98Pu4TNz14GAeRgxQ:ufnLq01weW5yX3jFxv49Nu4GhQ
TLSH
T134537C21B981C073C446107A592DC6B19F7BBC312675C983BB961BBB9F313D1E72E24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-DEK7S.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Lib\site-packages\setuptools\is-DEK7S.tmp
Size 64KB
SHA256 5c1af46c7300e87a73dacf6cf41ce397e3f05df6bd9c7e227b4ac59f85769160
MD5 e97c622b03fb2a2598bf019fbbe29f2c
SHA1 32698bd1d3a0ff6cf441770d1b2b816285068d19
SHA512 db70c62fb35a8e5b005f13b57c1ebbf6c465f6ff0524422294c43e27fb4aa79379dc1e300ad11dc2354405c43b192ae06b91c0f525a1f2617e4d14673651a87d
SSDEEP 768:nMgEYaPKRsVvd7M826QXqVXDjPXHyRhQcBU+zGqJS967GMctEvdGA9SYxQ:Mg/6/tM8NXDjPX0QWlfGMckTQ
TLSH
T1C7536B21B981C073C4465079482DC7B19F7BBC3126B5C987BB961BBB9F313D1A72B24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-6PVM6.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\Scripts\is-6PVM6.tmp
Size 103KB
SHA256 b80d84613af92686500142504def9374f124e208b225501dfbf921ff25d8f4b8
MD5 b9ce4415a717206ba6f434535a44dff2
SHA1 3ab9f1a56d93331687c6ddc41cbe428c2be83346
SHA512 847724655da4ee66d0b5b0b93149f6ce586f8785521eafb444f3bf071e1cbd0ac15faa5f05c5ff0a151caf2437b61f68cc53d45a2bcbb27f4fc83650de6f1aae
SSDEEP 1536:Oq9wlfW9aTR7gyTdneTaef5g9aJxgdS64Cdk+uJE4F4k1hEZqm6iM1FfHYTopwdq:n9sfQvTbuaJG4vlP6k4qmKjfHYTo0q
TLSH
T181A37C4A33D450F9D4679174CCB68915D3B2BC374278838F27A47B6A1F732926D2B722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-O61S2.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\tcl\tcl8.6\encoding\is-O61S2.tmp
Size 83KB
SHA256 546392237f47d71cee1daa1aae287d94d93216a1fabd648b50f59ddce7e8ae35
MD5 9a60e5d1ab841db3324d584f1b84f619
SHA1 bccc899015b688d5c426bc791c2fcde3a03a3eb5
SHA512 e9f42b65a8dfb157d1d3336a94a83d372227baa10a82eb0c6b6fb5601aa352a576fa3cdfd71edf74a2285abca3b1d3172bb4b393c05b3b4ab141aaf04b10f426
SSDEEP 384:SgOycCs6mBixg1k6y8NMSwR8JMvz6VaVZmASVHBtGtRfS7FXtQ/RSJj9fNLSmXn/:SdC4BmCkjSwAO6VIrahNrVNTSYG3Oln
TLSH
T19B830860C35ACDC0DB0D165BE0DB77932A367C7297C415A4623BF8858A378DD6C8C6DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-2ECSL.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\tcl\tix8.4.3\demos\bitmaps\is-2ECSL.tmp
Size 1KB
SHA256 250f7425b32889f3384ff40e288d09ecfdda75c2aeead0444adccaaff444a719
MD5 cfcaa296afc6467e68a6eebd2489bf70
SHA1 d8e658ba3322afbbe58899ab3f1acc45f08d6305
SHA512 da94d09f49e8440e5f87d2f8d29d9cfa5cd95c9a20b224425303ad208d164c31e029bc72b98fb4fc584bff0604994fee2726cd9785b470ac70ebb8badfc5c019
TLSH
T15B21671F86AAFC237A06F9B597C26EA4ED446F83DA85FE717E1C024C37D52382905109
MD5 SHA1 SHA512 TLSH

Submit Download

is-BIKSJ.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\tcl\tix8.4.3\demos\bitmaps\is-BIKSJ.tmp
Size 890B
SHA256 d299abcebe7cf4a006b2ece9a5abd17f8269291f34afa3aa15c9a93881806a30
MD5 53a59004420e88fcd58aee8131d65783
SHA1 c097134dff77daa7ac2e57a9987275220f8f88e4
SHA512 0580b1e78128f27b3ac75b8eb77cccb09dbc4dd79e288dd6fd6df619ee882a1f236f82a1609e094a0f73ae2f97469e75194f087744dee97b86f5b24f6ce4c548
TLSH
T1B11147DB73782884B827A90EDBE203856EEF04B115D62C10F8D95258F9EE03EC1E0B5D
MD5 SHA1 SHA512 TLSH

Submit Download

is-BJ4KL.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\tcl\tix8.4.3\demos\bitmaps\is-BJ4KL.tmp
Size 1KB
SHA256 fbfc3ca770bad13b48db192c64f92c1f4698cf00e58c1051c6355b44edc15afd
MD5 c18086cdceeed7992314935eccbd24fe
SHA1 5a76875519b8942a865f0e5ca890d7bc53a1e6b3
SHA512 023dcffe2a31e4b4b0fe3abce2da359acf3328f261976db4b51c47cac1bf935f10c8582c7b0f717b3e1c9721d352a2999690638737a1f4f1e01cc6bd0b594481
TLSH
T1F321FE199674FC53B209EAB426C3A671ED84BF979D95FE31BD5D120C1398079064160E
MD5 SHA1 SHA512 TLSH

Submit Download

is-HJR13.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\tcl\tix8.4.3\demos\bitmaps\is-HJR13.tmp
Size 884B
SHA256 e899db1d6acc030d684c87b389d32e523ce171aa32700e1626712afcc2cd1713
MD5 67ac239418325e52a736a0dc3f5588e7
SHA1 39f0bcdfeb4c793549291edac11536dbd92c7aa6
SHA512 33030b304d8112f8db590c6c2270f2668f425175bfb7857d335c44cb28e4817d2274045748b05ea4fdcf484d4497c920ea82073f6b0a51f828853b20bb93fca4
TLSH
T142111BCA37FC3544BDA7AF0DCB8003157D9F60B519E2684AF8E95884CAEA17BC1A474D
MD5 SHA1 SHA512 TLSH

Submit Download

is-2MQ1T.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\tcl\tk8.6\demos\images\is-2MQ1T.tmp
Size 2KB
SHA256 72f6b34d3c8f424ff0a290a793fcfbf34fd5630a916cd02e0a5dda0144b5957f
MD5 ff04b357b7ab0a8b573c10c6da945d6a
SHA1 bcb73d8af2628463a1b955581999c77f09f805b8
SHA512 10dfe631c5fc24cf239d817eefa14329946e26ed6bcfc1b517e2f9af81807977428ba2539aaa653a89a372257d494e8136fd6abbc4f727e6b199400de05accd5
TLSH
T1A2417505072CF858CFEDA8F6C98F1198319CE5093471EC971C05497A821AAFAD4FEBA5
MD5 SHA1 SHA512 TLSH

Submit Download

is-FULUJ.tmp

Path C:\ProgramData\PassMark\OSForensics\Python64\tcl\tk8.6\is-FULUJ.tmp
Size 2KB
SHA256 2cde822b93ca16ae535c954b7dfe658b4ad10df2a193628d1b358f1765e8b198
MD5 c88f99decec11afa967ad33d314f87fe
SHA1 58769f631eb2c8ded0c274ab1d399085cc7aa845
SHA512 4cd59971a2614891b2f0e24fd8a42a706ae10a2e54402d774e5daa5f6a37de186f1a45b1722a7c0174f9f80625b13d7c9f48fdb03a7ddbc6e6881f56537b5478
TLSH
T1FF41C52A737243B24AC20791BD5D76E5B62E9F7C7322B584382D620C760352DA3FB442
MD5 SHA1 SHA512 TLSH

Submit Download

RegularExpressions.txt

Path C:\ProgramData\PassMark\OSForensics\RegularExpressions.txt
Size 856B
SHA256 c5581a27f519666a0dafde10cbf412f573ee9823c35025cb2c4b0fba144b07f3
MD5 23f15180a2a78e707c9f46f2eee38101
SHA1 67a7fac4009b51969c3fffc8db2aae953eed5176
SHA512 4b333bcfc6436c318a4e1d98fde189dcafcd8a50ee635ddebf77ddd2184a69c844a0adb6b25f1d120187b523b2ce3cfefc3eb25ab462427271104e73478ad73f
TLSH
T1C611F5E64F8AB5D12F7D7809C5AC5061BB463B218E2DEE4B13C4158F0AF0218D87DEA6
MD5 SHA1 SHA512 TLSH

Submit Download

is-VS534.tmp

Path C:\ProgramData\PassMark\OSForensics\ReportTemplates\Case Report - No Javascript\is-VS534.tmp
Size 3KB
SHA256 361d2f1ea696fb25936228b3c5f9e1db26d32d8b18e7e264a8fea130d5d18274
MD5 cf5442acfdabf3d4e8aaebbc92bad0e8
SHA1 116905380efc62fc6e7952269f2ec2a7b84b5bd0
SHA512 fb1fc78b1424fcfcce26d33e6d4fa52f2fc10a209369da6c8549494d5fa38a14ae9131e846adae4c63c6e9a0af179e866965a7dcc0ccb0a5690b068950ba0a6e
TLSH
T157613B4564749C4ADCCBA4E64818685F66169A01F24320F99DF3BFC8CA34A739C5DB06
MD5 SHA1 SHA512 TLSH

Submit Download

is-3F9TK.tmp

Path C:\ProgramData\PassMark\OSForensics\ReportTemplates\Case Report PDF - Printer Friendly\is-3F9TK.tmp
Size 829B
SHA256 83d252074e3e92b09c7dc7a93bac6332c26eff18c7325b316b32ad279cc643ec
MD5 9692357a7f0d451b75cfdbdbdb55125c
SHA1 1e544ddfb86bd77f0d047a6c32e2637b8accf009
SHA512 8ad3eddca456a532d2b58d5358073252a6c017936d4a2c73367487a5ddf617d7dcfbd4fba3e7b46e7403eaeff40e73c9ee5a7d52508af1bbba30f3fb600a13e3
TLSH
T1B60181D0F1BDD1232DF595385E908FA28C85152828630F8DF26B2898A249F852C6D13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-9HF05.tmp

Path C:\ProgramData\PassMark\OSForensics\ReportTemplates\Case Report PDF - Printer Friendly\is-9HF05.tmp
Size 12KB
SHA256 b7889f9f3d9e07240451a7e772849d254c03da352debc558f02ccd8c0cb0a34f
MD5 8f686d799c18844d296853333694634a
SHA1 7372d3fe21f1a21791b91fa44dbdc94e099c9687
SHA512 459c6f69d21f5532fca4c846a9501364367780b5f598c089613e27cdd4975c8a0faa674577454e4c4d213bbaafab56655e16f4120c767a9b94a22600dd02d637
SSDEEP 384:nzwkRz9U4lyRwHh1dRUH/u3IN26AYWAZVs/27:n0+S4l1UPfT
TLSH
T1BF42B685739975A380C9A8B0C49E056ABD315FA36404C831AE75E48B3DB4E8CCB77F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-DFB1K.tmp

Path C:\ProgramData\PassMark\OSForensics\ReportTemplates\Case Report PDF - Printer Friendly\is-DFB1K.tmp
Size 64B
SHA256 27d129fa5a93bf28ac9f228dd2acd5de75bb9f81d53b011bb448cd94dcd9c143
MD5 3c2f9d238d4d811277b6182d1bbb1709
SHA1 598b211e1d0742900316d3b00e0a6ca9a48bda36
SHA512 7637d7c86cbeb5e36632a5afabe38645631c78749bf45cfe2b7ea5be8d62533991ff84728fbd23319b8930a87c66dae16251ef85c353d9ca0da3cd5c2bf483ff
TLSH
T1B8A02282A88CC000C00223320C288B830020FA22820C0E0BB232A300A8200338022080
MD5 SHA1 SHA512 TLSH

Submit Download

is-QE6M0.tmp

Path C:\ProgramData\PassMark\OSForensics\ReportTemplates\Case Report PDF - Printer Friendly\is-QE6M0.tmp
Size 70KB
SHA256 e23a2a4e2d7c2b41ebcdd8ffc0679df7140eb7f52e1eebabf827a88182643c59
MD5 10092eee563dec2dca82b77d2cf5a1ae
SHA1 65cbff4e9d95d47a6f31d96ab4ea361c1f538a7b
SHA512 cc92cf5a9b3a62a18af432fdffb81b76da84e2f43ce3c7800a919c10809118d0611e29a47f103ff3df18a54d5331bc5f06ef4771dc406cc763b30ff2a66a3e81
SSDEEP 1536:Du98G2ltZMNWnDr7doqPp07HVDTLGbY9TGA7zEcbnkb17jQq3nPRefqvpsz:DuJItn6qepq15nUfqvpsz
TLSH
T15063E9C9B2C67273C3E730B824AF510AF136A8AAA44C4854F06CE8E5BD74A55447BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-VFHD9.tmp

Path C:\ProgramData\PassMark\OSForensics\ReportTemplates\Case Report PDF - Printer Friendly\is-VFHD9.tmp
Size 54B
SHA256 1cd572b583d93dd347d963f8f2d9b0c550338096726af04ad9eae8ea36707fd6
MD5 33491bb5c9bae4d25b74a178d8f598e1
SHA1 5cbe13b9a8b2627689f55e0426c73cf9af56cc26
SHA512 8534e76424111f2ff6728d3046fc8c99cbe17ac7bce1294a3111c887ac2a5c9ea62948ac4226d010abcb6f69cc99f978acfa00e3f3fc3aeb59289d5ea23930cb
TLSH
T18F900242B688C441D004E4705C658794213697514184560BA0E52A01BD5B9394423D80
MD5 SHA1 SHA512 TLSH

Submit Download

is-E4NO3.tmp

Path C:\ProgramData\PassMark\OSForensics\ReportTemplates\Chain of Custody\is-E4NO3.tmp
Size 22KB
SHA256 91171498d053bc95c736c13c453ec1d1c01f7c3f55bff5cc7871f959559c2137
MD5 d6f99a5310a9fabd083320f18f74a60e
SHA1 ff4d1b9e2accdcd831dad9176244a7849da6f1f4
SHA512 f2162bdaa9f531c482c4a07f673e4a8db6d3d0262370730bf5172f281086475e68458942aa70354f148fb96a37c31139f31daab9e5fbf8d32f05495595a55796
SSDEEP 384:xfiMJ7TD9bfyx8q1+zD0LpaiIcbHWLLd8IG+ophWsx0+8RMTwSjGBMP1Z:hiMJ7U8q1+vma47WLyfgsxz8RMT5yOj
TLSH
T152A2E0E0D77AF750E6C6CE3981002518622CD0D5377A5B8C1D4BD39AE5617B1819ECBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-Q3DP3.tmp

Path C:\ProgramData\PassMark\OSForensics\ReportTemplates\Log Report\is-Q3DP3.tmp
Size 36KB
SHA256 0e65e8eecd5ac080a4b16c720ecdd35dbd4dbc25fe434aec0bbaa31772d6bb63
MD5 ba6ec36a7392af0f724f7baf8522eac6
SHA1 837142b0a73d5157c1649c9a1258b936f904c4d2
SHA512 e43114ed263538f13eeff2aee6dca4fa35dba053b44572cd037531f9164f66f1351fa9bb2aca1db5752ef75f1b9adb52dc3bb3fd71557039b2f1e48f2007397b
SSDEEP 768:/C9UExfjeQO/tdn6RtNpHYx/IRk/yq5GieDlVFU3bcn7H:nExCQO/ONdYx/tqUrcn7H
TLSH
T179F2F1089F1064DE5EA8B6D24D4A600D4CDBCCDD8EDE14D86E491584DF3A66DB2A0FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SMARTdesc.csv

Path C:\ProgramData\PassMark\OSForensics\SMARTdesc.csv
Size 31KB
SHA256 35fed9e08a69465c18f8022ad5cb744ce052322d90be4eccc4584d3bccbd9d3c
MD5 cec52ae5bfbb8ffa8b259c8d85e79725
SHA1 1f609a272131fd6e90497f15d19292b7e5ace8a9
SHA512 cccb8a31ce9843ed5fb688a443612fe4105b801f2e95b238cf5822d876275da5e204c71864b98001664ee26ccb6d7b0f21ba949c6e662cff645ef11dbf60d7e6
SSDEEP 384:3qYJrYoHdHRfCVc4xMHfhiji9iga8K3oJvIwjqqpGFd6DWkY3TiAfm4pEUkjdsji:RYoHLfEUcO+3o5IwjqqpGFd6iCAZpQCO
TLSH
T144E28625AB1413B62F2313E0715F8296E7B18268C663639594ADC029730ECB8E77FFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SysInfoStyle.css

Path C:\ProgramData\PassMark\OSForensics\SysInfoStyle.css
Size 2KB
SHA256 2f518d58a7b8b055bb602d82ed6e74ca8050fb29041d727b1dfe9b01ccd78df3
MD5 577564b4668149218ca552d33c1a4c72
SHA1 a8a0145e039b405ffd3ca1096a4355ba0d636c4f
SHA512 4f295a78f0ebed902962b42f8e836b6717f70666d6279af2d756760b4adcc118d8521d9f9a795dea470b0e20dcaffe94c30ef9db9a20ea34b90306d53e8e67bb
TLSH
T159417806FA42030675135C6AB25BBB53AE5D0246745783B03BA62D65C8CE89323E63CC
MD5 SHA1 SHA512 TLSH

Submit Download

_07b-ATA-IDE-SATA-forPE.reg

Path C:\ProgramData\PassMark\OSForensics\_07b-ATA-IDE-SATA-forPE.reg
Size 8KB
SHA256 1cb3cde34188981e7fc03710528f064928463265260251fcb1ef18d756dd8728
MD5 bf20aba78e66468e4cf66c2a19b3b088
SHA1 761fb94dde832677aef85d983c95ddbe4ed8ee70
SHA512 69f848b46fb75aa444380287b0d5c0f270ac09e0ce505f090463472bfe6b0f6a54d02fd2d0b21681dc4b32796f21954b2df4810159ec057abb57d66c07a8a1aa
SSDEEP 96:f7d/ksKQ9ri97WRsOJqfjvIsKdF9l0xZSV9LWyGCZwTv41iJ1wIDPfwcDG6PYwh1:R8/cy4Vy3//T
TLSH
T1AD0269528E7317FE541BC1BC3BAA8C8525857195878A9C03900EE60738E5DDBF3EB58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApfsDriverLoader.efi

Path C:\ProgramData\PassMark\OSForensics\efi\drivers\ApfsDriverLoader.efi
Size 11KB
SHA256 1401ff4e57eb4a90e4cb0597b0cd8fea36e42e7bd7fc4810328288fb109a1122
MD5 0600f1c4c04172b226344e9d1c34bff5
SHA1 3fc9d44a15aac07cc2cc0f7703500674468d212a
SHA512 5a66e2a372d6e8a904d907e60d90670dcb411865f95881ebaa239ef89ff4779d395ceaee50a1184b2bb2d6035563f7ce26234267faaafb3ddc7458d06d5f5801
SSDEEP 192:4PYTyWE7F3kzvvKlu5u/nr/hi4ZBz5hagzDUlcFnuH6YlvWImoeY9qS+RPgCu:37E7F3kzvvK8E/nRXzLag2l+ke6qS+RU
TLSH
T134423A7B12A19464F39DC4359FC29E22B5F1306328312A8C27D16172CBBAEC97B29758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppleUiSupport.efi

Path C:\ProgramData\PassMark\OSForensics\efi\drivers\AppleUiSupport.efi
Size 45KB
SHA256 ff3b08b24ce22a6d0563add8e61bdb313e3cfd9d154b9101a84bfd2129a7c793
MD5 9d6cee84326b2d5aed29d1417882fbe2
SHA1 03fc9cea431af7df473511a814bdd662f0bfb015
SHA512 1110a064add7b80144bd5e6c982b71513487ac3e88334d24dee3f679dd578bdaa98efccf7d79c134dce08393fde1cfd025e092d8fa2f86f79059956180be3eeb
SSDEEP 768:7rvCKM2ST5W51wl4MvEok3abcc4yyllP3xB+ajzIVekyTahfm4C3OWHEo+fqIeuB:C2ST5Ws4Mv3pBglPhB+Sdahfmr1wC3uq
TLSH
T11E237C575AF190B8F092C2304BE7EE1789B678222B21959D23D565703F76C913F2D38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apfs.efi

Path C:\ProgramData\PassMark\OSForensics\efi\drivers\apfs.efi
Size 592KB
SHA256 e88a5f23adecb003f75ad9ff79258ae71dd2df1a4b30ad92f6abbdfd88addf22
MD5 960d08d218f9d11566f75217b40dadd4
SHA1 e8d530b12ce44bc0c70063b70c46a2332bbbd65b
SHA512 457828b8bd7f26ec73d3fdf76e8a42055a7287d5795eccb84d59da80e5fe4d1ca4b0e785399ec92905e1455f368cb1003600eb0ef7848191f2a32118f09a3ae8
SSDEEP 12288:aJqBgb+Z145X05C/juMtjFbuX07QFGuy/qn6d:anb+bY/txuXBGuy/+6d
TLSH
T1CFD48D33907254E8D4E6C0305B9B8B22EA3078E74A38B84E33D956716B7AC553B6F71D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptocurrency.OSFHashSet

Path C:\ProgramData\PassMark\OSForensics\hashSets\Cryptocurrency.OSFHashSet
Size 2.7MB
SHA256 3cc9bdbff48cc79995f95f92ccaf48642606daef0132ac274906fe59e11d619c
MD5 fa00e17a0ee7b46ee36de48a10ff074f
SHA1 5c85a8e4cfa983bd36b5c8ea03d5ebb36e815e73
SHA512 afe6c29e8aed3c1fa3d996d31bd5c3a79a2e4078cbbdb6ef2f708c64befd29ac5f1b30d8fd55dc70d304c5dbe052f046378e66de992eec33b040ae2fce30978f
SSDEEP 24576:wy4OYFoVQFyzGDs68EyZqHkNi4dRdbkoS4H8eoN+V:eAsEip4dxPjoN
TLSH
T1AAD57D85EF6399AECC8A0EFB84614B850F1B8C8B9F3317972D0EB46918722525D5D4CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Example.OSFHashSet

Path C:\ProgramData\PassMark\OSForensics\hashSets\Example.OSFHashSet
Size 2.0MB
SHA256 46642bf5f73453c8be649755dc0bdb4bbbab058eec75c54ccf2f658767f00411
MD5 b223c7baeaa792623daed30b82cce3f7
SHA1 39030ac92234f4e3d7774e2115bd3be9b230141d
SHA512 27482a25b3ab4f7b8868475af017e66dbdef652aa2e752fbdee8b72f7861adfc54e738bae5e405933e256e1e854489556df218d49c1f956b58c26a7bd6f97c13
SSDEEP 12288:Cj3Bc+ZzHqSqdciWdxtQ99iNCbRRvF3z8+AbVMBM0ptaOu2L5:Cj3Bc+lHqmjzoXlzFAMoC5
TLSH
T1C3A53C09FF61DB77C8860EB69C602B483E399C579FB2170758CEB0A58532A584C6CDDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Keyloggers.OSFHashSet

Path C:\ProgramData\PassMark\OSForensics\hashSets\Keyloggers.OSFHashSet
Size 1.8MB
SHA256 5e3e703214faf341cc417cece6c19221a5c617851f443cd2b0df52e7160418a2
MD5 3e4c4480616d830a87a2120f5e401657
SHA1 2ef7641e1eadf3a059ac2116893ce2bd3b79e932
SHA512 ddbec6eeec9c2342ede29b7b143dc96d6b91e4b9781fc56a751200bc9ff5be7c7349362d9c462eff819690120d7cef88ba8a96504027c192dfc1e9c0c558f94b
SSDEEP 12288:sy4OYF5IWP7orB9Dol2ohOfxvHkLMxEzIZQKLCjFpaGa2+AfT:sy4OYFdkrrsZ
TLSH
T123856C15FFC2985ECD9E1E7D00B51B841F2BEC135E3257931E8EB0B828B2686ED554CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

P2P.OSFHashSet

Path C:\ProgramData\PassMark\OSForensics\hashSets\P2P.OSFHashSet
Size 3.6MB
SHA256 d2d4b4d20fde9fbca4231d81f614b5660ed58a9ace2251f4308f82b159aca07b
MD5 8da361cb3af35c9a9d38f70a04e13480
SHA1 fc1cfac811791973b4e3c91c672661de86928516
SHA512 153a0f9c1835ec168cb87df52c206641a1ed4ebc8c7011cf0e8fd40345564cbdea22ca7348f576359c6db6db4ee3c92c7cbdd41016d74852534cf85d850d32f6
SSDEEP 24576:Zy4OYFqpc/LPSypiuOIY1sKtQ+1tTWNkSyXqH+ynxtverSUV4xdRUb:fq2D9iuTY1sKO+1xRsx5aSx
TLSH
T121065AA9AF4398EECFCEDFB284501B452FA85EA79F260747097A72BD35336014C114DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VPN.OSFHashSet

Path C:\ProgramData\PassMark\OSForensics\hashSets\VPN.OSFHashSet
Size 3.6MB
SHA256 f589dc6e48081d0693d83b22b56642943337796a262d0aa9ea4c86f21269f231
MD5 50703476be4cff7fe0d83ca6708944c9
SHA1 4070917b6c7677edd363d003f3c7beae2ced7cfe
SHA512 f878c6ebe127a956cd1be9293e199afe77eeb0cc313d0949936b79d9d829f36cbd6e3de932736cab382b4d9a678efb164a919e394631d5f7096026f73a453c6d
SSDEEP 24576:Ty4OYFmKavls9Y8sQEWq9ca+lbYRe3IsbCuv5EKqoJakZ4z7o9LRA:JKkEAa+r4Iv
TLSH
T182065B69DF57D89CCA4A5EF240204F488F6A7D979B760397293E73FD28321088D46DCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plotly-2.2.0.min.js

Path C:\ProgramData\PassMark\OSForensics\js\plotly-2.2.0.min.js
Size 3.4MB
SHA256 b12e1f1fbae97e2577928ae1a2a4dffe6d2ab6ef1e352aad25de9be52d1f9931
MD5 acbe4de3995da238fa9717f32ab46a29
SHA1 6f1834260fca936e20b10bb15828ccca2bfaac5b
SHA512 d6670a0e980f9136e5c530d622ed9db2a9b77ada13610ec686b0aabc699ae4cf45cfe65251165184a297785c7c145e8b380de430aba5f7269358e607e9be696b
SSDEEP 49152:ZTlT0IJPJwEO97vt/42vNGMzIpz+ioZkQhNlIsDGM3K7K66upRRK5lu++eYQhXrU:sJHkv
TLSH
T19AF54B98B255703A479372A4446F050BF27B6D58B40AC89CF25AC4D7ADBC88D627BF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

magicLookup.csv

Path C:\ProgramData\PassMark\OSForensics\magicLookup.csv
Size 827B
SHA256 2e2a568a6e5a94b6fbf51619c459f90bd0ae149661676bf80a419600fafff20a
MD5 965485725879145a37a1f999f28c92c6
SHA1 aac6d4f2cd8ff6e7f0ddcbe720e0ec9a5f2e1b7f
SHA512 f34cd85da7a9dd0126a57e6c3a9ab8aa302835ad8ef758b0523c519bde0640d81112eea42b7a9c986f2f04478a1c1f7a3738ef8dc98d0f2418daba2499a8807d
TLSH
T119015742BC1DA92D6425A49A09571C910ECFF0CD2DE76AF8E0B4608262B5D773EC29D4
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp120.dll

Path C:\ProgramData\PassMark\OSForensics\msvcp120.dll
Size 444KB
SHA256 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
MD5 fd5cabbe52272bd76007b68186ebaf00
SHA1 efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA512 1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
SSDEEP 12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
TLSH
T11AA45B237B864CF2D19E53B231C9531557FAFC6441B1F343ABEEE1692FA6282E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr120.dll

Path C:\ProgramData\PassMark\OSForensics\msvcr120.dll
Size 948KB
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
TLSH
T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oauth2reponse.html

Path C:\ProgramData\PassMark\OSForensics\oauth2reponse.html
Size 240KB
SHA256 269f557f56e4219d2b68b08dd45c43767b81c35e4e4ccf85b38f597e6113157a
MD5 27afe6363e42974185b210944a221a5e
SHA1 a03aeaf343b5d0cfaf45190d595a30ee8c77ae68
SHA512 f3ca7df96414c2800c3a69d2ef1a5501379fc018347fc452beadb60263b16de28dfaa1a8c867bcf8cc24ec5a8286d3db33980cae3f6518f2923e6eed62d216c9
SSDEEP 6144:ojl1dEuvDp/PCHafnEhzzudmep6abnGHZdQXfyJrurSzpEoP3:ojNJ7xPGzutdbyZdQqBuONv3
TLSH
T1E6341265C7038F5EEF6481B4D29B420E5D448FA6E1BECDBD08DA295106DBB21C04EAFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osf_filecarve.conf

Path C:\ProgramData\PassMark\OSForensics\osf_filecarve.conf
Size 8KB
SHA256 39b3639ebf3cb41c4e2d155e2d840570d466687eae6c865a67f98a1cc3c30f7a
MD5 d27eb0a00786faab80306d22f6ac9e95
SHA1 6bdda339cc5cbdc3950d999e140c359374f05801
SHA512 0025195e5a0fd299e72fe098986bed9fc3e0487e8bdc0b299a7514e88f52fbbf1a7ac76747756dce1168a1256fac3d252b7c0b141a9ae1518fba19ff6dce9ced
SSDEEP 192:s4QI8YPENrRdErgYFVESWE/eiAWHaM++jXn:s4QFYwCFe4PH5n
TLSH
T1BF022FDA2E40B632DB10C634B71AF1FACB24B05ABAEC6B5190CA55393515C3C42DFB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qpdf.exe

Path C:\ProgramData\PassMark\OSForensics\qpdf.exe
Size 166KB
SHA256 156a0501922fae17efcde39ccd4a7542e22ed7d3cf0a4e93323b875420577eb4
MD5 1b8b9abc4392ea39c8cb879312d8cfde
SHA1 a63841f8dda8d6e224f08ae6ff67d56cd6017a21
SHA512 20ffce3bb1de80169037d5eae19cc73c77bba8d224e94890d4ec6dbd0f7c8fa225bf28321a3ea0aeaad512271d319790903831ca902fbc8d5cdd50eacb6ac209
SSDEEP 3072:MetGskdYQ1wP4o4fF1ZEaw2t+iMrnJ9lTpdR1DLdmV5wQ:3EwP4o4tz42tTMrnJ3Tz3D8V5wQ
TLSH
T1D2F33A1E7B1441A6D1A292BC8AC6CA43F371B4080B2197CF27D9837D1F63EE94DBA535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qpdf21.dll

Path C:\ProgramData\PassMark\OSForensics\qpdf21.dll
Size 1.5MB
SHA256 0ba3b1c008bdb7d9261a8f4317e5b47f8147ace421c6486734465887f2370571
MD5 b39231d65072cfed4ecc653a15928acb
SHA1 60b54689367d61eac9ca0c08552f2541a1756d9f
SHA512 c5bc62f7ed8143c235a1788c0c3e304115672150a8e62bc6fae5a00cd1ffc1bae5729709ca2c61c1a5bc69e93e83478bfb365699f7f3e5af59d70c53429a3a22
SSDEEP 24576:wH+fkHvH6HJHfHEZX/kLHOHpHZH3/weYFGH3HHe7qKj3cH9YBIYQ1eRLW9e5+TEB:wH+oZvk+/wWetByReT5+TYV0
TLSH
T10475491BAA2581F5E0B3E2BDCA82995BF67130044B34EBDF45554B0B2F23AF48A7D354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qpdf_README.txt

Path C:\ProgramData\PassMark\OSForensics\qpdf_README.txt
Size 540B
SHA256 e4255ef565dc9dfddb1c08aef6cc19a784a90b14e3955f61ce55c5d67b21befc
MD5 dde272a29323c55a39b800b7e655df75
SHA1 da3b249c16a4bb22b4bdb511cdb4eff9d2a9d1d6
SHA512 48a106d1ea638a82ea8a3485d2fb0d8d53567864ae4104037e0c207e8241fab861fd99ea13f0a81df2c34bc36f2e48026e971179ba82a2548c2700db2bc7b52b
TLSH
T1FFF08B6CB68D213086E31250E30FEED73376408A230A763889281188707E27283E71CA
MD5 SHA1 SHA512 TLSH

Submit Download

top10000sites.txt

Path C:\ProgramData\PassMark\OSForensics\top10000sites.txt
Size 1.3MB
SHA256 f0a8a4584bc87483314167b1b7848ec8763e138480f22b51d1f70bc6a7994e8f
MD5 9d829e077e01a64b3de691ea85a17e2a
SHA1 636a174af6ac3f8e8d07f17607312fada593f562
SHA512 d183a2a003b13d7e7d34512c6e567463e49abaac544b83cad999cb12aee5952c9ffcc439b2e84def78649b7538b8586d925b7a1cae7890019c22f1c7269083f9
SSDEEP 24576:jW0Hv0nufPtO4+1uw04Jc3Klt4NxLdfmdGPILlogJiXc1YRpMrbJL0VBMp:BHsufPtOtt04y3qGxLpmYC3Z1l/d0VBk
TLSH
T18B55D15366FE8709B6B35A5C2DBD54758FBAB852E81CB78C433105C905E1E809EA0FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usb.ids

Path C:\ProgramData\PassMark\OSForensics\usb.ids
Size 547KB
SHA256 df4f6842fb0136452533b08f421188be97e2e1d12686d08268edfc1ae802b568
MD5 273596b6ee101b1df454827cfa87dff8
SHA1 79cbec7fffefe16913a299ce59a29d7776e03f46
SHA512 a706b438ec4a68033d74f68b71250a8672f1ddc6790c07b3561f8a9a7204aab83ed07043ec8120524e64886ed665e5edb69513c794091da32c22fdf35cea5eeb
SSDEEP 12288:rJeiEk+mLrNzRcypbEhWGrsayrGjxC31riyAt1yoaALuypIdrKQPO0x2lSayRcDm:7EkBLrNzRcypbEhWGOrDyqdr1Bx
TLSH
T190C44A156EDF3813236B928F7B821CAE592E3885251B566B112CDDDC63C70C99FDBE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usb.if

Path C:\ProgramData\PassMark\OSForensics\usb.if
Size 26KB
SHA256 89cc88bddf76460baabdd918eb75571550897c4066ae5fb31eca1d4cbfe03f8f
MD5 b59549bc5125b75d44301b2150a19180
SHA1 4428de772205bce9bb5ed95cf735363fa4b5f1c6
SHA512 966b8a0a74d61eee77b958e510263089443876486064e56f6a6c9e3339152a640fcae7b6626137bf46c76a76ca2cbbab1b97912771b90d59367eb5f49d53a7d9
SSDEEP 384:TniBtyRX7nSv4IRqj5cHY4J4q3h03+RPVinsJ/pmTJayL+WP42qoOVsNOT/AvNHb:Tniyl7SvDRqdO53JGO/cLphOT/Avxb
TLSH
T1CDC22FE93A2F72220B0E275F7DC32EC7333C27DC716912117258501765FB0AA6ADAA5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkhtmltopdf.exe

Path C:\ProgramData\PassMark\OSForensics\wkhtmltopdf.exe
Size 21.8MB
SHA256 77e6ba092516048d79ff20571cf97903fdd12a85f5aeeab8d1ccd78d757b9898
MD5 7391ffae579131578d2215a98a2198f6
SHA1 c8bb4eed2afbd1ba42d6af1e6c9343c1c1704ebb
SHA512 19c29dc8d115c0afd3f2355e137a5e4d7fe1ed232926a274b1b42ae1d147f8f57898385a1d166481be678bc9dc206b1762e84ecc209ea7c1fbb672cbb81b9aff
SSDEEP 393216:xqeejQG8CnBRUeADaG31Jsv6tWKFdu9C3/E:xIj7dBRUeAWG3BE
TLSH
T157378D02FB9F82F2EF8614F4506BA72E47B9561987244EE3D21C2BEA5D311D23D3B149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkhtmltopdf_LICENSE.txt

Path C:\ProgramData\PassMark\OSForensics\wkhtmltopdf_LICENSE.txt
Size 7KB
SHA256 ea7d049c7705dc13afc202dd18e1827f3484f8212fd3fa7b82fc4a0c363432c9
MD5 38138baa100d7259934590850bc0406e
SHA1 c70af14df11e3908dfc10397b1ba4b1f346661f3
SHA512 342718258f5cf7c8d6cd575cec375e9806980f56d1451b752ae6a3a37d35a00ebf236262ef806ee73be7b4d9e49f00324c6a355851093f33a7b5f7e46f5484bb
SSDEEP 192:ph8dfuB05iy5ylXFln0LxDvjzDyf1/rKpC:Udfsgi6uD0LlDs
TLSH
T196F1EF6B970153B202E305416E4EA1CEE36AA07B36778D6438ADC25C177BC3493B66ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSForensics_v10.0.1016.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-Q38IK.tmp\OSForensics_v10.0.1016.tmp
Size 3.1MB
SHA256 95cce03aeb60ed01fc8847ebf77b1cb6f37af836502bc21cfa349260e27dbc7d
MD5 571d58f5af29bf993557814987fcab45
SHA1 c786b1a3ca9533211858878bf9099902a6c78aab
SHA512 70f6fcb2afef028841d64a4e693af917e88fe48e23ee3d8eb91dfd16035f027928c66b9a221bc76d38051d8ed90171e943c7f8b74de2dccd12a92ede3d3bebac
SSDEEP 49152:0LJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTv3sDJ/IEZJ:gwSi0b67zeCzt0+yO3kSJAJ/L3
TLSH
T1DAE56B27F7887D3ED06B0B364A37C650983BBF627A128D5757F0290C8E355942E3EA46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_setup64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-VLLIO.tmp\_isetup\_setup64.tmp
Size 6KB
SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 e4211d6d009757c078a9fac7ff4f03d4
SHA1 019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA512 17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e
SSDEEP 96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
TLSH
T198C1E80ECA279263FD5A09B79E8219C46FFC262339C6623FCF0045D667C1E4E59A17B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-10335-0x0000000006B70000-0x0000000007D3B000-memory.dmp

Download

memory/1736-10326-0x0000000000400000-0x0000000000508000-memory.dmp

Download

memory/1736-1-0x0000000000400000-0x0000000000508000-memory.dmp

Download

memory/1736-7-0x0000000000400000-0x0000000000508000-memory.dmp

Download

memory/2984-10331-0x0000000006FC0000-0x000000000818B000-memory.dmp

Download

memory/4516-16-0x0000000000400000-0x000000000072A000-memory.dmp

Download

memory/4516-4435-0x0000000000400000-0x000000000072A000-memory.dmp

Download

memory/4516-10247-0x0000000000400000-0x000000000072A000-memory.dmp

Download

memory/4516-9-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/4516-10325-0x0000000000400000-0x000000000072A000-memory.dmp

Download

memory/4516-514-0x0000000000400000-0x000000000072A000-memory.dmp

Download

memory/4516-8-0x0000000000400000-0x000000000072A000-memory.dmp

Download

memory/4516-5-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download