45e3b30b...9ecf

C:\Users\5P5NRG~1\AppData\Local\Temp\svchost.exe

Dropped File

Binary

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\z[1].exe (Modified File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	2.38 MB
MD5	03b4bde64ec061d96f076f01e46962c4
SHA1	8f7cadaf91289d579fbe86403c76e2ad08a05342
SHA256	1d2ebc84511da3d31ee0178241c25273e12424c710df8bcf26be35d3920b6ad9
SSDeep	24576:RQsYQyqXKxgIjd2muM4j+6Fat/Q6gG36d2K+9u5tUjBPSfI4q5s6uINuNS/SEVRx:KqyRSIQaUxMj5Sg4q//SEIZ
ImpHash	431632d4b949b124df9085fa5baea5d7
Parser Error Remark	Static engine was unable to completely parse the analyzed file

PE Information

»

Image Base	0x400000
Entry Point	0x61c598
Size Of Code	0x21b800
Size Of Initialized Data	0x46600
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-12-17 06:57:32+00:00

Version Information (8)

»

CompanyName	Microsoft Corporation
FileDescription	Host Process for Windows Services
FileVersion	6.1.7601.23403 (win7sp1_ldr.160325-0600)
InternalName	svchost.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	svchost.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7601.23403

Sections (11)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x219e74	0x21a000	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.48
.itext	0x61b000	0x161c	0x1800	0x21a400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	5.99
.data	0x61d000	0x87c8	0x8800	0x21bc00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	6.7
.bss	0x626000	0x77f0	0x0	0x0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.idata	0x62e000	0x31b0	0x3200	0x224400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.32
.didata	0x632000	0xb3c	0xc00	0x227600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	4.1
.edata	0x633000	0x9c	0x200	0x228200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	1.95
.tls	0x634000	0x48	0x0	0x0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.rdata	0x635000	0x5d	0x200	0x228400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	1.37
.reloc	0x636000	0x2f958	0x2fa00	0x228600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.72
.rsrc	0x666000	0xa146	0xa200	0x258000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.3

Imports (11)

»

kernel32.dll (119)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetFileType	0x0	0x62e8a8	0x22e0f0	0x2244f0	0x0
GetACP	0x0	0x62e8ac	0x22e0f4	0x2244f4	0x0
CloseHandle	0x0	0x62e8b0	0x22e0f8	0x2244f8	0x0
LocalFree	0x0	0x62e8b4	0x22e0fc	0x2244fc	0x0
GetCurrentProcessId	0x0	0x62e8b8	0x22e100	0x224500	0x0
SizeofResource	0x0	0x62e8bc	0x22e104	0x224504	0x0
VirtualProtect	0x0	0x62e8c0	0x22e108	0x224508	0x0
QueryPerformanceFrequency	0x0	0x62e8c4	0x22e10c	0x22450c	0x0
IsDebuggerPresent	0x0	0x62e8c8	0x22e110	0x224510	0x0
FindNextFileW	0x0	0x62e8cc	0x22e114	0x224514	0x0
GetFullPathNameW	0x0	0x62e8d0	0x22e118	0x224518	0x0
VirtualFree	0x0	0x62e8d4	0x22e11c	0x22451c	0x0
ExitProcess	0x0	0x62e8d8	0x22e120	0x224520	0x0
HeapAlloc	0x0	0x62e8dc	0x22e124	0x224524	0x0
GetCPInfoExW	0x0	0x62e8e0	0x22e128	0x224528	0x0
RtlUnwind	0x0	0x62e8e4	0x22e12c	0x22452c	0x0
GetCPInfo	0x0	0x62e8e8	0x22e130	0x224530	0x0
EnumSystemLocalesW	0x0	0x62e8ec	0x22e134	0x224534	0x0
GetStdHandle	0x0	0x62e8f0	0x22e138	0x224538	0x0
FileTimeToLocalFileTime	0x0	0x62e8f4	0x22e13c	0x22453c	0x0
GetModuleHandleW	0x0	0x62e8f8	0x22e140	0x224540	0x0
FreeLibrary	0x0	0x62e8fc	0x22e144	0x224544	0x0
TryEnterCriticalSection	0x0	0x62e900	0x22e148	0x224548	0x0
HeapDestroy	0x0	0x62e904	0x22e14c	0x22454c	0x0
FileTimeToDosDateTime	0x0	0x62e908	0x22e150	0x224550	0x0
ReadFile	0x0	0x62e90c	0x22e154	0x224554	0x0
HeapSize	0x0	0x62e910	0x22e158	0x224558	0x0
GetLastError	0x0	0x62e914	0x22e15c	0x22455c	0x0
GetModuleFileNameW	0x0	0x62e918	0x22e160	0x224560	0x0
SetLastError	0x0	0x62e91c	0x22e164	0x224564	0x0
GlobalAlloc	0x0	0x62e920	0x22e168	0x224568	0x0
GlobalUnlock	0x0	0x62e924	0x22e16c	0x22456c	0x0
FindResourceW	0x0	0x62e928	0x22e170	0x224570	0x0
CreateThread	0x0	0x62e92c	0x22e174	0x224574	0x0
CompareStringW	0x0	0x62e930	0x22e178	0x224578	0x0
CreateMutexW	0x0	0x62e934	0x22e17c	0x22457c	0x0
LoadLibraryA	0x0	0x62e938	0x22e180	0x224580	0x0
ResetEvent	0x0	0x62e93c	0x22e184	0x224584	0x0
MulDiv	0x0	0x62e940	0x22e188	0x224588	0x0
FreeResource	0x0	0x62e944	0x22e18c	0x22458c	0x0
GetVersion	0x0	0x62e948	0x22e190	0x224590	0x0
RaiseException	0x0	0x62e94c	0x22e194	0x224594	0x0
MoveFileW	0x0	0x62e950	0x22e198	0x224598	0x0
GlobalAddAtomW	0x0	0x62e954	0x22e19c	0x22459c	0x0
FormatMessageW	0x0	0x62e958	0x22e1a0	0x2245a0	0x0
SwitchToThread	0x0	0x62e95c	0x22e1a4	0x2245a4	0x0
GetExitCodeThread	0x0	0x62e960	0x22e1a8	0x2245a8	0x0
GetCurrentThread	0x0	0x62e964	0x22e1ac	0x2245ac	0x0
LoadLibraryExW	0x0	0x62e968	0x22e1b0	0x2245b0	0x0
LockResource	0x0	0x62e96c	0x22e1b4	0x2245b4	0x0
GetCurrentThreadId	0x0	0x62e970	0x22e1b8	0x2245b8	0x0
UnhandledExceptionFilter	0x0	0x62e974	0x22e1bc	0x2245bc	0x0
VirtualQuery	0x0	0x62e978	0x22e1c0	0x2245c0	0x0
GlobalFindAtomW	0x0	0x62e97c	0x22e1c4	0x2245c4	0x0
VirtualQueryEx	0x0	0x62e980	0x22e1c8	0x2245c8	0x0
GlobalFree	0x0	0x62e984	0x22e1cc	0x2245cc	0x0
Sleep	0x0	0x62e988	0x22e1d0	0x2245d0	0x0
EnterCriticalSection	0x0	0x62e98c	0x22e1d4	0x2245d4	0x0
SetFilePointer	0x0	0x62e990	0x22e1d8	0x2245d8	0x0
LoadResource	0x0	0x62e994	0x22e1dc	0x2245dc	0x0
SuspendThread	0x0	0x62e998	0x22e1e0	0x2245e0	0x0
GetTickCount	0x0	0x62e99c	0x22e1e4	0x2245e4	0x0
GetFileSize	0x0	0x62e9a0	0x22e1e8	0x2245e8	0x0
GetStartupInfoW	0x0	0x62e9a4	0x22e1ec	0x2245ec	0x0
GlobalDeleteAtom	0x0	0x62e9a8	0x22e1f0	0x2245f0	0x0
GetFileAttributesW	0x0	0x62e9ac	0x22e1f4	0x2245f4	0x0
InitializeCriticalSection	0x0	0x62e9b0	0x22e1f8	0x2245f8	0x0
GetThreadPriority	0x0	0x62e9b4	0x22e1fc	0x2245fc	0x0
GetCurrentProcess	0x0	0x62e9b8	0x22e200	0x224600	0x0
SetThreadPriority	0x0	0x62e9bc	0x22e204	0x224604	0x0
GlobalLock	0x0	0x62e9c0	0x22e208	0x224608	0x0
VirtualAlloc	0x0	0x62e9c4	0x22e20c	0x22460c	0x0
GetCommandLineW	0x0	0x62e9c8	0x22e210	0x224610	0x0
GetSystemInfo	0x0	0x62e9cc	0x22e214	0x224614	0x0
LeaveCriticalSection	0x0	0x62e9d0	0x22e218	0x224618	0x0
GetProcAddress	0x0	0x62e9d4	0x22e21c	0x22461c	0x0
ResumeThread	0x0	0x62e9d8	0x22e220	0x224620	0x0
GetVersionExW	0x0	0x62e9dc	0x22e224	0x224624	0x0
VerifyVersionInfoW	0x0	0x62e9e0	0x22e228	0x224628	0x0
HeapCreate	0x0	0x62e9e4	0x22e22c	0x22462c	0x0
GetDiskFreeSpaceW	0x0	0x62e9e8	0x22e230	0x224630	0x0
VerSetConditionMask	0x0	0x62e9ec	0x22e234	0x224634	0x0
FindFirstFileW	0x0	0x62e9f0	0x22e238	0x224638	0x0
GetUserDefaultUILanguage	0x0	0x62e9f4	0x22e23c	0x22463c	0x0
GetConsoleOutputCP	0x0	0x62e9f8	0x22e240	0x224640	0x0
GetConsoleCP	0x0	0x62e9fc	0x22e244	0x224644	0x0
lstrlenW	0x0	0x62ea00	0x22e248	0x224648	0x0
SetEndOfFile	0x0	0x62ea04	0x22e24c	0x22464c	0x0
QueryPerformanceCounter	0x0	0x62ea08	0x22e250	0x224650	0x0
HeapFree	0x0	0x62ea0c	0x22e254	0x224654	0x0
WideCharToMultiByte	0x0	0x62ea10	0x22e258	0x224658	0x0
FindClose	0x0	0x62ea14	0x22e25c	0x22465c	0x0
MultiByteToWideChar	0x0	0x62ea18	0x22e260	0x224660	0x0
LoadLibraryW	0x0	0x62ea1c	0x22e264	0x224664	0x0
SetEvent	0x0	0x62ea20	0x22e268	0x224668	0x0
GetLocaleInfoW	0x0	0x62ea24	0x22e26c	0x22466c	0x0
CreateFileW	0x0	0x62ea28	0x22e270	0x224670	0x0
EnumResourceNamesW	0x0	0x62ea2c	0x22e274	0x224674	0x0
DeleteFileW	0x0	0x62ea30	0x22e278	0x224678	0x0
IsDBCSLeadByteEx	0x0	0x62ea34	0x22e27c	0x22467c	0x0
GetEnvironmentVariableW	0x0	0x62ea38	0x22e280	0x224680	0x0
GetLocalTime	0x0	0x62ea3c	0x22e284	0x224684	0x0
WaitForSingleObject	0x0	0x62ea40	0x22e288	0x224688	0x0
WriteFile	0x0	0x62ea44	0x22e28c	0x22468c	0x0
ExitThread	0x0	0x62ea48	0x22e290	0x224690	0x0
DeleteCriticalSection	0x0	0x62ea4c	0x22e294	0x224694	0x0
GetDateFormatW	0x0	0x62ea50	0x22e298	0x224698	0x0
TlsGetValue	0x0	0x62ea54	0x22e29c	0x22469c	0x0
SetErrorMode	0x0	0x62ea58	0x22e2a0	0x2246a0	0x0
IsValidLocale	0x0	0x62ea5c	0x22e2a4	0x2246a4	0x0
TlsSetValue	0x0	0x62ea60	0x22e2a8	0x2246a8	0x0
GetSystemDefaultUILanguage	0x0	0x62ea64	0x22e2ac	0x2246ac	0x0
EnumCalendarInfoW	0x0	0x62ea68	0x22e2b0	0x2246b0	0x0
LocalAlloc	0x0	0x62ea6c	0x22e2b4	0x2246b4	0x0
RemoveDirectoryW	0x0	0x62ea70	0x22e2b8	0x2246b8	0x0
CreateEventW	0x0	0x62ea74	0x22e2bc	0x2246bc	0x0
WaitForMultipleObjectsEx	0x0	0x62ea78	0x22e2c0	0x2246c0	0x0
SetThreadLocale	0x0	0x62ea7c	0x22e2c4	0x2246c4	0x0
GetThreadLocale	0x0	0x62ea80	0x22e2c8	0x2246c8	0x0

winspool.drv (5)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
DocumentPropertiesW	0x0	0x62ea88	0x22e2d0	0x2246d0	0x0
ClosePrinter	0x0	0x62ea8c	0x22e2d4	0x2246d4	0x0
OpenPrinterW	0x0	0x62ea90	0x22e2d8	0x2246d8	0x0
GetDefaultPrinterW	0x0	0x62ea94	0x22e2dc	0x2246dc	0x0
EnumPrintersW	0x0	0x62ea98	0x22e2e0	0x2246e0	0x0

comctl32.dll (35)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ImageList_GetImageInfo	0x0	0x62eaa0	0x22e2e8	0x2246e8	0x0
FlatSB_SetScrollInfo	0x0	0x62eaa4	0x22e2ec	0x2246ec	0x0
ImageList_DragMove	0x0	0x62eaa8	0x22e2f0	0x2246f0	0x0
ImageList_Destroy	0x0	0x62eaac	0x22e2f4	0x2246f4	0x0
_TrackMouseEvent	0x0	0x62eab0	0x22e2f8	0x2246f8	0x0
ImageList_DragShowNolock	0x0	0x62eab4	0x22e2fc	0x2246fc	0x0
ImageList_Add	0x0	0x62eab8	0x22e300	0x224700	0x0
FlatSB_SetScrollProp	0x0	0x62eabc	0x22e304	0x224704	0x0
ImageList_GetDragImage	0x0	0x62eac0	0x22e308	0x224708	0x0
ImageList_Create	0x0	0x62eac4	0x22e30c	0x22470c	0x0
ImageList_EndDrag	0x0	0x62eac8	0x22e310	0x224710	0x0
ImageList_DrawEx	0x0	0x62eacc	0x22e314	0x224714	0x0
ImageList_SetImageCount	0x0	0x62ead0	0x22e318	0x224718	0x0
FlatSB_GetScrollPos	0x0	0x62ead4	0x22e31c	0x22471c	0x0
FlatSB_SetScrollPos	0x0	0x62ead8	0x22e320	0x224720	0x0
InitializeFlatSB	0x0	0x62eadc	0x22e324	0x224724	0x0
ImageList_Copy	0x0	0x62eae0	0x22e328	0x224728	0x0
FlatSB_GetScrollInfo	0x0	0x62eae4	0x22e32c	0x22472c	0x0
ImageList_Write	0x0	0x62eae8	0x22e330	0x224730	0x0
ImageList_SetBkColor	0x0	0x62eaec	0x22e334	0x224734	0x0
ImageList_GetBkColor	0x0	0x62eaf0	0x22e338	0x224738	0x0
ImageList_BeginDrag	0x0	0x62eaf4	0x22e33c	0x22473c	0x0
ImageList_GetIcon	0x0	0x62eaf8	0x22e340	0x224740	0x0
ImageList_Replace	0x0	0x62eafc	0x22e344	0x224744	0x0
ImageList_GetImageCount	0x0	0x62eb00	0x22e348	0x224748	0x0
ImageList_DragEnter	0x0	0x62eb04	0x22e34c	0x22474c	0x0
ImageList_GetIconSize	0x0	0x62eb08	0x22e350	0x224750	0x0
ImageList_SetIconSize	0x0	0x62eb0c	0x22e354	0x224754	0x0
ImageList_Read	0x0	0x62eb10	0x22e358	0x224758	0x0
ImageList_DragLeave	0x0	0x62eb14	0x22e35c	0x22475c	0x0
ImageList_LoadImageW	0x0	0x62eb18	0x22e360	0x224760	0x0
ImageList_Draw	0x0	0x62eb1c	0x22e364	0x224764	0x0
ImageList_Remove	0x0	0x62eb20	0x22e368	0x224768	0x0
ImageList_ReplaceIcon	0x0	0x62eb24	0x22e36c	0x22476c	0x0
ImageList_SetOverlayImage	0x0	0x62eb28	0x22e370	0x224770	0x0

shell32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
Shell_NotifyIconW	0x0	0x62eb30	0x22e378	0x224778	0x0
SHGetSpecialFolderPathW	0x0	0x62eb34	0x22e37c	0x22477c	0x0
ShellExecuteW	0x0	0x62eb38	0x22e380	0x224780	0x0

ole32.dll (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
IsEqualGUID	0x0	0x62eb40	0x22e388	0x224788	0x0
OleInitialize	0x0	0x62eb44	0x22e38c	0x22478c	0x0
OleUninitialize	0x0	0x62eb48	0x22e390	0x224790	0x0
CoInitialize	0x0	0x62eb4c	0x22e394	0x224794	0x0
CoCreateInstance	0x0	0x62eb50	0x22e398	0x224798	0x0
CoUninitialize	0x0	0x62eb54	0x22e39c	0x22479c	0x0
CoTaskMemFree	0x0	0x62eb58	0x22e3a0	0x2247a0	0x0
CoTaskMemAlloc	0x0	0x62eb5c	0x22e3a4	0x2247a4	0x0

version.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetFileVersionInfoSizeW	0x0	0x62eb64	0x22e3ac	0x2247ac	0x0
VerQueryValueW	0x0	0x62eb68	0x22e3b0	0x2247b0	0x0
GetFileVersionInfoW	0x0	0x62eb6c	0x22e3b4	0x2247b4	0x0

user32.dll (183)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CopyImage	0x0	0x62eb74	0x22e3bc	0x2247bc	0x0
CreateWindowExW	0x0	0x62eb78	0x22e3c0	0x2247c0	0x0
GetMenuItemInfoW	0x0	0x62eb7c	0x22e3c4	0x2247c4	0x0
SetMenuItemInfoW	0x0	0x62eb80	0x22e3c8	0x2247c8	0x0
DefFrameProcW	0x0	0x62eb84	0x22e3cc	0x2247cc	0x0
GetDCEx	0x0	0x62eb88	0x22e3d0	0x2247d0	0x0
PeekMessageW	0x0	0x62eb8c	0x22e3d4	0x2247d4	0x0
MonitorFromWindow	0x0	0x62eb90	0x22e3d8	0x2247d8	0x0
GetDlgCtrlID	0x0	0x62eb94	0x22e3dc	0x2247dc	0x0
SetTimer	0x0	0x62eb98	0x22e3e0	0x2247e0	0x0
WindowFromPoint	0x0	0x62eb9c	0x22e3e4	0x2247e4	0x0
BeginPaint	0x0	0x62eba0	0x22e3e8	0x2247e8	0x0
RegisterClipboardFormatW	0x0	0x62eba4	0x22e3ec	0x2247ec	0x0
FrameRect	0x0	0x62eba8	0x22e3f0	0x2247f0	0x0
MapVirtualKeyW	0x0	0x62ebac	0x22e3f4	0x2247f4	0x0
IsWindowUnicode	0x0	0x62ebb0	0x22e3f8	0x2247f8	0x0
RegisterWindowMessageW	0x0	0x62ebb4	0x22e3fc	0x2247fc	0x0
FillRect	0x0	0x62ebb8	0x22e400	0x224800	0x0
GetMenuStringW	0x0	0x62ebbc	0x22e404	0x224804	0x0
DispatchMessageW	0x0	0x62ebc0	0x22e408	0x224808	0x0
CreateAcceleratorTableW	0x0	0x62ebc4	0x22e40c	0x22480c	0x0
SendMessageA	0x0	0x62ebc8	0x22e410	0x224810	0x0
DefMDIChildProcW	0x0	0x62ebcc	0x22e414	0x224814	0x0
EnumWindows	0x0	0x62ebd0	0x22e418	0x224818	0x0
GetClassInfoW	0x0	0x62ebd4	0x22e41c	0x22481c	0x0
ShowOwnedPopups	0x0	0x62ebd8	0x22e420	0x224820	0x0
GetSystemMenu	0x0	0x62ebdc	0x22e424	0x224824	0x0
GetScrollRange	0x0	0x62ebe0	0x22e428	0x224828	0x0
SetScrollPos	0x0	0x62ebe4	0x22e42c	0x22482c	0x0
GetScrollPos	0x0	0x62ebe8	0x22e430	0x224830	0x0
GetActiveWindow	0x0	0x62ebec	0x22e434	0x224834	0x0
SetActiveWindow	0x0	0x62ebf0	0x22e438	0x224838	0x0
DrawEdge	0x0	0x62ebf4	0x22e43c	0x22483c	0x0
GetKeyboardLayoutList	0x0	0x62ebf8	0x22e440	0x224840	0x0
LoadBitmapW	0x0	0x62ebfc	0x22e444	0x224844	0x0
DrawFocusRect	0x0	0x62ec00	0x22e448	0x224848	0x0
EnumChildWindows	0x0	0x62ec04	0x22e44c	0x22484c	0x0
ReleaseCapture	0x0	0x62ec08	0x22e450	0x224850	0x0
UnhookWindowsHookEx	0x0	0x62ec0c	0x22e454	0x224854	0x0
LoadCursorW	0x0	0x62ec10	0x22e458	0x224858	0x0
GetCapture	0x0	0x62ec14	0x22e45c	0x22485c	0x0
SetCapture	0x0	0x62ec18	0x22e460	0x224860	0x0
CreatePopupMenu	0x0	0x62ec1c	0x22e464	0x224864	0x0
ScrollWindow	0x0	0x62ec20	0x22e468	0x224868	0x0
ShowCaret	0x0	0x62ec24	0x22e46c	0x22486c	0x0
GetMenuItemID	0x0	0x62ec28	0x22e470	0x224870	0x0
GetLastActivePopup	0x0	0x62ec2c	0x22e474	0x224874	0x0
CharLowerBuffW	0x0	0x62ec30	0x22e478	0x224878	0x0
GetSystemMetrics	0x0	0x62ec34	0x22e47c	0x22487c	0x0
SetWindowLongW	0x0	0x62ec38	0x22e480	0x224880	0x0
PostMessageW	0x0	0x62ec3c	0x22e484	0x224884	0x0
DrawMenuBar	0x0	0x62ec40	0x22e488	0x224888	0x0
SetParent	0x0	0x62ec44	0x22e48c	0x22488c	0x0
IsZoomed	0x0	0x62ec48	0x22e490	0x224890	0x0
CharUpperBuffW	0x0	0x62ec4c	0x22e494	0x224894	0x0
GetClientRect	0x0	0x62ec50	0x22e498	0x224898	0x0
IsChild	0x0	0x62ec54	0x22e49c	0x22489c	0x0
ClientToScreen	0x0	0x62ec58	0x22e4a0	0x2248a0	0x0
GetClipboardData	0x0	0x62ec5c	0x22e4a4	0x2248a4	0x0
SetClipboardData	0x0	0x62ec60	0x22e4a8	0x2248a8	0x0
SetWindowPlacement	0x0	0x62ec64	0x22e4ac	0x2248ac	0x0
IsIconic	0x0	0x62ec68	0x22e4b0	0x2248b0	0x0
CallNextHookEx	0x0	0x62ec6c	0x22e4b4	0x2248b4	0x0
GetMonitorInfoW	0x0	0x62ec70	0x22e4b8	0x2248b8	0x0
ShowWindow	0x0	0x62ec74	0x22e4bc	0x2248bc	0x0
CheckMenuItem	0x0	0x62ec78	0x22e4c0	0x2248c0	0x0
CharUpperW	0x0	0x62ec7c	0x22e4c4	0x2248c4	0x0
DefWindowProcW	0x0	0x62ec80	0x22e4c8	0x2248c8	0x0
GetForegroundWindow	0x0	0x62ec84	0x22e4cc	0x2248cc	0x0
SetForegroundWindow	0x0	0x62ec88	0x22e4d0	0x2248d0	0x0
GetWindowTextW	0x0	0x62ec8c	0x22e4d4	0x2248d4	0x0
EnableWindow	0x0	0x62ec90	0x22e4d8	0x2248d8	0x0
DestroyWindow	0x0	0x62ec94	0x22e4dc	0x2248dc	0x0
IsDialogMessageW	0x0	0x62ec98	0x22e4e0	0x2248e0	0x0
EndMenu	0x0	0x62ec9c	0x22e4e4	0x2248e4	0x0
RegisterClassW	0x0	0x62eca0	0x22e4e8	0x2248e8	0x0
CharNextW	0x0	0x62eca4	0x22e4ec	0x2248ec	0x0
GetWindowThreadProcessId	0x0	0x62eca8	0x22e4f0	0x2248f0	0x0
RedrawWindow	0x0	0x62ecac	0x22e4f4	0x2248f4	0x0
GetDC	0x0	0x62ecb0	0x22e4f8	0x2248f8	0x0
GetFocus	0x0	0x62ecb4	0x22e4fc	0x2248fc	0x0
SetFocus	0x0	0x62ecb8	0x22e500	0x224900	0x0
EndPaint	0x0	0x62ecbc	0x22e504	0x224904	0x0
ReleaseDC	0x0	0x62ecc0	0x22e508	0x224908	0x0
MsgWaitForMultipleObjectsEx	0x0	0x62ecc4	0x22e50c	0x22490c	0x0
LoadKeyboardLayoutW	0x0	0x62ecc8	0x22e510	0x224910	0x0
GetClassLongW	0x0	0x62eccc	0x22e514	0x224914	0x0
ActivateKeyboardLayout	0x0	0x62ecd0	0x22e518	0x224918	0x0
GetParent	0x0	0x62ecd4	0x22e51c	0x22491c	0x0
DrawTextW	0x0	0x62ecd8	0x22e520	0x224920	0x0
SetScrollRange	0x0	0x62ecdc	0x22e524	0x224924	0x0
MonitorFromRect	0x0	0x62ece0	0x22e528	0x224928	0x0
InsertMenuItemW	0x0	0x62ece4	0x22e52c	0x22492c	0x0
PeekMessageA	0x0	0x62ece8	0x22e530	0x224930	0x0
GetPropW	0x0	0x62ecec	0x22e534	0x224934	0x0
SetClassLongW	0x0	0x62ecf0	0x22e538	0x224938	0x0
MessageBoxW	0x0	0x62ecf4	0x22e53c	0x22493c	0x0
MessageBeep	0x0	0x62ecf8	0x22e540	0x224940	0x0
SetPropW	0x0	0x62ecfc	0x22e544	0x224944	0x0
RemovePropW	0x0	0x62ed00	0x22e548	0x224948	0x0
UpdateWindow	0x0	0x62ed04	0x22e54c	0x22494c	0x0
GetSubMenu	0x0	0x62ed08	0x22e550	0x224950	0x0
MsgWaitForMultipleObjects	0x0	0x62ed0c	0x22e554	0x224954	0x0
DestroyMenu	0x0	0x62ed10	0x22e558	0x224958	0x0
DestroyIcon	0x0	0x62ed14	0x22e55c	0x22495c	0x0
SetWindowsHookExW	0x0	0x62ed18	0x22e560	0x224960	0x0
EmptyClipboard	0x0	0x62ed1c	0x22e564	0x224964	0x0
IsWindowVisible	0x0	0x62ed20	0x22e568	0x224968	0x0
DispatchMessageA	0x0	0x62ed24	0x22e56c	0x22496c	0x0
UnregisterClassW	0x0	0x62ed28	0x22e570	0x224970	0x0
GetTopWindow	0x0	0x62ed2c	0x22e574	0x224974	0x0
SendMessageW	0x0	0x62ed30	0x22e578	0x224978	0x0
AdjustWindowRectEx	0x0	0x62ed34	0x22e57c	0x22497c	0x0
DrawIcon	0x0	0x62ed38	0x22e580	0x224980	0x0
IsWindow	0x0	0x62ed3c	0x22e584	0x224984	0x0
EnumThreadWindows	0x0	0x62ed40	0x22e588	0x224988	0x0
InvalidateRect	0x0	0x62ed44	0x22e58c	0x22498c	0x0
GetKeyboardState	0x0	0x62ed48	0x22e590	0x224990	0x0
DrawFrameControl	0x0	0x62ed4c	0x22e594	0x224994	0x0
ScreenToClient	0x0	0x62ed50	0x22e598	0x224998	0x0
SetCursor	0x0	0x62ed54	0x22e59c	0x22499c	0x0
CreateIcon	0x0	0x62ed58	0x22e5a0	0x2249a0	0x0
CreateMenu	0x0	0x62ed5c	0x22e5a4	0x2249a4	0x0
LoadStringW	0x0	0x62ed60	0x22e5a8	0x2249a8	0x0
CharLowerW	0x0	0x62ed64	0x22e5ac	0x2249ac	0x0
SetWindowRgn	0x0	0x62ed68	0x22e5b0	0x2249b0	0x0
SetWindowPos	0x0	0x62ed6c	0x22e5b4	0x2249b4	0x0
GetMenuItemCount	0x0	0x62ed70	0x22e5b8	0x2249b8	0x0
RemoveMenu	0x0	0x62ed74	0x22e5bc	0x2249bc	0x0
GetSysColorBrush	0x0	0x62ed78	0x22e5c0	0x2249c0	0x0
GetKeyboardLayoutNameW	0x0	0x62ed7c	0x22e5c4	0x2249c4	0x0
GetWindowDC	0x0	0x62ed80	0x22e5c8	0x2249c8	0x0
TranslateMessage	0x0	0x62ed84	0x22e5cc	0x2249cc	0x0
OpenClipboard	0x0	0x62ed88	0x22e5d0	0x2249d0	0x0
DrawTextExW	0x0	0x62ed8c	0x22e5d4	0x2249d4	0x0
MapWindowPoints	0x0	0x62ed90	0x22e5d8	0x2249d8	0x0
EnumDisplayMonitors	0x0	0x62ed94	0x22e5dc	0x2249dc	0x0
CallWindowProcW	0x0	0x62ed98	0x22e5e0	0x2249e0	0x0
CloseClipboard	0x0	0x62ed9c	0x22e5e4	0x2249e4	0x0
DestroyCursor	0x0	0x62eda0	0x22e5e8	0x2249e8	0x0
GetScrollInfo	0x0	0x62eda4	0x22e5ec	0x2249ec	0x0
SetWindowTextW	0x0	0x62eda8	0x22e5f0	0x2249f0	0x0
GetMessageExtraInfo	0x0	0x62edac	0x22e5f4	0x2249f4	0x0
EnableScrollBar	0x0	0x62edb0	0x22e5f8	0x2249f8	0x0
GetSysColor	0x0	0x62edb4	0x22e5fc	0x2249fc	0x0
TrackPopupMenu	0x0	0x62edb8	0x22e600	0x224a00	0x0
CopyIcon	0x0	0x62edbc	0x22e604	0x224a04	0x0
DrawIconEx	0x0	0x62edc0	0x22e608	0x224a08	0x0
PostQuitMessage	0x0	0x62edc4	0x22e60c	0x224a0c	0x0
GetClassNameW	0x0	0x62edc8	0x22e610	0x224a10	0x0
ShowScrollBar	0x0	0x62edcc	0x22e614	0x224a14	0x0
EnableMenuItem	0x0	0x62edd0	0x22e618	0x224a18	0x0
GetIconInfo	0x0	0x62edd4	0x22e61c	0x224a1c	0x0
GetMessagePos	0x0	0x62edd8	0x22e620	0x224a20	0x0
SetScrollInfo	0x0	0x62eddc	0x22e624	0x224a24	0x0
GetKeyNameTextW	0x0	0x62ede0	0x22e628	0x224a28	0x0
GetDesktopWindow	0x0	0x62ede4	0x22e62c	0x224a2c	0x0
GetCursorPos	0x0	0x62ede8	0x22e630	0x224a30	0x0
SetCursorPos	0x0	0x62edec	0x22e634	0x224a34	0x0
HideCaret	0x0	0x62edf0	0x22e638	0x224a38	0x0
GetMenu	0x0	0x62edf4	0x22e63c	0x224a3c	0x0
GetMenuState	0x0	0x62edf8	0x22e640	0x224a40	0x0
SetMenu	0x0	0x62edfc	0x22e644	0x224a44	0x0
SetRect	0x0	0x62ee00	0x22e648	0x224a48	0x0
GetKeyState	0x0	0x62ee04	0x22e64c	0x224a4c	0x0
FindWindowExW	0x0	0x62ee08	0x22e650	0x224a50	0x0
MonitorFromPoint	0x0	0x62ee0c	0x22e654	0x224a54	0x0
SystemParametersInfoW	0x0	0x62ee10	0x22e658	0x224a58	0x0
LoadIconW	0x0	0x62ee14	0x22e65c	0x224a5c	0x0
GetCursor	0x0	0x62ee18	0x22e660	0x224a60	0x0
GetWindow	0x0	0x62ee1c	0x22e664	0x224a64	0x0
GetWindowLongW	0x0	0x62ee20	0x22e668	0x224a68	0x0
GetWindowRect	0x0	0x62ee24	0x22e66c	0x224a6c	0x0
InsertMenuW	0x0	0x62ee28	0x22e670	0x224a70	0x0
KillTimer	0x0	0x62ee2c	0x22e674	0x224a74	0x0
WaitMessage	0x0	0x62ee30	0x22e678	0x224a78	0x0
IsWindowEnabled	0x0	0x62ee34	0x22e67c	0x224a7c	0x0
IsDialogMessageA	0x0	0x62ee38	0x22e680	0x224a80	0x0
TranslateMDISysAccel	0x0	0x62ee3c	0x22e684	0x224a84	0x0
GetWindowPlacement	0x0	0x62ee40	0x22e688	0x224a88	0x0
FindWindowW	0x0	0x62ee44	0x22e68c	0x224a8c	0x0
DeleteMenu	0x0	0x62ee48	0x22e690	0x224a90	0x0
GetKeyboardLayout	0x0	0x62ee4c	0x22e694	0x224a94	0x0

oleaut32.dll (12)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SysFreeString	0x0	0x62ee54	0x22e69c	0x224a9c	0x0
VariantClear	0x0	0x62ee58	0x22e6a0	0x224aa0	0x0
VariantInit	0x0	0x62ee5c	0x22e6a4	0x224aa4	0x0
GetErrorInfo	0x0	0x62ee60	0x22e6a8	0x224aa8	0x0
SysReAllocStringLen	0x0	0x62ee64	0x22e6ac	0x224aac	0x0
SafeArrayCreate	0x0	0x62ee68	0x22e6b0	0x224ab0	0x0
SysAllocStringLen	0x0	0x62ee6c	0x22e6b4	0x224ab4	0x0
SafeArrayPtrOfIndex	0x0	0x62ee70	0x22e6b8	0x224ab8	0x0
SafeArrayGetUBound	0x0	0x62ee74	0x22e6bc	0x224abc	0x0
SafeArrayGetLBound	0x0	0x62ee78	0x22e6c0	0x224ac0	0x0
VariantCopy	0x0	0x62ee7c	0x22e6c4	0x224ac4	0x0
VariantChangeType	0x0	0x62ee80	0x22e6c8	0x224ac8	0x0

netapi32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
NetWkstaGetInfo	0x0	0x62ee88	0x22e6d0	0x224ad0	0x0
NetApiBufferFree	0x0	0x62ee8c	0x22e6d4	0x224ad4	0x0

advapi32.dll (17)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegSetValueExW	0x0	0x62ee94	0x22e6dc	0x224adc	0x0
RegConnectRegistryW	0x0	0x62ee98	0x22e6e0	0x224ae0	0x0
RegEnumKeyExW	0x0	0x62ee9c	0x22e6e4	0x224ae4	0x0
RegLoadKeyW	0x0	0x62eea0	0x22e6e8	0x224ae8	0x0
RegDeleteKeyW	0x0	0x62eea4	0x22e6ec	0x224aec	0x0
RegOpenKeyExW	0x0	0x62eea8	0x22e6f0	0x224af0	0x0
RegQueryInfoKeyW	0x0	0x62eeac	0x22e6f4	0x224af4	0x0
RegUnLoadKeyW	0x0	0x62eeb0	0x22e6f8	0x224af8	0x0
RegSaveKeyW	0x0	0x62eeb4	0x22e6fc	0x224afc	0x0
RegDeleteValueW	0x0	0x62eeb8	0x22e700	0x224b00	0x0
RegReplaceKeyW	0x0	0x62eebc	0x22e704	0x224b04	0x0
RegFlushKey	0x0	0x62eec0	0x22e708	0x224b08	0x0
RegQueryValueExW	0x0	0x62eec4	0x22e70c	0x224b0c	0x0
RegEnumValueW	0x0	0x62eec8	0x22e710	0x224b10	0x0
RegCloseKey	0x0	0x62eecc	0x22e714	0x224b14	0x0
RegCreateKeyExW	0x0	0x62eed0	0x22e718	0x224b18	0x0
RegRestoreKeyW	0x0	0x62eed4	0x22e71c	0x224b1c	0x0

gdi32.dll (96)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
Pie	0x0	0x62eedc	0x22e724	0x224b24	0x0
SetBkMode	0x0	0x62eee0	0x22e728	0x224b28	0x0
CreateCompatibleBitmap	0x0	0x62eee4	0x22e72c	0x224b2c	0x0
GetEnhMetaFileHeader	0x0	0x62eee8	0x22e730	0x224b30	0x0
RectVisible	0x0	0x62eeec	0x22e734	0x224b34	0x0
AngleArc	0x0	0x62eef0	0x22e738	0x224b38	0x0
SetAbortProc	0x0	0x62eef4	0x22e73c	0x224b3c	0x0
SetTextColor	0x0	0x62eef8	0x22e740	0x224b40	0x0
StretchBlt	0x0	0x62eefc	0x22e744	0x224b44	0x0
RoundRect	0x0	0x62ef00	0x22e748	0x224b48	0x0
RestoreDC	0x0	0x62ef04	0x22e74c	0x224b4c	0x0
SetRectRgn	0x0	0x62ef08	0x22e750	0x224b50	0x0
GetTextMetricsW	0x0	0x62ef0c	0x22e754	0x224b54	0x0
GetWindowOrgEx	0x0	0x62ef10	0x22e758	0x224b58	0x0
CreatePalette	0x0	0x62ef14	0x22e75c	0x224b5c	0x0
PolyBezierTo	0x0	0x62ef18	0x22e760	0x224b60	0x0
CreateICW	0x0	0x62ef1c	0x22e764	0x224b64	0x0
CreateDCW	0x0	0x62ef20	0x22e768	0x224b68	0x0
GetStockObject	0x0	0x62ef24	0x22e76c	0x224b6c	0x0
CreateSolidBrush	0x0	0x62ef28	0x22e770	0x224b70	0x0
Polygon	0x0	0x62ef2c	0x22e774	0x224b74	0x0
MoveToEx	0x0	0x62ef30	0x22e778	0x224b78	0x0
PlayEnhMetaFile	0x0	0x62ef34	0x22e77c	0x224b7c	0x0
Ellipse	0x0	0x62ef38	0x22e780	0x224b80	0x0
StartPage	0x0	0x62ef3c	0x22e784	0x224b84	0x0
GetBitmapBits	0x0	0x62ef40	0x22e788	0x224b88	0x0
StartDocW	0x0	0x62ef44	0x22e78c	0x224b8c	0x0
GetSystemPaletteEntries	0x0	0x62ef48	0x22e790	0x224b90	0x0
GetEnhMetaFileBits	0x0	0x62ef4c	0x22e794	0x224b94	0x0
AbortDoc	0x0	0x62ef50	0x22e798	0x224b98	0x0
GetEnhMetaFilePaletteEntries	0x0	0x62ef54	0x22e79c	0x224b9c	0x0
CreatePenIndirect	0x0	0x62ef58	0x22e7a0	0x224ba0	0x0
CreateFontIndirectW	0x0	0x62ef5c	0x22e7a4	0x224ba4	0x0
PolyBezier	0x0	0x62ef60	0x22e7a8	0x224ba8	0x0
EndDoc	0x0	0x62ef64	0x22e7ac	0x224bac	0x0
GetObjectW	0x0	0x62ef68	0x22e7b0	0x224bb0	0x0
GetWinMetaFileBits	0x0	0x62ef6c	0x22e7b4	0x224bb4	0x0
SetROP2	0x0	0x62ef70	0x22e7b8	0x224bb8	0x0
GetEnhMetaFileDescriptionW	0x0	0x62ef74	0x22e7bc	0x224bbc	0x0
ArcTo	0x0	0x62ef78	0x22e7c0	0x224bc0	0x0
Arc	0x0	0x62ef7c	0x22e7c4	0x224bc4	0x0
SelectPalette	0x0	0x62ef80	0x22e7c8	0x224bc8	0x0
ExcludeClipRect	0x0	0x62ef84	0x22e7cc	0x224bcc	0x0
MaskBlt	0x0	0x62ef88	0x22e7d0	0x224bd0	0x0
SetWindowOrgEx	0x0	0x62ef8c	0x22e7d4	0x224bd4	0x0
EndPage	0x0	0x62ef90	0x22e7d8	0x224bd8	0x0
DeleteEnhMetaFile	0x0	0x62ef94	0x22e7dc	0x224bdc	0x0
Chord	0x0	0x62ef98	0x22e7e0	0x224be0	0x0
SetDIBits	0x0	0x62ef9c	0x22e7e4	0x224be4	0x0
SetViewportOrgEx	0x0	0x62efa0	0x22e7e8	0x224be8	0x0
CreateRectRgn	0x0	0x62efa4	0x22e7ec	0x224bec	0x0
RealizePalette	0x0	0x62efa8	0x22e7f0	0x224bf0	0x0
SetDIBColorTable	0x0	0x62efac	0x22e7f4	0x224bf4	0x0
GetDIBColorTable	0x0	0x62efb0	0x22e7f8	0x224bf8	0x0
CreateBrushIndirect	0x0	0x62efb4	0x22e7fc	0x224bfc	0x0
PatBlt	0x0	0x62efb8	0x22e800	0x224c00	0x0
SetEnhMetaFileBits	0x0	0x62efbc	0x22e804	0x224c04	0x0
Rectangle	0x0	0x62efc0	0x22e808	0x224c08	0x0
SaveDC	0x0	0x62efc4	0x22e80c	0x224c0c	0x0
DeleteDC	0x0	0x62efc8	0x22e810	0x224c10	0x0
FrameRgn	0x0	0x62efcc	0x22e814	0x224c14	0x0
BitBlt	0x0	0x62efd0	0x22e818	0x224c18	0x0
GetDeviceCaps	0x0	0x62efd4	0x22e81c	0x224c1c	0x0
GetTextExtentPoint32W	0x0	0x62efd8	0x22e820	0x224c20	0x0
GetClipBox	0x0	0x62efdc	0x22e824	0x224c24	0x0
IntersectClipRect	0x0	0x62efe0	0x22e828	0x224c28	0x0
Polyline	0x0	0x62efe4	0x22e82c	0x224c2c	0x0
CreateBitmap	0x0	0x62efe8	0x22e830	0x224c30	0x0
SetWinMetaFileBits	0x0	0x62efec	0x22e834	0x224c34	0x0
GetStretchBltMode	0x0	0x62eff0	0x22e838	0x224c38	0x0
CreateDIBitmap	0x0	0x62eff4	0x22e83c	0x224c3c	0x0
SetStretchBltMode	0x0	0x62eff8	0x22e840	0x224c40	0x0
GetDIBits	0x0	0x62effc	0x22e844	0x224c44	0x0
CreateDIBSection	0x0	0x62f000	0x22e848	0x224c48	0x0
LineTo	0x0	0x62f004	0x22e84c	0x224c4c	0x0
GetRgnBox	0x0	0x62f008	0x22e850	0x224c50	0x0
EnumFontsW	0x0	0x62f00c	0x22e854	0x224c54	0x0
CreateHalftonePalette	0x0	0x62f010	0x22e858	0x224c58	0x0
SelectObject	0x0	0x62f014	0x22e85c	0x224c5c	0x0
DeleteObject	0x0	0x62f018	0x22e860	0x224c60	0x0
ExtFloodFill	0x0	0x62f01c	0x22e864	0x224c64	0x0
UnrealizeObject	0x0	0x62f020	0x22e868	0x224c68	0x0
CopyEnhMetaFileW	0x0	0x62f024	0x22e86c	0x224c6c	0x0
SetBkColor	0x0	0x62f028	0x22e870	0x224c70	0x0
CreateCompatibleDC	0x0	0x62f02c	0x22e874	0x224c74	0x0
GetBrushOrgEx	0x0	0x62f030	0x22e878	0x224c78	0x0
GetCurrentPositionEx	0x0	0x62f034	0x22e87c	0x224c7c	0x0
GetTextExtentPointW	0x0	0x62f038	0x22e880	0x224c80	0x0
ExtTextOutW	0x0	0x62f03c	0x22e884	0x224c84	0x0
SetBrushOrgEx	0x0	0x62f040	0x22e888	0x224c88	0x0
GetPixel	0x0	0x62f044	0x22e88c	0x224c8c	0x0
GdiFlush	0x0	0x62f048	0x22e890	0x224c90	0x0
SetPixel	0x0	0x62f04c	0x22e894	0x224c94	0x0
EnumFontFamiliesExW	0x0	0x62f050	0x22e898	0x224c98	0x0
StretchDIBits	0x0	0x62f054	0x22e89c	0x224c9c	0x0
GetPaletteEntries	0x0	0x62f058	0x22e8a0	0x224ca0	0x0

Exports (3)

»

Api name	EAT Address	Ordinal
TMethodImplementationIntercept	0xd7ebc	0x3
__dbk_fcall_wrapper	0x11084	0x2
dbkFCallWrapperAddr	0x22963c	0x1

Memory Dumps (4)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Points	Actions
svchost.exe	3	0x00400000	0x00670FFF	Relevant Image	-	32-bit	-	... Memory Dump Actions Download Dump Go to process Go to AV Match
buffer	3	0x00230000	0x00230FFF	First Execution	-	32-bit	0x00230FE2	... Memory Dump Actions Download Dump Go to process
buffer	3	0x00230000	0x00230FFF	Content Changed	-	32-bit	0x00230FE2	... Memory Dump Actions Download Dump Go to process
svchost.exe	3	0x00400000	0x00670FFF	Final Dump	-	32-bit	-	... Memory Dump Actions Download Dump Go to process Go to AV Match

Local AV Matches (1)

»

Threat Name	Severity
Gen:Trojan.Heur.yU0@riXijEli	Malicious

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ztarter.exe

Sample File

Binary

Blacklisted

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	2.80 MB
MD5	2b89ef183c92e9079dbbc94e1ec98882
SHA1	0c002fd5bc1f8cc160eb8ab703efed34d98a0ab6
SHA256	45e3b30b0f9c9c6448397a5023ae896f3fe9460bab7c6f63c4cc856c60ed9ecf
SSDeep	49152:j5Hu8Dz/QWPllSS932iAllZnSieTOAHy:j5Hu8vQk4dN
ImpHash	c836057dae67f1a056025c5091865bb1
Parser Error Remark	Static engine was unable to completely parse the analyzed file

File Reputation Information

»

Severity	Blacklisted
First Seen	2019-12-19 10:30 (UTC+1)
Last Seen	2019-12-19 12:19 (UTC+1)
Names	Win32.Trojan.Wacatac
Families	Wacatac
Classification	Trojan

PE Information

»

Image Base	0x400000
Entry Point	0x668d20
Size Of Code	0x267400
Size Of Initialized Data	0x64600
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-12-19 08:39:46+00:00
Packer	BobSoft Mini Delphi -> BoB / BobSoft

Version Information (5)

»

FileDescription	Ztarter
FileVersion	1.0.0.0
ProductName	Ztarter
ProductVersion	1.0.0.0
ProgramID	com.embarcadero.Ztarter

Sections (11)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x2655ec	0x265600	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.48
.itext	0x667000	0x1da8	0x1e00	0x265a00	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.14
.data	0x669000	0x8f6c	0x9000	0x267800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	6.22
.bss	0x672000	0x1a094	0x0	0x0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.idata	0x68d000	0x32aa	0x3400	0x270800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.2
.didata	0x691000	0xb5e	0xc00	0x273c00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	4.15
.edata	0x692000	0x99	0x200	0x274800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	1.89
.tls	0x693000	0x54	0x0	0x0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.rdata	0x694000	0x5d	0x200	0x274a00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	1.37
.reloc	0x695000	0x35b48	0x35c00	0x274c00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.72
.rsrc	0x6cb000	0x21600	0x21600	0x2aa800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	7.53

Imports (13)

»

winspool.drv (5)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
DocumentPropertiesW	0x0	0x68d8f8	0x28d118	0x270918	0x0
ClosePrinter	0x0	0x68d8fc	0x28d11c	0x27091c	0x0
OpenPrinterW	0x0	0x68d900	0x28d120	0x270920	0x0
GetDefaultPrinterW	0x0	0x68d904	0x28d124	0x270924	0x0
EnumPrintersW	0x0	0x68d908	0x28d128	0x270928	0x0

comctl32.dll (35)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ImageList_GetImageInfo	0x0	0x68d910	0x28d130	0x270930	0x0
FlatSB_SetScrollInfo	0x0	0x68d914	0x28d134	0x270934	0x0
ImageList_DragMove	0x0	0x68d918	0x28d138	0x270938	0x0
ImageList_Destroy	0x0	0x68d91c	0x28d13c	0x27093c	0x0
_TrackMouseEvent	0x0	0x68d920	0x28d140	0x270940	0x0
ImageList_DragShowNolock	0x0	0x68d924	0x28d144	0x270944	0x0
ImageList_Add	0x0	0x68d928	0x28d148	0x270948	0x0
FlatSB_SetScrollProp	0x0	0x68d92c	0x28d14c	0x27094c	0x0
ImageList_GetDragImage	0x0	0x68d930	0x28d150	0x270950	0x0
ImageList_Create	0x0	0x68d934	0x28d154	0x270954	0x0
ImageList_EndDrag	0x0	0x68d938	0x28d158	0x270958	0x0
ImageList_DrawEx	0x0	0x68d93c	0x28d15c	0x27095c	0x0
ImageList_SetImageCount	0x0	0x68d940	0x28d160	0x270960	0x0
FlatSB_GetScrollPos	0x0	0x68d944	0x28d164	0x270964	0x0
FlatSB_SetScrollPos	0x0	0x68d948	0x28d168	0x270968	0x0
InitializeFlatSB	0x0	0x68d94c	0x28d16c	0x27096c	0x0
ImageList_Copy	0x0	0x68d950	0x28d170	0x270970	0x0
FlatSB_GetScrollInfo	0x0	0x68d954	0x28d174	0x270974	0x0
ImageList_Write	0x0	0x68d958	0x28d178	0x270978	0x0
ImageList_SetBkColor	0x0	0x68d95c	0x28d17c	0x27097c	0x0
ImageList_GetBkColor	0x0	0x68d960	0x28d180	0x270980	0x0
ImageList_BeginDrag	0x0	0x68d964	0x28d184	0x270984	0x0
ImageList_GetIcon	0x0	0x68d968	0x28d188	0x270988	0x0
ImageList_Replace	0x0	0x68d96c	0x28d18c	0x27098c	0x0
ImageList_GetImageCount	0x0	0x68d970	0x28d190	0x270990	0x0
ImageList_DragEnter	0x0	0x68d974	0x28d194	0x270994	0x0
ImageList_GetIconSize	0x0	0x68d978	0x28d198	0x270998	0x0
ImageList_SetIconSize	0x0	0x68d97c	0x28d19c	0x27099c	0x0
ImageList_Read	0x0	0x68d980	0x28d1a0	0x2709a0	0x0
ImageList_DragLeave	0x0	0x68d984	0x28d1a4	0x2709a4	0x0
ImageList_LoadImageW	0x0	0x68d988	0x28d1a8	0x2709a8	0x0
ImageList_Draw	0x0	0x68d98c	0x28d1ac	0x2709ac	0x0
ImageList_Remove	0x0	0x68d990	0x28d1b0	0x2709b0	0x0
ImageList_ReplaceIcon	0x0	0x68d994	0x28d1b4	0x2709b4	0x0
ImageList_SetOverlayImage	0x0	0x68d998	0x28d1b8	0x2709b8	0x0

shell32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
Shell_NotifyIconW	0x0	0x68d9a0	0x28d1c0	0x2709c0	0x0
ShellExecuteW	0x0	0x68d9a4	0x28d1c4	0x2709c4	0x0

user32.dll (192)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CopyImage	0x0	0x68d9ac	0x28d1cc	0x2709cc	0x0
SetMenuItemInfoW	0x0	0x68d9b0	0x28d1d0	0x2709d0	0x0
GetMenuItemInfoW	0x0	0x68d9b4	0x28d1d4	0x2709d4	0x0
DefFrameProcW	0x0	0x68d9b8	0x28d1d8	0x2709d8	0x0
GetDlgCtrlID	0x0	0x68d9bc	0x28d1dc	0x2709dc	0x0
FrameRect	0x0	0x68d9c0	0x28d1e0	0x2709e0	0x0
RegisterWindowMessageW	0x0	0x68d9c4	0x28d1e4	0x2709e4	0x0
GetMenuStringW	0x0	0x68d9c8	0x28d1e8	0x2709e8	0x0
FillRect	0x0	0x68d9cc	0x28d1ec	0x2709ec	0x0
SendMessageA	0x0	0x68d9d0	0x28d1f0	0x2709f0	0x0
EnumWindows	0x0	0x68d9d4	0x28d1f4	0x2709f4	0x0
ShowOwnedPopups	0x0	0x68d9d8	0x28d1f8	0x2709f8	0x0
GetClassInfoExW	0x0	0x68d9dc	0x28d1fc	0x2709fc	0x0
GetClassInfoW	0x0	0x68d9e0	0x28d200	0x270a00	0x0
GetScrollRange	0x0	0x68d9e4	0x28d204	0x270a04	0x0
SetActiveWindow	0x0	0x68d9e8	0x28d208	0x270a08	0x0
GetActiveWindow	0x0	0x68d9ec	0x28d20c	0x270a0c	0x0
DrawEdge	0x0	0x68d9f0	0x28d210	0x270a10	0x0
GetKeyboardLayoutList	0x0	0x68d9f4	0x28d214	0x270a14	0x0
LoadBitmapW	0x0	0x68d9f8	0x28d218	0x270a18	0x0
EnumChildWindows	0x0	0x68d9fc	0x28d21c	0x270a1c	0x0
UnhookWindowsHookEx	0x0	0x68da00	0x28d220	0x270a20	0x0
SetCapture	0x0	0x68da04	0x28d224	0x270a24	0x0
GetCapture	0x0	0x68da08	0x28d228	0x270a28	0x0
ShowCaret	0x0	0x68da0c	0x28d22c	0x270a2c	0x0
CreatePopupMenu	0x0	0x68da10	0x28d230	0x270a30	0x0
GetMenuItemID	0x0	0x68da14	0x28d234	0x270a34	0x0
CharLowerBuffW	0x0	0x68da18	0x28d238	0x270a38	0x0
PostMessageW	0x0	0x68da1c	0x28d23c	0x270a3c	0x0
SetWindowLongW	0x0	0x68da20	0x28d240	0x270a40	0x0
IsZoomed	0x0	0x68da24	0x28d244	0x270a44	0x0
SetParent	0x0	0x68da28	0x28d248	0x270a48	0x0
DrawMenuBar	0x0	0x68da2c	0x28d24c	0x270a4c	0x0
GetClientRect	0x0	0x68da30	0x28d250	0x270a50	0x0
IsChild	0x0	0x68da34	0x28d254	0x270a54	0x0
IsIconic	0x0	0x68da38	0x28d258	0x270a58	0x0
CallNextHookEx	0x0	0x68da3c	0x28d25c	0x270a5c	0x0
ShowWindow	0x0	0x68da40	0x28d260	0x270a60	0x0
GetWindowTextW	0x0	0x68da44	0x28d264	0x270a64	0x0
SetForegroundWindow	0x0	0x68da48	0x28d268	0x270a68	0x0
IsDialogMessageW	0x0	0x68da4c	0x28d26c	0x270a6c	0x0
DestroyWindow	0x0	0x68da50	0x28d270	0x270a70	0x0
RegisterClassW	0x0	0x68da54	0x28d274	0x270a74	0x0
EndMenu	0x0	0x68da58	0x28d278	0x270a78	0x0
CharNextW	0x0	0x68da5c	0x28d27c	0x270a7c	0x0
GetFocus	0x0	0x68da60	0x28d280	0x270a80	0x0
GetDC	0x0	0x68da64	0x28d284	0x270a84	0x0
SetFocus	0x0	0x68da68	0x28d288	0x270a88	0x0
ReleaseDC	0x0	0x68da6c	0x28d28c	0x270a8c	0x0
GetClassLongW	0x0	0x68da70	0x28d290	0x270a90	0x0
SetScrollRange	0x0	0x68da74	0x28d294	0x270a94	0x0
DrawTextW	0x0	0x68da78	0x28d298	0x270a98	0x0
PeekMessageA	0x0	0x68da7c	0x28d29c	0x270a9c	0x0
MessageBeep	0x0	0x68da80	0x28d2a0	0x270aa0	0x0
SetClassLongW	0x0	0x68da84	0x28d2a4	0x270aa4	0x0
RemovePropW	0x0	0x68da88	0x28d2a8	0x270aa8	0x0
GetSubMenu	0x0	0x68da8c	0x28d2ac	0x270aac	0x0
DestroyIcon	0x0	0x68da90	0x28d2b0	0x270ab0	0x0
IsWindowVisible	0x0	0x68da94	0x28d2b4	0x270ab4	0x0
PtInRect	0x0	0x68da98	0x28d2b8	0x270ab8	0x0
DispatchMessageA	0x0	0x68da9c	0x28d2bc	0x270abc	0x0
UnregisterClassW	0x0	0x68daa0	0x28d2c0	0x270ac0	0x0
GetTopWindow	0x0	0x68daa4	0x28d2c4	0x270ac4	0x0
SendMessageW	0x0	0x68daa8	0x28d2c8	0x270ac8	0x0
GetComboBoxInfo	0x0	0x68daac	0x28d2cc	0x270acc	0x0
LoadStringW	0x0	0x68dab0	0x28d2d0	0x270ad0	0x0
CreateMenu	0x0	0x68dab4	0x28d2d4	0x270ad4	0x0
CharLowerW	0x0	0x68dab8	0x28d2d8	0x270ad8	0x0
SetWindowPos	0x0	0x68dabc	0x28d2dc	0x270adc	0x0
SetWindowRgn	0x0	0x68dac0	0x28d2e0	0x270ae0	0x0
GetMenuItemCount	0x0	0x68dac4	0x28d2e4	0x270ae4	0x0
GetSysColorBrush	0x0	0x68dac8	0x28d2e8	0x270ae8	0x0
GetWindowDC	0x0	0x68dacc	0x28d2ec	0x270aec	0x0
DrawTextExW	0x0	0x68dad0	0x28d2f0	0x270af0	0x0
GetScrollInfo	0x0	0x68dad4	0x28d2f4	0x270af4	0x0
SetWindowTextW	0x0	0x68dad8	0x28d2f8	0x270af8	0x0
GetMessageExtraInfo	0x0	0x68dadc	0x28d2fc	0x270afc	0x0
GetSysColor	0x0	0x68dae0	0x28d300	0x270b00	0x0
EnableScrollBar	0x0	0x68dae4	0x28d304	0x270b04	0x0
TrackPopupMenu	0x0	0x68dae8	0x28d308	0x270b08	0x0
DrawIconEx	0x0	0x68daec	0x28d30c	0x270b0c	0x0
GetClassNameW	0x0	0x68daf0	0x28d310	0x270b10	0x0
GetMessagePos	0x0	0x68daf4	0x28d314	0x270b14	0x0
GetIconInfo	0x0	0x68daf8	0x28d318	0x270b18	0x0
SetScrollInfo	0x0	0x68dafc	0x28d31c	0x270b1c	0x0
GetKeyNameTextW	0x0	0x68db00	0x28d320	0x270b20	0x0
GetDesktopWindow	0x0	0x68db04	0x28d324	0x270b24	0x0
SetCursorPos	0x0	0x68db08	0x28d328	0x270b28	0x0
GetCursorPos	0x0	0x68db0c	0x28d32c	0x270b2c	0x0
SetMenu	0x0	0x68db10	0x28d330	0x270b30	0x0
GetMenuState	0x0	0x68db14	0x28d334	0x270b34	0x0
GetMenu	0x0	0x68db18	0x28d338	0x270b38	0x0
SetRect	0x0	0x68db1c	0x28d33c	0x270b3c	0x0
GetKeyState	0x0	0x68db20	0x28d340	0x270b40	0x0
IsRectEmpty	0x0	0x68db24	0x28d344	0x270b44	0x0
GetCursor	0x0	0x68db28	0x28d348	0x270b48	0x0
KillTimer	0x0	0x68db2c	0x28d34c	0x270b4c	0x0
WaitMessage	0x0	0x68db30	0x28d350	0x270b50	0x0
TranslateMDISysAccel	0x0	0x68db34	0x28d354	0x270b54	0x0
GetWindowPlacement	0x0	0x68db38	0x28d358	0x270b58	0x0
GetMenuItemRect	0x0	0x68db3c	0x28d35c	0x270b5c	0x0
CreateIconIndirect	0x0	0x68db40	0x28d360	0x270b60	0x0
CreateWindowExW	0x0	0x68db44	0x28d364	0x270b64	0x0
GetDCEx	0x0	0x68db48	0x28d368	0x270b68	0x0
PeekMessageW	0x0	0x68db4c	0x28d36c	0x270b6c	0x0
MonitorFromWindow	0x0	0x68db50	0x28d370	0x270b70	0x0
SetTimer	0x0	0x68db54	0x28d374	0x270b74	0x0
WindowFromPoint	0x0	0x68db58	0x28d378	0x270b78	0x0
BeginPaint	0x0	0x68db5c	0x28d37c	0x270b7c	0x0
RegisterClipboardFormatW	0x0	0x68db60	0x28d380	0x270b80	0x0
MapVirtualKeyW	0x0	0x68db64	0x28d384	0x270b84	0x0
OffsetRect	0x0	0x68db68	0x28d388	0x270b88	0x0
IsWindowUnicode	0x0	0x68db6c	0x28d38c	0x270b8c	0x0
DispatchMessageW	0x0	0x68db70	0x28d390	0x270b90	0x0
CreateAcceleratorTableW	0x0	0x68db74	0x28d394	0x270b94	0x0
DefMDIChildProcW	0x0	0x68db78	0x28d398	0x270b98	0x0
GetSystemMenu	0x0	0x68db7c	0x28d39c	0x270b9c	0x0
SetScrollPos	0x0	0x68db80	0x28d3a0	0x270ba0	0x0
GetScrollPos	0x0	0x68db84	0x28d3a4	0x270ba4	0x0
InflateRect	0x0	0x68db88	0x28d3a8	0x270ba8	0x0
DrawFocusRect	0x0	0x68db8c	0x28d3ac	0x270bac	0x0
ReleaseCapture	0x0	0x68db90	0x28d3b0	0x270bb0	0x0
LoadCursorW	0x0	0x68db94	0x28d3b4	0x270bb4	0x0
ScrollWindow	0x0	0x68db98	0x28d3b8	0x270bb8	0x0
GetLastActivePopup	0x0	0x68db9c	0x28d3bc	0x270bbc	0x0
GetSystemMetrics	0x0	0x68dba0	0x28d3c0	0x270bc0	0x0
CharUpperBuffW	0x0	0x68dba4	0x28d3c4	0x270bc4	0x0
SetClipboardData	0x0	0x68dba8	0x28d3c8	0x270bc8	0x0
GetClipboardData	0x0	0x68dbac	0x28d3cc	0x270bcc	0x0
ClientToScreen	0x0	0x68dbb0	0x28d3d0	0x270bd0	0x0
SetWindowPlacement	0x0	0x68dbb4	0x28d3d4	0x270bd4	0x0
GetMonitorInfoW	0x0	0x68dbb8	0x28d3d8	0x270bd8	0x0
CheckMenuItem	0x0	0x68dbbc	0x28d3dc	0x270bdc	0x0
CharUpperW	0x0	0x68dbc0	0x28d3e0	0x270be0	0x0
DefWindowProcW	0x0	0x68dbc4	0x28d3e4	0x270be4	0x0
GetForegroundWindow	0x0	0x68dbc8	0x28d3e8	0x270be8	0x0
EnableWindow	0x0	0x68dbcc	0x28d3ec	0x270bec	0x0
GetWindowThreadProcessId	0x0	0x68dbd0	0x28d3f0	0x270bf0	0x0
RedrawWindow	0x0	0x68dbd4	0x28d3f4	0x270bf4	0x0
EndPaint	0x0	0x68dbd8	0x28d3f8	0x270bf8	0x0
MsgWaitForMultipleObjectsEx	0x0	0x68dbdc	0x28d3fc	0x270bfc	0x0
LoadKeyboardLayoutW	0x0	0x68dbe0	0x28d400	0x270c00	0x0
ActivateKeyboardLayout	0x0	0x68dbe4	0x28d404	0x270c04	0x0
GetParent	0x0	0x68dbe8	0x28d408	0x270c08	0x0
InsertMenuItemW	0x0	0x68dbec	0x28d40c	0x270c0c	0x0
MonitorFromRect	0x0	0x68dbf0	0x28d410	0x270c10	0x0
GetPropW	0x0	0x68dbf4	0x28d414	0x270c14	0x0
MessageBoxW	0x0	0x68dbf8	0x28d418	0x270c18	0x0
SetPropW	0x0	0x68dbfc	0x28d41c	0x270c1c	0x0
UpdateWindow	0x0	0x68dc00	0x28d420	0x270c20	0x0
MsgWaitForMultipleObjects	0x0	0x68dc04	0x28d424	0x270c24	0x0
DestroyMenu	0x0	0x68dc08	0x28d428	0x270c28	0x0
SetWindowsHookExW	0x0	0x68dc0c	0x28d42c	0x270c2c	0x0
EmptyClipboard	0x0	0x68dc10	0x28d430	0x270c30	0x0
GetDlgItem	0x0	0x68dc14	0x28d434	0x270c34	0x0
AdjustWindowRectEx	0x0	0x68dc18	0x28d438	0x270c38	0x0
IsWindow	0x0	0x68dc1c	0x28d43c	0x270c3c	0x0
DrawIcon	0x0	0x68dc20	0x28d440	0x270c40	0x0
EnumThreadWindows	0x0	0x68dc24	0x28d444	0x270c44	0x0
InvalidateRect	0x0	0x68dc28	0x28d448	0x270c48	0x0
GetKeyboardState	0x0	0x68dc2c	0x28d44c	0x270c4c	0x0
ScreenToClient	0x0	0x68dc30	0x28d450	0x270c50	0x0
DrawFrameControl	0x0	0x68dc34	0x28d454	0x270c54	0x0
SetCursor	0x0	0x68dc38	0x28d458	0x270c58	0x0
CreateIcon	0x0	0x68dc3c	0x28d45c	0x270c5c	0x0
RemoveMenu	0x0	0x68dc40	0x28d460	0x270c60	0x0
GetKeyboardLayoutNameW	0x0	0x68dc44	0x28d464	0x270c64	0x0
OpenClipboard	0x0	0x68dc48	0x28d468	0x270c68	0x0
TranslateMessage	0x0	0x68dc4c	0x28d46c	0x270c6c	0x0
MapWindowPoints	0x0	0x68dc50	0x28d470	0x270c70	0x0
EnumDisplayMonitors	0x0	0x68dc54	0x28d474	0x270c74	0x0
CallWindowProcW	0x0	0x68dc58	0x28d478	0x270c78	0x0
CloseClipboard	0x0	0x68dc5c	0x28d47c	0x270c7c	0x0
DestroyCursor	0x0	0x68dc60	0x28d480	0x270c80	0x0
CopyIcon	0x0	0x68dc64	0x28d484	0x270c84	0x0
PostQuitMessage	0x0	0x68dc68	0x28d488	0x270c88	0x0
ShowScrollBar	0x0	0x68dc6c	0x28d48c	0x270c8c	0x0
EnableMenuItem	0x0	0x68dc70	0x28d490	0x270c90	0x0
HideCaret	0x0	0x68dc74	0x28d494	0x270c94	0x0
FindWindowExW	0x0	0x68dc78	0x28d498	0x270c98	0x0
LoadIconW	0x0	0x68dc7c	0x28d49c	0x270c9c	0x0
SystemParametersInfoW	0x0	0x68dc80	0x28d4a0	0x270ca0	0x0
MonitorFromPoint	0x0	0x68dc84	0x28d4a4	0x270ca4	0x0
GetWindow	0x0	0x68dc88	0x28d4a8	0x270ca8	0x0
GetWindowRect	0x0	0x68dc8c	0x28d4ac	0x270cac	0x0
GetWindowLongW	0x0	0x68dc90	0x28d4b0	0x270cb0	0x0
InsertMenuW	0x0	0x68dc94	0x28d4b4	0x270cb4	0x0
IsWindowEnabled	0x0	0x68dc98	0x28d4b8	0x270cb8	0x0
IsDialogMessageA	0x0	0x68dc9c	0x28d4bc	0x270cbc	0x0
FindWindowW	0x0	0x68dca0	0x28d4c0	0x270cc0	0x0
GetKeyboardLayout	0x0	0x68dca4	0x28d4c4	0x270cc4	0x0
DeleteMenu	0x0	0x68dca8	0x28d4c8	0x270cc8	0x0

version.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetFileVersionInfoSizeW	0x0	0x68dcb0	0x28d4d0	0x270cd0	0x0
VerQueryValueW	0x0	0x68dcb4	0x28d4d4	0x270cd4	0x0
GetFileVersionInfoW	0x0	0x68dcb8	0x28d4d8	0x270cd8	0x0

URLMON.DLL (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
URLDownloadToFileW	0x0	0x68dcc0	0x28d4e0	0x270ce0	0x0

oleaut32.dll (12)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SysFreeString	0x0	0x68dcc8	0x28d4e8	0x270ce8	0x0
VariantClear	0x0	0x68dccc	0x28d4ec	0x270cec	0x0
VariantInit	0x0	0x68dcd0	0x28d4f0	0x270cf0	0x0
GetErrorInfo	0x0	0x68dcd4	0x28d4f4	0x270cf4	0x0
SysReAllocStringLen	0x0	0x68dcd8	0x28d4f8	0x270cf8	0x0
SafeArrayCreate	0x0	0x68dcdc	0x28d4fc	0x270cfc	0x0
SysAllocStringLen	0x0	0x68dce0	0x28d500	0x270d00	0x0
SafeArrayPtrOfIndex	0x0	0x68dce4	0x28d504	0x270d04	0x0
SafeArrayGetUBound	0x0	0x68dce8	0x28d508	0x270d08	0x0
SafeArrayGetLBound	0x0	0x68dcec	0x28d50c	0x270d0c	0x0
VariantCopy	0x0	0x68dcf0	0x28d510	0x270d10	0x0
VariantChangeType	0x0	0x68dcf4	0x28d514	0x270d14	0x0

advapi32.dll (17)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegSetValueExW	0x0	0x68dcfc	0x28d51c	0x270d1c	0x0
RegConnectRegistryW	0x0	0x68dd00	0x28d520	0x270d20	0x0
RegEnumKeyExW	0x0	0x68dd04	0x28d524	0x270d24	0x0
RegLoadKeyW	0x0	0x68dd08	0x28d528	0x270d28	0x0
RegDeleteKeyW	0x0	0x68dd0c	0x28d52c	0x270d2c	0x0
RegOpenKeyExW	0x0	0x68dd10	0x28d530	0x270d30	0x0
RegQueryInfoKeyW	0x0	0x68dd14	0x28d534	0x270d34	0x0
RegUnLoadKeyW	0x0	0x68dd18	0x28d538	0x270d38	0x0
RegSaveKeyW	0x0	0x68dd1c	0x28d53c	0x270d3c	0x0
RegDeleteValueW	0x0	0x68dd20	0x28d540	0x270d40	0x0
RegReplaceKeyW	0x0	0x68dd24	0x28d544	0x270d44	0x0
RegFlushKey	0x0	0x68dd28	0x28d548	0x270d48	0x0
RegQueryValueExW	0x0	0x68dd2c	0x28d54c	0x270d4c	0x0
RegEnumValueW	0x0	0x68dd30	0x28d550	0x270d50	0x0
RegCloseKey	0x0	0x68dd34	0x28d554	0x270d54	0x0
RegCreateKeyExW	0x0	0x68dd38	0x28d558	0x270d58	0x0
RegRestoreKeyW	0x0	0x68dd3c	0x28d55c	0x270d5c	0x0

netapi32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
NetWkstaGetInfo	0x0	0x68dd44	0x28d564	0x270d64	0x0
NetApiBufferFree	0x0	0x68dd48	0x28d568	0x270d68	0x0

msvcrt.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
memcpy	0x0	0x68dd50	0x28d570	0x270d70	0x0
memset	0x0	0x68dd54	0x28d574	0x270d74	0x0

kernel32.dll (107)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetACP	0x0	0x68dd5c	0x28d57c	0x270d7c	0x0
LocalFree	0x0	0x68dd60	0x28d580	0x270d80	0x0
CloseHandle	0x0	0x68dd64	0x28d584	0x270d84	0x0
SizeofResource	0x0	0x68dd68	0x28d588	0x270d88	0x0
GetCurrentProcessId	0x0	0x68dd6c	0x28d58c	0x270d8c	0x0
VirtualProtect	0x0	0x68dd70	0x28d590	0x270d90	0x0
QueryPerformanceFrequency	0x0	0x68dd74	0x28d594	0x270d94	0x0
IsDebuggerPresent	0x0	0x68dd78	0x28d598	0x270d98	0x0
VirtualFree	0x0	0x68dd7c	0x28d59c	0x270d9c	0x0
GetFullPathNameW	0x0	0x68dd80	0x28d5a0	0x270da0	0x0
ExitProcess	0x0	0x68dd84	0x28d5a4	0x270da4	0x0
HeapAlloc	0x0	0x68dd88	0x28d5a8	0x270da8	0x0
GetCPInfoExW	0x0	0x68dd8c	0x28d5ac	0x270dac	0x0
RtlUnwind	0x0	0x68dd90	0x28d5b0	0x270db0	0x0
GetCPInfo	0x0	0x68dd94	0x28d5b4	0x270db4	0x0
EnumSystemLocalesW	0x0	0x68dd98	0x28d5b8	0x270db8	0x0
GetStdHandle	0x0	0x68dd9c	0x28d5bc	0x270dbc	0x0
GetModuleHandleW	0x0	0x68dda0	0x28d5c0	0x270dc0	0x0
FreeLibrary	0x0	0x68dda4	0x28d5c4	0x270dc4	0x0
TryEnterCriticalSection	0x0	0x68dda8	0x28d5c8	0x270dc8	0x0
HeapDestroy	0x0	0x68ddac	0x28d5cc	0x270dcc	0x0
ReadFile	0x0	0x68ddb0	0x28d5d0	0x270dd0	0x0
HeapSize	0x0	0x68ddb4	0x28d5d4	0x270dd4	0x0
GetLastError	0x0	0x68ddb8	0x28d5d8	0x270dd8	0x0
GetModuleFileNameW	0x0	0x68ddbc	0x28d5dc	0x270ddc	0x0
SetLastError	0x0	0x68ddc0	0x28d5e0	0x270de0	0x0
GlobalAlloc	0x0	0x68ddc4	0x28d5e4	0x270de4	0x0
GlobalUnlock	0x0	0x68ddc8	0x28d5e8	0x270de8	0x0
FindResourceW	0x0	0x68ddcc	0x28d5ec	0x270dec	0x0
CreateThread	0x0	0x68ddd0	0x28d5f0	0x270df0	0x0
CompareStringW	0x0	0x68ddd4	0x28d5f4	0x270df4	0x0
LoadLibraryA	0x0	0x68ddd8	0x28d5f8	0x270df8	0x0
ResetEvent	0x0	0x68dddc	0x28d5fc	0x270dfc	0x0
MulDiv	0x0	0x68dde0	0x28d600	0x270e00	0x0
FreeResource	0x0	0x68dde4	0x28d604	0x270e04	0x0
GetVersion	0x0	0x68dde8	0x28d608	0x270e08	0x0
RaiseException	0x0	0x68ddec	0x28d60c	0x270e0c	0x0
GlobalAddAtomW	0x0	0x68ddf0	0x28d610	0x270e10	0x0
FormatMessageW	0x0	0x68ddf4	0x28d614	0x270e14	0x0
SwitchToThread	0x0	0x68ddf8	0x28d618	0x270e18	0x0
GetExitCodeThread	0x0	0x68ddfc	0x28d61c	0x270e1c	0x0
GetCurrentThread	0x0	0x68de00	0x28d620	0x270e20	0x0
LoadLibraryExW	0x0	0x68de04	0x28d624	0x270e24	0x0
LockResource	0x0	0x68de08	0x28d628	0x270e28	0x0
GetCurrentThreadId	0x0	0x68de0c	0x28d62c	0x270e2c	0x0
UnhandledExceptionFilter	0x0	0x68de10	0x28d630	0x270e30	0x0
VirtualQuery	0x0	0x68de14	0x28d634	0x270e34	0x0
GlobalFindAtomW	0x0	0x68de18	0x28d638	0x270e38	0x0
VirtualQueryEx	0x0	0x68de1c	0x28d63c	0x270e3c	0x0
GlobalFree	0x0	0x68de20	0x28d640	0x270e40	0x0
Sleep	0x0	0x68de24	0x28d644	0x270e44	0x0
EnterCriticalSection	0x0	0x68de28	0x28d648	0x270e48	0x0
SetFilePointer	0x0	0x68de2c	0x28d64c	0x270e4c	0x0
LoadResource	0x0	0x68de30	0x28d650	0x270e50	0x0
SuspendThread	0x0	0x68de34	0x28d654	0x270e54	0x0
GetTickCount	0x0	0x68de38	0x28d658	0x270e58	0x0
GetStartupInfoW	0x0	0x68de3c	0x28d65c	0x270e5c	0x0
GlobalDeleteAtom	0x0	0x68de40	0x28d660	0x270e60	0x0
GetFileAttributesW	0x0	0x68de44	0x28d664	0x270e64	0x0
InitializeCriticalSection	0x0	0x68de48	0x28d668	0x270e68	0x0
GetThreadPriority	0x0	0x68de4c	0x28d66c	0x270e6c	0x0
GetCurrentProcess	0x0	0x68de50	0x28d670	0x270e70	0x0
SetThreadPriority	0x0	0x68de54	0x28d674	0x270e74	0x0
GlobalLock	0x0	0x68de58	0x28d678	0x270e78	0x0
VirtualAlloc	0x0	0x68de5c	0x28d67c	0x270e7c	0x0
GetSystemInfo	0x0	0x68de60	0x28d680	0x270e80	0x0
GetCommandLineW	0x0	0x68de64	0x28d684	0x270e84	0x0
LeaveCriticalSection	0x0	0x68de68	0x28d688	0x270e88	0x0
GetProcAddress	0x0	0x68de6c	0x28d68c	0x270e8c	0x0
ResumeThread	0x0	0x68de70	0x28d690	0x270e90	0x0
GetVersionExW	0x0	0x68de74	0x28d694	0x270e94	0x0
VerifyVersionInfoW	0x0	0x68de78	0x28d698	0x270e98	0x0
HeapCreate	0x0	0x68de7c	0x28d69c	0x270e9c	0x0
VerSetConditionMask	0x0	0x68de80	0x28d6a0	0x270ea0	0x0
GetDiskFreeSpaceW	0x0	0x68de84	0x28d6a4	0x270ea4	0x0
FindFirstFileW	0x0	0x68de88	0x28d6a8	0x270ea8	0x0
GetUserDefaultUILanguage	0x0	0x68de8c	0x28d6ac	0x270eac	0x0
lstrlenW	0x0	0x68de90	0x28d6b0	0x270eb0	0x0
QueryPerformanceCounter	0x0	0x68de94	0x28d6b4	0x270eb4	0x0
SetEndOfFile	0x0	0x68de98	0x28d6b8	0x270eb8	0x0
HeapFree	0x0	0x68de9c	0x28d6bc	0x270ebc	0x0
WideCharToMultiByte	0x0	0x68dea0	0x28d6c0	0x270ec0	0x0
FindClose	0x0	0x68dea4	0x28d6c4	0x270ec4	0x0
MultiByteToWideChar	0x0	0x68dea8	0x28d6c8	0x270ec8	0x0
LoadLibraryW	0x0	0x68deac	0x28d6cc	0x270ecc	0x0
SetEvent	0x0	0x68deb0	0x28d6d0	0x270ed0	0x0
CreateFileW	0x0	0x68deb4	0x28d6d4	0x270ed4	0x0
GetLocaleInfoW	0x0	0x68deb8	0x28d6d8	0x270ed8	0x0
EnumResourceNamesW	0x0	0x68debc	0x28d6dc	0x270edc	0x0
GetLocalTime	0x0	0x68dec0	0x28d6e0	0x270ee0	0x0
GetEnvironmentVariableW	0x0	0x68dec4	0x28d6e4	0x270ee4	0x0
WaitForSingleObject	0x0	0x68dec8	0x28d6e8	0x270ee8	0x0
WriteFile	0x0	0x68decc	0x28d6ec	0x270eec	0x0
ExitThread	0x0	0x68ded0	0x28d6f0	0x270ef0	0x0
DeleteCriticalSection	0x0	0x68ded4	0x28d6f4	0x270ef4	0x0
TlsGetValue	0x0	0x68ded8	0x28d6f8	0x270ef8	0x0
GetDateFormatW	0x0	0x68dedc	0x28d6fc	0x270efc	0x0
SetErrorMode	0x0	0x68dee0	0x28d700	0x270f00	0x0
IsValidLocale	0x0	0x68dee4	0x28d704	0x270f04	0x0
TlsSetValue	0x0	0x68dee8	0x28d708	0x270f08	0x0
GetSystemDefaultUILanguage	0x0	0x68deec	0x28d70c	0x270f0c	0x0
EnumCalendarInfoW	0x0	0x68def0	0x28d710	0x270f10	0x0
LocalAlloc	0x0	0x68def4	0x28d714	0x270f14	0x0
CreateEventW	0x0	0x68def8	0x28d718	0x270f18	0x0
WaitForMultipleObjectsEx	0x0	0x68defc	0x28d71c	0x270f1c	0x0
SetThreadLocale	0x0	0x68df00	0x28d720	0x270f20	0x0
GetThreadLocale	0x0	0x68df04	0x28d724	0x270f24	0x0

ole32.dll (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
IsEqualGUID	0x0	0x68df0c	0x28d72c	0x270f2c	0x0
OleInitialize	0x0	0x68df10	0x28d730	0x270f30	0x0
OleUninitialize	0x0	0x68df14	0x28d734	0x270f34	0x0
CoInitialize	0x0	0x68df18	0x28d738	0x270f38	0x0
CoCreateInstance	0x0	0x68df1c	0x28d73c	0x270f3c	0x0
CoUninitialize	0x0	0x68df20	0x28d740	0x270f40	0x0
CoTaskMemFree	0x0	0x68df24	0x28d744	0x270f44	0x0
CoTaskMemAlloc	0x0	0x68df28	0x28d748	0x270f48	0x0

gdi32.dll (105)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
Pie	0x0	0x68df30	0x28d750	0x270f50	0x0
SetBkMode	0x0	0x68df34	0x28d754	0x270f54	0x0
CreateCompatibleBitmap	0x0	0x68df38	0x28d758	0x270f58	0x0
GetEnhMetaFileHeader	0x0	0x68df3c	0x28d75c	0x270f5c	0x0
RectVisible	0x0	0x68df40	0x28d760	0x270f60	0x0
AngleArc	0x0	0x68df44	0x28d764	0x270f64	0x0
SetAbortProc	0x0	0x68df48	0x28d768	0x270f68	0x0
GetTextColor	0x0	0x68df4c	0x28d76c	0x270f6c	0x0
SetTextColor	0x0	0x68df50	0x28d770	0x270f70	0x0
StretchBlt	0x0	0x68df54	0x28d774	0x270f74	0x0
RoundRect	0x0	0x68df58	0x28d778	0x270f78	0x0
RestoreDC	0x0	0x68df5c	0x28d77c	0x270f7c	0x0
SetRectRgn	0x0	0x68df60	0x28d780	0x270f80	0x0
GetTextMetricsW	0x0	0x68df64	0x28d784	0x270f84	0x0
GetWindowOrgEx	0x0	0x68df68	0x28d788	0x270f88	0x0
CreatePalette	0x0	0x68df6c	0x28d78c	0x270f8c	0x0
PolyBezierTo	0x0	0x68df70	0x28d790	0x270f90	0x0
CreateICW	0x0	0x68df74	0x28d794	0x270f94	0x0
CreateDCW	0x0	0x68df78	0x28d798	0x270f98	0x0
GetStockObject	0x0	0x68df7c	0x28d79c	0x270f9c	0x0
CreateSolidBrush	0x0	0x68df80	0x28d7a0	0x270fa0	0x0
GetBkMode	0x0	0x68df84	0x28d7a4	0x270fa4	0x0
Polygon	0x0	0x68df88	0x28d7a8	0x270fa8	0x0
MoveToEx	0x0	0x68df8c	0x28d7ac	0x270fac	0x0
PlayEnhMetaFile	0x0	0x68df90	0x28d7b0	0x270fb0	0x0
Ellipse	0x0	0x68df94	0x28d7b4	0x270fb4	0x0
StartPage	0x0	0x68df98	0x28d7b8	0x270fb8	0x0
GetBitmapBits	0x0	0x68df9c	0x28d7bc	0x270fbc	0x0
StartDocW	0x0	0x68dfa0	0x28d7c0	0x270fc0	0x0
AbortDoc	0x0	0x68dfa4	0x28d7c4	0x270fc4	0x0
GetSystemPaletteEntries	0x0	0x68dfa8	0x28d7c8	0x270fc8	0x0
GetEnhMetaFileBits	0x0	0x68dfac	0x28d7cc	0x270fcc	0x0
GetEnhMetaFilePaletteEntries	0x0	0x68dfb0	0x28d7d0	0x270fd0	0x0
CreatePenIndirect	0x0	0x68dfb4	0x28d7d4	0x270fd4	0x0
CreateFontIndirectW	0x0	0x68dfb8	0x28d7d8	0x270fd8	0x0
PolyBezier	0x0	0x68dfbc	0x28d7dc	0x270fdc	0x0
EndDoc	0x0	0x68dfc0	0x28d7e0	0x270fe0	0x0
GetObjectW	0x0	0x68dfc4	0x28d7e4	0x270fe4	0x0
GetCurrentObject	0x0	0x68dfc8	0x28d7e8	0x270fe8	0x0
GetWinMetaFileBits	0x0	0x68dfcc	0x28d7ec	0x270fec	0x0
SetROP2	0x0	0x68dfd0	0x28d7f0	0x270ff0	0x0
GetEnhMetaFileDescriptionW	0x0	0x68dfd4	0x28d7f4	0x270ff4	0x0
ArcTo	0x0	0x68dfd8	0x28d7f8	0x270ff8	0x0
Arc	0x0	0x68dfdc	0x28d7fc	0x270ffc	0x0
SelectPalette	0x0	0x68dfe0	0x28d800	0x271000	0x0
SetGraphicsMode	0x0	0x68dfe4	0x28d804	0x271004	0x0
ExcludeClipRect	0x0	0x68dfe8	0x28d808	0x271008	0x0
MaskBlt	0x0	0x68dfec	0x28d80c	0x27100c	0x0
SetWindowOrgEx	0x0	0x68dff0	0x28d810	0x271010	0x0
EndPage	0x0	0x68dff4	0x28d814	0x271014	0x0
DeleteEnhMetaFile	0x0	0x68dff8	0x28d818	0x271018	0x0
Chord	0x0	0x68dffc	0x28d81c	0x27101c	0x0
SetDIBits	0x0	0x68e000	0x28d820	0x271020	0x0
GetViewportOrgEx	0x0	0x68e004	0x28d824	0x271024	0x0
SetViewportOrgEx	0x0	0x68e008	0x28d828	0x271028	0x0
CreateRectRgn	0x0	0x68e00c	0x28d82c	0x27102c	0x0
RealizePalette	0x0	0x68e010	0x28d830	0x271030	0x0
SetDIBColorTable	0x0	0x68e014	0x28d834	0x271034	0x0
GetDIBColorTable	0x0	0x68e018	0x28d838	0x271038	0x0
CreateBrushIndirect	0x0	0x68e01c	0x28d83c	0x27103c	0x0
PatBlt	0x0	0x68e020	0x28d840	0x271040	0x0
SetEnhMetaFileBits	0x0	0x68e024	0x28d844	0x271044	0x0
Rectangle	0x0	0x68e028	0x28d848	0x271048	0x0
SaveDC	0x0	0x68e02c	0x28d84c	0x27104c	0x0
DeleteDC	0x0	0x68e030	0x28d850	0x271050	0x0
BitBlt	0x0	0x68e034	0x28d854	0x271054	0x0
SetWorldTransform	0x0	0x68e038	0x28d858	0x271058	0x0
FrameRgn	0x0	0x68e03c	0x28d85c	0x27105c	0x0
GetDeviceCaps	0x0	0x68e040	0x28d860	0x271060	0x0
GetTextExtentPoint32W	0x0	0x68e044	0x28d864	0x271064	0x0
GetClipBox	0x0	0x68e048	0x28d868	0x271068	0x0
IntersectClipRect	0x0	0x68e04c	0x28d86c	0x27106c	0x0
Polyline	0x0	0x68e050	0x28d870	0x271070	0x0
CreateBitmap	0x0	0x68e054	0x28d874	0x271074	0x0
CombineRgn	0x0	0x68e058	0x28d878	0x271078	0x0
SetWinMetaFileBits	0x0	0x68e05c	0x28d87c	0x27107c	0x0
GetStretchBltMode	0x0	0x68e060	0x28d880	0x271080	0x0
CreateDIBitmap	0x0	0x68e064	0x28d884	0x271084	0x0
SetStretchBltMode	0x0	0x68e068	0x28d888	0x271088	0x0
GetDIBits	0x0	0x68e06c	0x28d88c	0x27108c	0x0
CreateDIBSection	0x0	0x68e070	0x28d890	0x271090	0x0
ExtCreateRegion	0x0	0x68e074	0x28d894	0x271094	0x0
LineTo	0x0	0x68e078	0x28d898	0x271098	0x0
GetRgnBox	0x0	0x68e07c	0x28d89c	0x27109c	0x0
EnumFontsW	0x0	0x68e080	0x28d8a0	0x2710a0	0x0
CreateHalftonePalette	0x0	0x68e084	0x28d8a4	0x2710a4	0x0
SelectObject	0x0	0x68e088	0x28d8a8	0x2710a8	0x0
DeleteObject	0x0	0x68e08c	0x28d8ac	0x2710ac	0x0
ExtFloodFill	0x0	0x68e090	0x28d8b0	0x2710b0	0x0
UnrealizeObject	0x0	0x68e094	0x28d8b4	0x2710b4	0x0
CopyEnhMetaFileW	0x0	0x68e098	0x28d8b8	0x2710b8	0x0
SetBkColor	0x0	0x68e09c	0x28d8bc	0x2710bc	0x0
CreateCompatibleDC	0x0	0x68e0a0	0x28d8c0	0x2710c0	0x0
GetBrushOrgEx	0x0	0x68e0a4	0x28d8c4	0x2710c4	0x0
GetCurrentPositionEx	0x0	0x68e0a8	0x28d8c8	0x2710c8	0x0
CreateRoundRectRgn	0x0	0x68e0ac	0x28d8cc	0x2710cc	0x0
GetTextExtentPointW	0x0	0x68e0b0	0x28d8d0	0x2710d0	0x0
ExtTextOutW	0x0	0x68e0b4	0x28d8d4	0x2710d4	0x0
SetBrushOrgEx	0x0	0x68e0b8	0x28d8d8	0x2710d8	0x0
GetPixel	0x0	0x68e0bc	0x28d8dc	0x2710dc	0x0
GdiFlush	0x0	0x68e0c0	0x28d8e0	0x2710e0	0x0
SetPixel	0x0	0x68e0c4	0x28d8e4	0x2710e4	0x0
EnumFontFamiliesExW	0x0	0x68e0c8	0x28d8e8	0x2710e8	0x0
StretchDIBits	0x0	0x68e0cc	0x28d8ec	0x2710ec	0x0
GetPaletteEntries	0x0	0x68e0d0	0x28d8f0	0x2710f0	0x0

Exports (3)

»

Api name	EAT Address	Ordinal
TMethodImplementationIntercept	0xda408	0x3
__dbk_fcall_wrapper	0x1069c	0x2
dbkFCallWrapperAddr	0x27563c	0x1

Memory Dumps (4)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Points	Actions
ztarter.exe	1	0x00400000	0x006ECFFF	Relevant Image	-	32-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x002B0000	0x002B0FFF	First Execution	-	32-bit	0x002B0FE2	... Memory Dump Actions Download Dump Go to process
buffer	1	0x002B0000	0x002B0FFF	Content Changed	-	32-bit	0x002B0FC8	... Memory Dump Actions Download Dump Go to process
ztarter.exe	1	0x00400000	0x006ECFFF	Final Dump	-	32-bit	-	... Memory Dump Actions Download Dump Go to process

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-4ij7y-zIo-dhcoiIV.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-4ij7y-zIo-dhcoiIV.lnk (Modified File)
Mime Type	application/octet-stream
File Size	4.91 KB
MD5	70ddf2e97d71f21946090cbbe0d52b42
SHA1	79649214410af8d38b676eb1da44a66aed915615
SHA256	ff48abd9f7a56fbb93dea83e3011fa931198a37ba680ef97f9c351bd27322f56
SSDeep	96:z3ULD2v4CXGuLfAl5zXRG+UeC8WH1moKPBrTv9zl1EGbXlGzjEKGHBF6FzULixct:Ifk7T08teC8M1uJnv9BOG0zY1hF4zUuM

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-vbAQ74ugAbPjkEt.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-vbAQ74ugAbPjkEt.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.28 KB
MD5	f4f9f2bb415ed1db0ab3b8dd95a453ee
SHA1	dc0a465ba1b9f5252794a3ff0703085f14fe4c5d
SHA256	3e773eabc55f08e69526107df796edbaa8598d18aaead9bf420ddd2766bfed3a
SSDeep	96:3MoZZFW8zBv1VmztQmOcj9xBHermLUJJFizFxMW6OtsEYygW3LjP0:3M58V1VMXJhxIm4JJMB6KsEYy33s

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\0C4Q3lCUGrjgBWBW_0y.flv.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\0C4Q3lCUGrjgBWBW_0y.flv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	81cb5d256cf53953be1f43eec0ae7582
SHA1	f5dfcb02102269ece47035b18a099df657753f15
SHA256	47912595b35a4e085d9db52ce6774bb218f4b6e81a748ef2463cf7421cae43ec
SSDeep	24:5sS1ckA0BjXsue1nEnk4GitIhrstteW0om:5sSCVVXNEnkiGckW01

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\0osVjDZjBJvKoUQGP.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\0osVjDZjBJvKoUQGP.lnk (Modified File)
Mime Type	application/octet-stream
File Size	745 bytes
MD5	c741f8b6d3c0b5eb0501ddb6bbbdcb7b
SHA1	ec4da03d1654606116fe92f3c8d12d16b8ad2085
SHA256	b969a66ade66125a6717e9c58dafa3d869d8dfb26b193a444f5c5ca30dec3333
SSDeep	12:lEmP4fCaF/Wzz/VXLAj0RypdzA+KC+DQR/WwqvizBeRI0GoBu5hIHkb:lEM4KaVsj3RuuNfaK2qkb

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1H7TVT25t.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1H7TVT25t.lnk (Modified File)
Mime Type	application/octet-stream
File Size	574 bytes
MD5	2c8e39e52a2a0f612538241360479dcf
SHA1	a80272cbc631d214eb54c91d4410ea2cfed47370
SHA256	5aec33a1b970dcf9e3ee6b562483a06e574e7272372927b2cf8dd56bafbcc3ac
SSDeep	12:YTGmacSPQgC9DBVJiVmxusabifSABykuiM9KLTR5CPxXkaRn:YTG9C9DusQSSAEkur9KLPCaan

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2hc0nLdqeXfTqNl.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2hc0nLdqeXfTqNl.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.73 KB
MD5	917af507e8a524d9fc28e84e4c8aae25
SHA1	9d3d0d8acf7f081d486a0de3097dc4160135fb5b
SHA256	8ebe3fa0a9db45aceec524af6108e2cb55ea9d25fee12c4c6673480f82bebddd
SSDeep	96:EVOrQ4YRvfRio51JWoceEkQnwVaWw1C6jpVOYDcq:EVOM7lyetkwVaWw1C6jDHIq

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\304-.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\304-.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.48 KB
MD5	7a9a24be9581e066901e971f95e8b623
SHA1	03815d6c3a2d6ea0bd9a04f24fac33256f4d47cd
SHA256	88289a84c974dc2c597131481a29f38f829526c66853f6100917a09126d71410
SSDeep	48:+397ufxqpSsjOJ0BuK5bhzS6K1/LbeypVloQX1zF3kGvB+PFbOq:CKfO+shzS63Q1OGoPp/

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\3VRMss5BV-ngBLL642x.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\3VRMss5BV-ngBLL642x.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	c7852a1550d7292d4e040dea61b84484
SHA1	76d4625a1bc5a611af36823524de43ccdb745259
SHA256	07031783e295d6b1976415b4332f997915c2ebedbd7297c86feb6e381bd1e936
SSDeep	24:39lITNV+8aDR9/QuNNnn/SdglCHnKAi3W3nqj8Ghb7HDVUUAAls:3ONq//QuNhSdglCHKAi3WXzGhRUUAAi

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5WmPRJ5suanW.mkv.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5WmPRJ5suanW.mkv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	6.54 KB
MD5	571532a8a4387e1ae7311ac04e9990e8
SHA1	9b97833411e1a7da4c157357d7be615bc0dd5557
SHA256	e2d176f33f674815d4cecf73add2b7744fc27bb709abfd4aa4fa8bc2bbd4c174
SSDeep	96:elPKs48pgyHhRfzFE5w8Q6hkq44Ssyu3d4BIVtSyquOPnU1poEo8KhkpKV+qZXn+:eko+yH/0w8r4u42EYOG/a+qZX+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5_dX0Aaaa76daX6ovV1f.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5_dX0Aaaa76daX6ovV1f.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	815 bytes
MD5	d23bc69d0e5955e35fd55ebe5a5044b2
SHA1	ad31c2632895f9c18f10ef81b7acc097074231bf
SHA256	f2e7e50b60f1e29637c078ad3648d9740569b27d6671d590b3b2a13f3d323cbb
SSDeep	24:PETqoFHg4aCiXC1LCVFUwbzbzctGFVuAEw9ClKKw0:PETqoFHgkiXChCVewroG2w0

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\7Q9liHaXsdf.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\7Q9liHaXsdf.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.07 KB
MD5	fd6ba5e1e01fb49fda64855e9a0972d5
SHA1	45c5e8213429213f6748e98ce7528f1cf325695e
SHA256	0fbc16b7cfea6aeda334bafc73f310b7ee4fb0425caeb34abb5b6af7462047c5
SSDeep	96:sll0RM1EhEZ4MxPcH8qxUaORqcrPggoMiUchaPdss+jasx0KPo9He6:RRM1bGMifR6dHoMyaP+JD0KPob

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\7xqky_KR1phllF0lUBH.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\7xqky_KR1phllF0lUBH.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.29 KB
MD5	2d78d4ba5ea771ba9964d37b1837343d
SHA1	92a6c4ce66d6853da9b3eef57772669c059a875c
SHA256	2daa754896dc5aedec97d5c842dbe785706066206a70b96c94ff479030046ac5
SSDeep	96:wVMCSqxpM1vg4MoPqw1AD0Tml3JJhcljHKfqC5lwznMWEFXZ5hsm:wiC3M1Su2ZJUHKfJwzMWShf

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\7ZPfBAbmM5yoEBSb3T.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\7ZPfBAbmM5yoEBSb3T.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.16 KB
MD5	e836bd39f7a12ae01ec1e32300228e0a
SHA1	789493f7e83133dfdfb3564424989c28d51ea34c
SHA256	b7c90499bca2a74e782400fa3b7d8b44364170fcd0b69b41f5f9400e3e75dab8
SSDeep	96:zMAVqLIL96pkpXaiBy8wqlDrK+KSAhaJ2ap7+CwJncuIDPWwrEjmGB5u:zMGMpgXBy8zDrFll+CwJcuIDPWwr8mCQ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\8eWaTb.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\8eWaTb.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.71 KB
MD5	8e36eda95679d80c1b067ffbc8a8c195
SHA1	75731b329ea91da7835effbbc548cc9d0af04d6e
SHA256	bc05e473848df7bb1ea209eec46b030c99b41d4fc2f4ee46a6a12749dfaff777
SSDeep	96:JcA3mvhXQM/5VUASe+9AHhqIxbFkKZ/5GcBTUztrADo:JcA3mvhA45iAEQqipkKZ/gcKr1

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\8mJLvTqgcpH-zx5.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\8mJLvTqgcpH-zx5.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.40 KB
MD5	4fc8916bfa6538cf0540299737702908
SHA1	53cd20e6b532df73ae8bacc1284c97e80a10d07d
SHA256	620e9c863475fa23bd1b2c9d68473a23f015e3ba2d60a0cf31c5cbaf86bcdbc1
SSDeep	48:K6Y8QcGtw/WAtZHzTRzE4ZC4aOiDrbU5GvWFjj8KB3G0OOUZPX:K6Gtw5tzT9RC4EU8vWTZG0RIP

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\9zcK9yFvhp38_3ycric.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\9zcK9yFvhp38_3ycric.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.65 KB
MD5	cec9ea6322018bcc571f30fdd29bd54d
SHA1	9a91fd1c625b2f6bdce2cf6a6e0e3043eb0ebc77
SHA256	44894c73139481821920d9a661ea24b45dfb42bcc34091a82262e640de27040d
SSDeep	48:GGiiS3WHldlyX2bcMMhT5pT5EZEA+3K4nFPhHwPtdqb9Ds6l2k:FC3mldlyXZtaZEAsn1hQnYDBJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\AalPBDgDSgBqLTp 4TZ.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\AalPBDgDSgBqLTp 4TZ.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	6.43 KB
MD5	2c51e08eebeb58d45411454d8ed937a5
SHA1	3ab8e5db3d070b048467f3b26342f27b27b1b7ab
SHA256	8371aec027e38c13cec0cb6613637e008ab1a7305ee4ae2839ae6a75cd630369
SSDeep	192:uHc3GLiygys6WhY8ip4uIUzJ4aXs3aqAFON:Deid5neLb4miaqgON

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\adim4yK7GC8JdG2.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\adim4yK7GC8JdG2.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.61 KB
MD5	5564668cfd3856cbf43e6621b4577a32
SHA1	342edb36b4b81f31811b4f1a0d18eecf1dd96e1a
SHA256	97e8759dc66c340ebaa9fe5169479c505efb95d78add7f1c22e21fc009e4bdd2
SSDeep	48:DYrCQKEd/PQcIqxvEPXhipA2XV1F6jgJJ/e/XrutHWKf30sIkgCFIl1u1DGWxlHa:ACHEtBEPXEfYUqut2KAkgCeMDG4/8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\aWeYTbu-8Qx30.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\aWeYTbu-8Qx30.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.15 KB
MD5	11b7c46b2ae6e51a1963d5c96d01128a
SHA1	43d7194873e0037681c4fe7ae3b8d8d4e256a839
SHA256	f3887e5dba7ad0cbeadcbd99697375df764d3f64399debef8551f0cb36ff648d
SSDeep	96:XywwnPWNzB/ZafZVQJ5Ip8jKqbtbWR0lKMvR+aRFxnMqqDDdyiiavAYwTVl:iww+/Z5DIyKWqRXixALiBYwJl

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\b3Wd.ots.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\b3Wd.ots.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.65 KB
MD5	98ebb2b579a38d7473815f65b0e589bf
SHA1	dc952a49d31189be91fe0147c6c40a4568df0904
SHA256	b5d3443a612b4c538f207f6c64960a554049bef2e9812c5df90e6ad6420be390
SSDeep	96:ie5ikwPsfQ9qaybK19sbh2N0PE6/u0fC21FdEp6yU/rJw1:Viof9aoK1Os6fj9c6y6w1

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\bas277gWUmBLlLIEKTn.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\bas277gWUmBLlLIEKTn.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.16 KB
MD5	2defbc60df1147b221c6b02e3de0d4a9
SHA1	5912c2cf0c630de6c09389ccd614064bef6d2db2
SHA256	ed8f3a61ccc355730a6a52c200645a747b9c5c8193691ab171e1211281f230a3
SSDeep	96:6LWWoftuhJEgCUmwpLJnNwRn36m+wOgIudZODHam:6LWWY0JEgaonNS36mkgD4em

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\biGPbmuUIxOTke.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\biGPbmuUIxOTke.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.80 KB
MD5	f8e5a196afe8c415619ad2a67175be8f
SHA1	5c596b3da2474d31b65668395cda1524df6d5d6d
SHA256	11a087e61e9d17e45ca875617debca9d26562f658894982e2527921eaa92157e
SSDeep	96:PWARtyW8bhR+rnSjMJEaMNQ4MMlb94IX6hWOCbMNUVTt9hMd9O:1RUWm8rSgJ4MZPhbON89O

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BLitS9HIT9Qz.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BLitS9HIT9Qz.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	589 bytes
MD5	791717c89a4d8b5422633e252d251bb2
SHA1	cd433f6f1db22c4de44717400d6cd02e3b62bb05
SHA256	a658f749d3cd13274eb0a64a1133983015ee3b8f7831819bb9e9287f2dfa1ee8
SSDeep	12:MA7w6kBMYF2zE7Q24tKLJshhj5d71nomvp/OaJobgnGgUV:MEw6krF2zE7QftdhhjB9v1oqvUV

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BQPd1Wx n.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BQPd1Wx n.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.54 KB
MD5	9555b8aa0cdd2f22d7967c011c2291b9
SHA1	896bb4f4b903e1b465922b9101ddb50ee313a4ff
SHA256	4e82c5bcc73d550b393f4c8ed9cbce5e8686583be95b1eab8ac4bc020fe909d5
SSDeep	48:hxisxeajWYsOslbNjDdcnUdpbfs53vVbt2V+r8YFGjVlMXaps6T:hPjWfOKbZdHfsVv1tJzbKpVT

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BvoMVx.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BvoMVx.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.03 KB
MD5	066cc19b81e0d60b9309c1ceff6dc442
SHA1	afadde45afbd2fbe6c441d69872954bf233a8ac9
SHA256	0f4f43239a5d29e6c8356a37a2f7e2a2e45081d52618c54649d32d3f05e76e9f
SSDeep	96:d2MZO+YWb2PZ7BcTqdrRevVfLsp6B28pM+ZTqGbp3JNE/zxHrzT9dOzUxEF60+Se:d2MpjbO7STzvVfL4h894GVs/tHvhdS7E

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BZ9fqjq_C0.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BZ9fqjq_C0.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.08 KB
MD5	7965db35a76020d059588273fdf06838
SHA1	632aca0cf9b73748f15af9acf72de6a5f54f6347
SHA256	5054f3b4cb27a23e6dc843634c942215f2c3b6ebe33811b8ee9026760f2f23ab
SSDeep	96:kEH3fgdeIYnv+ZaEdLGxUFUdTKtm+kLVc0C+ItiK3vmhr:JH3fwfYn2ZaE5GxUmdTKt/tiK3Ohr

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ccKqRvGHdONou.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ccKqRvGHdONou.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.10 KB
MD5	b66b1c7a21a136a5b3481c617130c6fd
SHA1	62ccece0ab473c9df16bad807445647f9e3d4a4d
SHA256	3ea40103cdb89eebac4f9a7215402f97541f9a2470a6250770ca73b3355e71f1
SSDeep	96:HDqJxnQLlR2PuoCp+WYtFm+tT2N6gvUc32Zb9kEAo5kyyADS8xU6:janQLmPuodWKF1tT2kSUS0b+Jx4SCX

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\cGWVj3zjOM.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\cGWVj3zjOM.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.73 KB
MD5	e0e950163e522f744909514d0ee0898b
SHA1	902b64c875b51c3f3ab32c4d9d83b2a7e2a741ab
SHA256	9393a18e7dc544eb7e057a0b3bd5653017c2cb6aacb44bb212c946eff089d1ed
SSDeep	96:ctD0Y1+3dpx/JbmGDlqyDL3qexdBH7IchkPKZQO:c2YKpxhb/Y+LBBk+IK6O

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\CO u8DbP08g8.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\CO u8DbP08g8.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.78 KB
MD5	37cc741b8f58cb6b8df72ee2924af5d6
SHA1	47e2405cfdebe5b3aa49285656fed7b1836ba735
SHA256	def20ff37375c681eadaa7c1e94cff1f4f95ab52a019246d6ab6b720cfec8a2e
SSDeep	96:zXEa0w3xX61iCOUXh8v/fEMfsMp1oCotql8hT2:zXEaN3xXoiXU8kMfsMUCotqlT

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\D-ZBvd0l.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\D-ZBvd0l.lnk (Modified File)
Mime Type	application/octet-stream
File Size	469 bytes
MD5	4ffe74454fe49e807b1da2621c6c79e0
SHA1	9bbed7bf9adb858094fda9d0914189e7df4f4a7a
SHA256	e0a6f05fc20718262db73491261fc32fdd67295fd128ac507ea2aeaff3adad10
SSDeep	12:AclRXUyA6ndoiTGftWFnrrnPXB5VpKo0qR+1xC:vUr6dTAWp/PXppXR+e

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Dy5IW1xWAqSu23GIuS.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Dy5IW1xWAqSu23GIuS.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.19 KB
MD5	64c5b5fa9b794772a8acbe2110909dc8
SHA1	e751c42dc584cb8d09eb2096b08b91599ef0cec2
SHA256	d9e6ffdb04090c0066d901109e631c655f2fe5dba33396c200492194f3446af2
SSDeep	96:AADlVXUPp1T2jucbcmz2u7OAOqYJ5yE3USHOsFm89ALaQ2BdctFfTmhDTtTMmRsK:AADlVK1TSbcmz25AOFJ5yE3U4RFlKMdt

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\e6OEO.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\e6OEO.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.50 KB
MD5	cb7f284f96e99570defd2f348d7f7a8f
SHA1	ae2f6d0cf441e7d8f93bc7855de5b0eed236bdd8
SHA256	a7fc191f6740e45917257fbc4df7928d6e8d2fac430b3a2d9a3a4f64aaf588c2
SSDeep	48:P/NaQl+SdXgLzQP78CgeRqeMTI/aEtBxl411gfRTuJ/hfWalX+XbIl:NaQlJXgHQjBgeRKAaEtBxtFudh3IIl

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\eI7QTrX.flv.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\eI7QTrX.flv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.54 KB
MD5	7d8d86ae48b686ac14a271d22cdde270
SHA1	9a347bdf6cd7bb3ff1c9be75aaba8e1e50482a3a
SHA256	0f4dee35cbb61b1a9d7b2c7dcf910e57ac8fbbf5040d7b1260f698fc14425229
SSDeep	48:dKi2pRKc+X9RPFG76K79C2IW96iPU+IwnyRaZd89//iA6AdE4cO5TpA5DhTB7Fet:t2pRyTtbX2yiP5lnzZEXR14D9ew9W

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gsQ-EPB.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gsQ-EPB.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.52 KB
MD5	b652a9083c511ca2d9dc729915153166
SHA1	13459dc7bd624ecbb3ac72a3cb7699ae282d56cf
SHA256	d64a8bccadf54c0693f4d82d1b26c4ba9038e5eb3a70cdb21b367ada1cc8f69b
SSDeep	48:KopMErU4Ak01kyOPBke8MWKcFhTPKJ7yq7Ejah9WzqDs++HaJ7iEghWIXh:hTAkukXujFhDI7yq7EUwFaAEghFh

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Ia7vXnn.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Ia7vXnn.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.73 KB
MD5	84bf259536d68f48f6c35820e8e3b32d
SHA1	f1a688206684964e16f3ea57bc40c01496345f54
SHA256	a4d752410e60e45fd146d4feac60356e929dbf3953523b1002e1e2bfd8b3b6ab
SSDeep	96:O4E2wcp2uLH22tDXRZjiaui73MpCxv7BJ1l9E3ysMJM7KX:O4EvcpNLWwXRZjiBq3MpCxvtJec

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\i_4q7DX_I75G.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\i_4q7DX_I75G.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.58 KB
MD5	8055a2f49bc08e0daf280c44ec3de415
SHA1	bd5daed8aac3930d9c1997053379edcd93f9faff
SHA256	397fe766bbf2640d3886c13ebc721dfb2f0fc71b46a5f48b2f9ac6d107e2d4e8
SSDeep	48:o8FMU/8fiIHbdTaVmpDLKcgHvxtfvdZIsBn/gthzxNik6PClU5WWbeFEqnXvbo:hOo8fZ7ZaVqgHvLlbB/MhzHFHWfEvbo

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\JPFZDi_iA.mkv.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\JPFZDi_iA.mkv.lnk (Modified File)
Mime Type	application/octet-stream
File Size	8.21 KB
MD5	0ac68f11ca5e7e30918c95a8fbc0e38d
SHA1	824abe19f817ad25d438d393bce89d5f77091f0e
SHA256	862ed461826cdf632296a66e79fb9bafd153821c6218f7976d3d8516c622b483
SSDeep	192:QMGSN6Bojns9yL40B8bUVAlU14i6cHE1Z1sAgsu0d52l:QMb0Es9B0RuH1cHE1/FgAzc

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\jrQlzJ0Gbx.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\jrQlzJ0Gbx.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.60 KB
MD5	16b41f4d33ac222bc450951057734636
SHA1	e7e89abd085e3823a747faebe800a5a58258d7e1
SHA256	05b6f290d2eef8016a59867e4aaa6dabe2f3c0a088861f1e6d7c33107f0b9a59
SSDeep	96:IfaGTP+aEVXn9nSWbmqVCHnt6o7ttDkmDgm8F:IiG+aYfb/ANP7ttDWmG

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ju-g2y7wqsKhm.ots.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ju-g2y7wqsKhm.ots.lnk (Modified File)
Mime Type	application/octet-stream
File Size	1.00 KB
MD5	96e7fc5c6f14b690ca7c2ba17c6fa224
SHA1	d7b9ea0b7cd6d538305c8efd02167eb810644cfd
SHA256	b005f19c8a890162d40a6cd775eba6d793bd1f784bf6b5dc664eca598dfa189a
SSDeep	24:o/32BYDYXOUKNjr/PUFRqSyvYB6dN5ksymb4jTF5s:o/2BYDYeFTUKMBBsymsns

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\JuzpETj0m5mSI_GD8URT.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\JuzpETj0m5mSI_GD8URT.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	642 bytes
MD5	519846a268fe2a691f9efe1566712b21
SHA1	53e5156fcfaad3bd285660df7f98c47dc9b9260e
SHA256	b4f0ebe7751159372ea38a74b4b9c5023f72e1c1310db617311ad182105d5a5b
SSDeep	12:/n3F33AIoRQR8fK2xwHNw6/e5CuDqPW88z6hfzajyIl8nt9kPa:/OfGDtPVVev6t2O9sPa

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\JZ8ftz1nduVAZau6pD1J.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\JZ8ftz1nduVAZau6pD1J.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.29 KB
MD5	be4d6686bffc5bffd86b54c5a37a632b
SHA1	4af575f79914ee5160557effff3360d0d1f448b1
SHA256	b405c9c9d0a6586d6c662e39764731fe0829a746bd3f0e7cc7723cf1e8d0fa42
SSDeep	96:kKhUVvofZ9pN5I6wvbQDh9YiyIiCFj60bokHkUpqT:k5tohE5vkRyIJNLTHk4qT

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\kf0cD8ISIQxuHW_XccTx.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\kf0cD8ISIQxuHW_XccTx.lnk (Modified File)
Mime Type	application/octet-stream
File Size	975 bytes
MD5	4e8e99b1579d3eb36d05d5da13eb24e0
SHA1	d605af47c69f84d60f0cc9b9a4de17bfab9e9696
SHA256	ce91232aca0126759cf6faf394b32c6326f48fea1509caf60354c65de43aa9fe
SSDeep	24:wsoLOZ/NeFW9JNa1cvWNCN6FewDxYb3xF5KzD:wsQM/0W9uPCEe2xQ3xF2D

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\kgYaSl_t9.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\kgYaSl_t9.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.66 KB
MD5	e60aacfc6baa7de947b654ed07d88a65
SHA1	a80e9c99991490dc0cdb0e1cb70e8ed7701d16b8
SHA256	22b4bd220088e197e4fe57be3e8ce14f66043773c03e8957b6daafea57216a92
SSDeep	96:k6yMWNrdMbhDZNEOXib05CCNYpwWScfMMOi2tUdAJOCief:ouIMCCNEwSNjtd8kef

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\KjT4 HwzgaTQ5.flv.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\KjT4 HwzgaTQ5.flv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.49 KB
MD5	61fff0503d04c956676c606f80a31bba
SHA1	71f7a2fdaa1f6cb4bef23f0ece68c75fd099ec53
SHA256	7ff974465902e4d5528fe7ec14430c0781d5c88ed9fa2cbbe41edba542c41f66
SSDeep	48:blHt8cfNjGfH47ETVmcIByYo4dEcY0aN/Zln6rH3QfSCx9f1:b9t8cFSw7ETkcPXcN3lCV

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\kviaNKI4z6o.ots.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\kviaNKI4z6o.ots.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.09 KB
MD5	ab4af85b46a305a830b059f91f4f16e2
SHA1	5f143b2ce2717830be29680436e5b0e6333ec9db
SHA256	f6f2db981ff8ca1a3bcb21d92734e8b718e9d44bea2f64c3b76ed7af0b537747
SSDeep	96:s8QgYpSo0Cm29G/vlyg/yvGRHmr1woGY94hN6UGGqx3RAd/IsHk2JucAWIo0:s8QgCmCZclF0G9mrys94TZA9RcAsEEIp

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\maHvK_h22n001r8G.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\maHvK_h22n001r8G.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.54 KB
MD5	cf0ffe2a1f427b2fc9fca5b1ee79adee
SHA1	14657a6d6a2187729145231520322961300c7ddb
SHA256	e63cc4ec206aed4df34e6b4e41a4bd67fd4f8dcc9f5dda857c21f39c2a5aef8e
SSDeep	96:/AWja8Qd+kvvgw8MbobkEEXvGga+FqnqnpCov3B:/AAodsMb/EEXvpjpCov3B

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\MFW8IZ.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\MFW8IZ.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.32 KB
MD5	133df24cca9891b7b2f238180d52181e
SHA1	6fbb875988d5317512ef7cf3fa0e43451a7887f8
SHA256	18a7ee8a16f4bfaa36b07534438202b487a008af8b10ce858c48acfc0832a33a
SSDeep	48:JiXrHbGfzC2uYP9vcW1itFrm2zn7p+u80kSmaLu1OkrnpxmaDK:QHqfz/uYP9v5itFKWvbkSTL8hnGau

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\mn7dUzVEpT7myW.flv.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\mn7dUzVEpT7myW.flv.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.50 KB
MD5	39c1362bf93d9b20fa3f1fd8707bd1ba
SHA1	17a38a77b46ff9cda4c46f81d02ac8f06f8c934b
SHA256	984f771d31399773eb268999940fa0be831a0ab97db5492731aa87f317fbbede
SSDeep	48:0ykOzvqBtSBIZywGD4iu2W8OW0wPofMTp6V+WFgDdfxerA1Cs3AtiFrryMAXZIg/:NkOziB02Zvg4i5blPPo014+OgxsrDsQp

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Mq6WDLR_stC6S.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Mq6WDLR_stC6S.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.63 KB
MD5	45a79dbc0302d9223591a3b4bfcec9b7
SHA1	87f79c098da9fe40d963a6d807716c80844d7e42
SHA256	81a7a742efc1b841c4b6539b50b063cb2473d8cc11c590134d91cc32a8bb3a39
SSDeep	96:P8Vs7X/2u2ixvae+TFdYJbybuqjNiOXtBrHF+fIo:ksT/X2ixvaecqJLStst

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\My Pictures.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\My Pictures.lnk (Modified File)
Mime Type	application/octet-stream
File Size	1.33 KB
MD5	bd961149accbe3d6d6a40c4c1d1d88fe
SHA1	a8837bb85a0e89986e86468e78cd0eda7e3dddf3
SHA256	1b0bfa03f738c655bd960401cf80be1e57bee00b5cdd7e9de1de257af8554cd7
SSDeep	24:xGns3dmUE4zUbzRwZ2KdBLgzedTwwO2z0/wslaz2zwkTkMWBpFR+qAGx/2:Qns35zUXRwZFdBLZwiz0xEQg7R+qAGxO

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\M_3Qky P 4q7L.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\M_3Qky P 4q7L.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.11 KB
MD5	1073b7f8ae36a36372e47de4f24fab28
SHA1	d94f62cbc8a8428f88810b0470cb9c19e2767efc
SHA256	d219f6952c02c3a60b52c13a005cd66d2660b740c1e062e05e6f1a0e9a9aab0d
SSDeep	96:QJRljH1g5SfGMlbt/mbZNkcSNuse+ICSBLA15EARuQjzp:Q3ljHT+ebt/mb0cs1S5GvsQ5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\N1mlh_LBIUTsWGpL.mkv.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\N1mlh_LBIUTsWGpL.mkv.lnk (Modified File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	f1cbee793485ea2940d5991399e7640b
SHA1	c8b970359b13f4353d0035fcb3306b0d0e8efe75
SHA256	d5fa6763d592e8eb6ef2e6adcae7f1aa40763cbbed7ee78b24d728db93c0b1a6
SSDeep	24:mDyK8jAZ+JWK3iDO6+zGzWRKszgPrsJy+Ps9dXsETWd3lP2r:m4jNWBKyzWUUgD+PQXsYWdIr

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\n3ype.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\n3ype.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.50 KB
MD5	7db6c60969efb41b4d811e2914138af6
SHA1	4aeb1023b33973de06d658c574adc1be6bc18a3c
SHA256	ce5af4802cac8ba37b62c39159a6fe23b7c88d252d6c06ce23bdf9a392071b0f
SSDeep	48:HnY2PCM1j+tBDYkUfuHV4/kGFYQSkmrjiCnn77ZrEP5hVmikedmPsa:43sjiBDYkUmHekGFe+C71rEJmixdm1

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\nmLnE9JG9deI.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\nmLnE9JG9deI.lnk (Modified File)
Mime Type	application/octet-stream
File Size	602 bytes
MD5	d9c52518e8fb4f8b0a9858be9fc7ede1
SHA1	9a60a5078c77ea311a2d17e9b51a2b5d80e33ad5
SHA256	92a1f3bc39476118e4d25d72ff1127b9ede4291b2067ecc6067b88505bf9d3b6
SSDeep	12:g90DYutzMRiyZN5aXdV7H9Lww1XV9wtnw9ozd9Krb3IE:btzMRiyZN47dRJenRzrK/j

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\n_x6gNftmTgsMiPC2h.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\n_x6gNftmTgsMiPC2h.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.30 KB
MD5	dd5effa6f7f011f38e3e4a29497013ca
SHA1	e1353adcb0c1195b873467d044f503c4f803f252
SHA256	c7b2512d808f96a248444c876b60e289f794773928947a9d68ed6e7d076b0266
SSDeep	96:znoJxh5dQdkLL3lXaJR9OqwQQ/2PrI5SaA/of03U8aY1Ke7S/C6EwYiwugJJhKHW:zIVd5HVXkR3lPrI5SaO33aYHSaYYiwZB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\O-Rd72Ki9uU-FgTEP 8.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\O-Rd72Ki9uU-FgTEP 8.lnk (Modified File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	27d685d39925c5d3f045499e4d80d299
SHA1	ad78c063d87590cd67e3ce688463b517034cb08c
SHA256	d4139f448ca5cbcbae193e73033201ac5f11060f45c8a021065eaac31e18bed7
SSDeep	24:hKM5DkzskMr3Np2FbUDpaIilIB7E2bFjvl5IPvjsPt/bytSQWK2:rDk44odxilIu2bFhGPvIPt/bod2

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\OGRcAwhxVhr5uaOlpptg.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\OGRcAwhxVhr5uaOlpptg.lnk (Modified File)
Mime Type	application/octet-stream
File Size	1.00 KB
MD5	1ec205d0f0b63385e8eec94880cf6381
SHA1	f1d5e05fc011e950e01518e42cc41812dbf9f824
SHA256	21ace97d457d4a5cdf5e66828a1d7f08514af5b38684146411103b3aa6d61ba0
SSDeep	24:Sy7e6Dm0mq18eRiTYN2H17fB5/Ga4ua+wdn3f2UazE4M:BeuyI8e0TBloVP2Uaz+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\PfT_29aBkkq.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\PfT_29aBkkq.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.68 KB
MD5	9aa6eb9f464d5239742af086b313b1a3
SHA1	57dc7f2b2c5bcfadf3ae57cbfdaefc6e2f61c7a5
SHA256	7fb42ff400830f2d9ba9064da68b98a37d63793983f8ba58f81eb7b59881f105
SSDeep	48:yuWzsHGnYE9FTRbgKoyZnMJec58er570T4N9yH9C0MyJydCW/G4/9Y6lHdjZ1jeZ:yuWzrYEL3rZMJRtrmk29Cny8dCG97hdo

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\pp2-cOmu2l2wp3nZR.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\pp2-cOmu2l2wp3nZR.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.63 KB
MD5	4dd7db6573f4b06f440d5e5f467d6029
SHA1	e74803b4ba1fe37674fa118cc28edbf8b17987dc
SHA256	cbd4fd140f6563219044a13c36338fb5c4a02acde0cc794f5bb0e105c39750d7
SSDeep	48:qKmgfZorx4wjZhihr+cApKyUnho3WRC25qW2JSFpyeSfbtzcy:YgfyV4wjPTcQFUn2N2A6PCx

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\QYrNt_.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\QYrNt_.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.00 KB
MD5	42981a61e07ab9fb51ac33bf5508cbe4
SHA1	15dc1f77bd24fd7c70525d3a8cc6876476b12b4f
SHA256	9363a1bba1d37aaf13a6f5ff941211de1afcc2777c45c1680cf72d8d535a833b
SSDeep	96:7jvRCfjdqEpprmuo0cBmTwQaRuHZBrJwWfsKQlOvG2cbXULo8sPd2:7LRCfjdhpK2cfRu5BVhE1d2cbZhPI

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\RfWBl.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\RfWBl.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.67 KB
MD5	1158c609f4d5722b791a6da12a518bdb
SHA1	ec1cb617c336cb2fb9a973aeb65193041f4c0a0c
SHA256	cd4bc1272357c8406589d81ce4f7b8bcb0fde24830459044ec43de9765005baa
SSDeep	96:en+tHL2ccuTEQ/M07R5JJup7NIn40UsFlvx+SLRX+:t6cbN/MabIi40JRX+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Roaming.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Roaming.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	771 bytes
MD5	d1fb252e563b4e0a7c3f8491d8475abf
SHA1	62ae1262531a77276d2a7cde8cb0af8f7c99a0ee
SHA256	e8e6dc2bb96bf545d5e3891b98cb944e93ea290c6387d17175bd2fe241af9066
SSDeep	24:q/UeqhSc0UekOU11eLlXxCmSgFEGXakBo8D:oYH+U114lX2C7

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\RpdwIZgl7_.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\RpdwIZgl7_.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.41 KB
MD5	06faa4300b26d69e1f83034d105a6c03
SHA1	eff0864d0d5dba99139a4d0c9e15ba46411085a5
SHA256	04782f9492aa909793d1718eaa1f78b0fea67d6347b8e8d0ea895a58572ab6a6
SSDeep	48:/nzHJ7A/1yfJL54Y/I2ThSlz52ElmHIWxJGTi7yucqg2/FI1F+cH+Qa8:BAtUJOYQ5Gr7Gw/XceQa8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\rQP15tFZwPwBe-xpD8mB.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\rQP15tFZwPwBe-xpD8mB.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.45 KB
MD5	92a92f2fc86281442dd7836ebc6589c6
SHA1	d604bdf761de9b71ecac89bbad5d8c7d71dc3bc3
SHA256	b045eacbea77e69915f90f9e75efd34fb87902f3f73420867008838e818d042e
SSDeep	48:Yb2e8YoomXJ/MvR4O74ElqGcnXRW9Te94X9ivpiFl4I3oDUd3o7bBIHI+tBNsbCE:YaeJFGhMvRr3wuE4NWFI3oDUeKHwmJmz

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Ryd7aiOIUUjfakeRLt.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Ryd7aiOIUUjfakeRLt.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.76 KB
MD5	6747156943870423cb74947437394b29
SHA1	bd7a8e59edf9e33e49e9ba8109ffc5ea49314cbd
SHA256	027f838f7dbd3181a98e2e6b595d8b790a9e30f19e4931da6beae2400e88e8f9
SSDeep	96:h44PzEdNOkXpv7sEWf7MBbpvbXJ9gqqYiZiQfCo+HYPlncwh:rPzWNOkRgEigbVOYiZiQqDYtncA

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\sMK-BdQ8kydKz0.mkv.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\sMK-BdQ8kydKz0.mkv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	1.01 KB
MD5	b00acbbebfeae204eb0e1b91d17d24b8
SHA1	dc927cc14bbe81c031667ca48aca91a3d737eaba
SHA256	479b3d5b3c2dc38514934178b783755114850fced8fdc76c3cd7f0bde23f11ad
SSDeep	24:spfwsAkDhxwNr4cqlPvTHMgmxr1CcKNX16JRjhCQx4FQxn8:sp7AkDhxwN0c437aPl9jd8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\sn5vakIDi6gvvQd 6.flv.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\sn5vakIDi6gvvQd 6.flv.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.54 KB
MD5	bac90c42134b6171a279072c190c5b24
SHA1	01f97e8b171d6450a9aafcae183eb33559483796
SHA256	d985b1c89981bbb3a1cf15544dc3ba8dc96ee3cda0bd7a9c5e73815b26c7273c
SSDeep	48:uT9CZNk+1DoNBIC4JZF+zLanrwbCAEWXh/kcDduB+alUV7N:u5CZN9po7ICsZFcunsb4uzZuZ0N

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\SWxPvncg.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\SWxPvncg.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.71 KB
MD5	2a5024c260e0db4ef3bd673d696b0dd9
SHA1	466d6f5fc649402f9d2cf0650ed6528c7c85d79e
SHA256	b43ec807a25d6b462c1a25d0268c22325b341d386fef6a341dc7bd5628bd129e
SSDeep	96:xjgCK8f5Lntw23a/EaVSXgmuNiDm0+X/82I2YyrwzX6j:67rwa/E0rSDmpJI2Nwr4

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\T1wMLVSOJ3WHBc5IDz.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\T1wMLVSOJ3WHBc5IDz.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.20 KB
MD5	c1c6ddcd3006d47ebd3164e3f8faa7fb
SHA1	36c579efc8d309ecc4a189f2de5686df37e48f67
SHA256	a67510036eb7b31a5517009af78a4f480e34011d370da7bfb8ad058139f76a8b
SSDeep	96:H810d46LdWQeQ4gmVu43fpCI9ImS9Ockwp9a6/ycSL6gsTG1EuMzIXkS3UXOCn:HA0NA1ZVu4vpCI9DSrkwXa6/BSL63HGA

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\T3ly_ORHtP2pYU8ne7X.flv.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\T3ly_ORHtP2pYU8ne7X.flv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	f6cba27a113d01afee13465b47b1d4d3
SHA1	f3d2619688587c30321b9da31365927818d0d4c4
SHA256	0c8a8212664f5e1529313c9627254e48e5e19ce5931fc4d923a7f1db36c0d4be
SSDeep	24:XI5PqBe0Nd1DgJ3bLMCuoATtq3tKvvI7+rNQfY6z6RQXUS4Oz:XMIPDgNocAtaK8+x76WRYVp

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\thwDny9tMpkljL.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\thwDny9tMpkljL.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.44 KB
MD5	7256ab302ecab19b3b33acc3962ecef1
SHA1	bc41c43cddf49c959a57870bfcc79b15529fd27f
SHA256	299892bdfd1a1f1d410b32075999c15733ecdee5ed27c1803c0410d7855ea83e
SSDeep	48:Y/nxtj+5j8LVom0C0Elj2UCildZsUVT2KMb7Fpd2K3A/qxvnwOdYqevW:MnxtjSj8Jj0C0BUrZFViF3Ybuvnz5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\tsg7m_edB5q-IyPB_Uz.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\tsg7m_edB5q-IyPB_Uz.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.62 KB
MD5	be0f3bb167e3b6ca4a4e83568a206bdd
SHA1	1de043d5077e6bf3c9b99170f03a7b2870eedef4
SHA256	a1976ed4fe61f75ffcd0f34924931f9796b239464c7555120264bc79a309e4a3
SSDeep	48:alo5ByyWE5v2/53/g8Ns96vFtEjWXz4WJm6HInUYcY:fth+h3YQLtVXz4WJroUYN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\tujdUs.flv.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\tujdUs.flv.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.54 KB
MD5	60ae4425296586519133bf32ffc235a2
SHA1	015fb321df29a1e26301eb7b8bf74d8a73916f1c
SHA256	ce5ac19173d8b23349921579cae2d4ce44826f477b69fc07d12b38ca4427b56a
SSDeep	96:bSDk+YBg2hXJDfCXrLop7AN+XArxRkyU81lwa:mDMga5DaXrEOIXA7dOa

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\tVb2C4KAiQm_.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\tVb2C4KAiQm_.lnk (Modified File)
Mime Type	application/octet-stream
File Size	589 bytes
MD5	d02aff003a35bcc1c1f4613aab544c44
SHA1	83237f539c362c250839895beeae3a8123b3eef3
SHA256	e9ea518aca465d2db1d9a1b3a873203e75786c8a0c9153cab0d061ed3540780b
SSDeep	12:6GXvH/NVZPP1777zWsJ0CNmLFTSKCPlzA8WTYW76dsr+Mbv+jV:6GX9p8JxS1ldVo+MbvIV

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\uqXgy7 qD9ZrbV_ur.ots.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\uqXgy7 qD9ZrbV_ur.ots.lnk (Modified File)
Mime Type	application/octet-stream
File Size	1.02 KB
MD5	37b400a277ebf468acb9b5e59e6624e3
SHA1	08c6553f1d2b1f93c52539496506bfa52ae82442
SHA256	cbc6d951e7b55b00ec6805512473d024fe94cdef80e700c9f5c2dafcd41a6276
SSDeep	24:oXlOku6U4dTTXan3+BaHG70YnyI7c5xTtdC4jEEt+MFLtJi:o1gDUTKtYnFcPJ04jEwLi

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\UU WaPfo-9Vt J3.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\UU WaPfo-9Vt J3.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.60 KB
MD5	e08b5cc5732c9882e07bb6a26c5a7265
SHA1	dcbf858779745642e0ec4b31996522dafb2a7ce6
SHA256	8ddae4bcf8c3eaf0781df44da8ca8375a5903f712b0237f99d1ec90f2e9681f9
SSDeep	48:GE5F0nMgUhMMHiHj2dXSf0vfYSYtGaFw8y2C57XWHTZ7kvH1mMyFI5tJW:Gm0nMnGMJYUyQau8y2C57XWWvEMyFI5W

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\vB-uMh7aVn8iO-cSyY.mkv.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\vB-uMh7aVn8iO-cSyY.mkv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	cee71fefe01165519f92ab068f25ca88
SHA1	b8d57a284de83b62094b10a0d43c3a606741c8bd
SHA256	89438b0a13cd037464b07f0bade8e7e55eb386bf1dc6cf32fafee25c09c2a608
SSDeep	24:kSQH7SegfAOjmI8R+c+8pkkGfnOctZGFxXqOtkWG2t:kjHHgY6mVMc+MkkGfnbZkxaOtkWGs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\v_FG7ud1BH-KZPy09.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\v_FG7ud1BH-KZPy09.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.82 KB
MD5	9dd082ec96ccfaa742fc44fffb1e5a11
SHA1	d7da67ca5eea648508a956e50e56554d1a1f3388
SHA256	1dad58f7bbf5b5ce90c182722c666bc762aad1f6b49f0d1eab2382162b02b1d5
SSDeep	96:wRCj7dk59GzyX95V/ztOmV/hVrCmWk0QYu99O2SfI+:wRcdk7JDpppFCxkkAsg+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\V_J Zwq52Ighi.flv.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\V_J Zwq52Ighi.flv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.00 KB
MD5	d6f16a677a804386372cacc7167baa79
SHA1	8c08324d138d24bd915e0b83e5e02eb44c8e12cf
SHA256	6f19c2cd2846f6711641bddfcf753c335e09a9a4c5b265af805cc562c1c945a5
SSDeep	96:fxrqgxf+iNSc8t0f2PY9VFt56Mg9JTRmI5mumRv3+NKDu9shKBwF/RS:Bqgxfp/F9d5bg9lRmI5n6VIsh4wF/I

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\xVrbOB.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\xVrbOB.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.71 KB
MD5	a62b2179304c053090b2d85ba4a3135d
SHA1	06bd23e78b565e595667dc8d5379f6765dfec237
SHA256	07a16515628e2660a5dea8513826c81245c40bd004b2c36706c041cedcaf458c
SSDeep	96:mdGR31VTHnoDcjr8FDVHGhLXTzNbCQGWHYtI:q+oDc0FhHGhpCe4I

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\yTrX8T6qEOaWaHd93_.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\yTrX8T6qEOaWaHd93_.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	8788100cb751740249fd8c87b97063ed
SHA1	01a8f92230d6e74cfe48d24167ebec53944a7a43
SHA256	96efe8494dacba864a04592dcad4d8bb87b5b128cf0636cff0393bd240da53a9
SSDeep	48:sLechVo7ZI613RTD4ZikoVLQVon8/GZEcrd/pPh29pXbFVhfVS6/mcJzasUw:QeEehpZ10VoncGZEAxgXpkNsv

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\yZ_qbMH0dwR hFM992.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\yZ_qbMH0dwR hFM992.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.76 KB
MD5	fd928273e31000dc5b19f1387f5d9125
SHA1	761474cecc1d7a19fd4db1222158a7e281f4bd86
SHA256	e33fef10cba996af613ea06ffe42aa1eb22f51824236e9a6a20c3e3798fd7a01
SSDeep	96:/g1v5uwr8EhgAr0utoIq2hEUfiaYt+/hI1eRreT6FqzQ:/g1v5p8Q7r0uCIqWi7yjRreTR8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\zFyDIL2q.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\zFyDIL2q.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.05 KB
MD5	60d51221b078e87b2de8403f9cf82f18
SHA1	2ac9765778ccdec7ab29f24d98a5daeb8a38abac
SHA256	2bb0fc764d4714b237568d7fdcaa67325f86798ad471554ee4dae34bb5e79792
SSDeep	96:ta5EOP5HmQudjF4lwsTjzGcMxUNKPeJeck0ZCAbKRwwJ2Ksz+28VoDf1n:taN5FlwsTjzHp90sKRvwIVoD1

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\zGvXwHlK4-1z.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\zGvXwHlK4-1z.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.70 KB
MD5	81dffa8d417ee916bad573d0201f5cf7
SHA1	3c3805c62e14381ddc9712ea4eddd9a9afa1ed4f
SHA256	87a8a197486877ab2164845043bd79f99e3da45d3ded26e63f68a066e2fa14d4
SSDeep	96:29+gs6RmsCI+TST8D/+ZfVIqyJR6qNY0lNx:20gsGmtImc8I9JyJR650T

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ZroSs UxTGYvhkTzvhb.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ZroSs UxTGYvhkTzvhb.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.62 KB
MD5	b56a17771c41735f27e0252398e853eb
SHA1	9f66f77c96fc87e3e85279475ca0e91fddea789c
SHA256	3c62da94f1eadc2dfce60721b15d041c321a8aade535b63c10b9d4a537882c25
SSDeep	48:rn7RXO+9sTDTmKywv5Y2v31cJKboZiUN7otMKsTGyzNG+2mlZPYDJQso6X4huKCg:rdXO+9sT+KyJ231Yqg74sTRqCc4huKLt

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\_DBoxYrZjyO.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\_DBoxYrZjyO.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.68 KB
MD5	35321a0d9b340c6c2faa171466c2ed2b
SHA1	e902b75452a5d91bcc1a8e23fb570122d31a80d3
SHA256	bb12e62225f11afb405b23412cdde9edf93087ed0c10c30b06e6d897323e8077
SSDeep	96:lHTCDnCwmOZp/+MQZW9GDwvoiu2If2SF5yu8oL:lzIjZdQZW9Gb2If2SF5yuTL

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\_i1E0MyIa7bKl4brAwby.ots.lnk.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\_i1E0MyIa7bKl4brAwby.ots.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.14 KB
MD5	cceec8581e303c6704801164ac35a4b8
SHA1	6894f334cbec0d54b105dcf157a9427f101a6730
SHA256	31452ad504c9d78b83b0bf46b074b2ce698f258d8fbd1d1f2f4db431574b7767
SSDeep	96:YCplxmiZCLwJxtJLeDpUpslrPEemTVDme4NM11f4HF7M0GpEtXlzG9rMkXE2UH3:jmiZmkZNp4PEzYNM11f8YpsXlzG9rMkU

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\_We7 IhKAkd3i.lnk

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\_We7 IhKAkd3i.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	594 bytes
MD5	f42a3d211ada032298a80ab309860cf9
SHA1	99d65e64bdb2c2f571fbe688b301ea78957ed8a7
SHA256	c9ccef3379aab7f06a93fe4a9b1aeac1d376e9cf7146f3248393616ec538d3ce
SSDeep	12:3FVX1SKyulDMouDW3S8fafVGGl2uRH+MIobdY6CqtLYP0u:PX15yuN55C80VWO+MfBruP0u

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\RAwb Q.png

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\RAwb Q.png.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	4.60 KB
MD5	d569982e6c7b02c05d03c58fe9f529a2
SHA1	e1c10c1d6d5dbdecf5c98955fd9564e28f08b3bc
SHA256	4b85a5872998815d551b845942dc40e4d9bea1d6ed9d47a9bfc1409daeb34809
SSDeep	96:iF7rIFdTujoHQY2jgSYkeH2ZHsVxNLqA/SD+HZBG0PU3tkPraqj:wQ/ujoH0s0eHwifqA/Sq5BQle

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\2hc0nLdqeXfTqNl\lD4T0jw2Q6.jpg.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\2hc0nLdqeXfTqNl\lD4T0jw2Q6.jpg (Modified File)
Mime Type	application/octet-stream
File Size	57.78 KB
MD5	14fb3548a9d9210b3a18d5685dcb8fd2
SHA1	df788487d3b576d4b50fc7095f929c6348ccd80d
SHA256	e60adf843ecd76695521bfaf01b25e0dd2e210c144038f723333d4d6f80e4edc
SSDeep	1536:zYQWm15zxhZH4Hx07tSqhelvhcXPeNX60:zOmhrArqqaPN0

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\GSlIX-wE3J\JZ8ftz1nduVAZau6pD1J.bmp

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\GSlIX-wE3J\JZ8ftz1nduVAZau6pD1J.bmp.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	60.42 KB
MD5	22d4b6b93b27e92ba7df0ba8db54d431
SHA1	0af4638e96aa8dc6bdf846559e56b99e1682023a
SHA256	a4a7218eca159db3b7874d4a9a669fe7e05e71f67edbf8d67b3e52b1cfff43b3
SSDeep	1536:XubDoJqNDX/Ow+VCJyQm0S8mcDyhrEtBIGB6bcV1VyuOE:GU0N/wV9+S8g6BIm6oVAE

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\GSlIX-wE3J\ucQXAw25ykhb0B5VMNx.gif

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\GSlIX-wE3J\ucQXAw25ykhb0B5VMNx.gif.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	51.80 KB
MD5	f206d9f0266479e9543fc5fe8196d51b
SHA1	1a141a5baf4122e3b07dee02896013bb431971b5
SHA256	dba8153dba1dbd917d735f6749dfbe1a7b8453944c173c4adb80c9efdbd5669b
SSDeep	1536:/hY57QzPM1LEsQyyejviFJUF0YUGSOjXb53S/2:LDMOebAvUXQu

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\908--r3sgGXaQQ.jpg

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\908--r3sgGXaQQ.jpg.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	34.62 KB
MD5	e25130267128f2bbb22996d4ef9c2d42
SHA1	0ecdc992f9deecd819843f17da91d8f51aaacb76
SHA256	ee33671651063e972613f4ee70650712c19692f4ff1a2402121f343638a9cc0f
SSDeep	768:BKw7b5Dtd5wei8HwmGe4P/MbLUG+cwj6o1KUWeEwBM5qIgu:BKwxxlFHQ9MbLUG+cwl1Kbfiu

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\R9 umVY3s S.png.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\R9 umVY3s S.png (Modified File)
Mime Type	application/octet-stream
File Size	41.50 KB
MD5	b1d5370b5c505a51df8057bfca283b10
SHA1	4d13a445e6bfd2ec8e937c59c20b73b5c2962402
SHA256	17901267f823999340996ee5fa02018e9129db4669d0a3dab744643f74e8080f
SSDeep	768:qrQ24fE3L8/Hr448kQXJ5BwwVArncw6U/5JgrUTibi2K5kO:2Q24W4/HkGQZ5GqkBTxoUWbckO

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\RfWBl.bmp

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\RfWBl.bmp.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	39.29 KB
MD5	8586ba11aa17a876caac0bd15b2c7094
SHA1	c712224250c95ffea14b6b3d4477d9b49873c1d7
SHA256	6ab5351aa451bf046ab46cbba8cc402465477f33cb3a3601936459bf4ff953e5
SSDeep	768:z0Y4Gt1eKeAWJronSMfDEc/XIJxs39TJfOIvwv0g0wG3hgGpA8MqEy:oY4gw5aScoc/XSq9xoN0TfpA8Mqv

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\SWxPvncg.jpg.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\SWxPvncg.jpg (Modified File)
Mime Type	application/octet-stream
File Size	24.00 KB
MD5	223a72f770579881bd20fc24b232aeed
SHA1	e0b3507c3b893427991226e7410b16489bd941dd
SHA256	750f666bee91d0761b6f4ad7c82bad33a5a4761df0faff119cbabdeedcb1de99
SSDeep	384:K9Bz9ea5fsPFA33T118twQ/iyM+MctUhUmIO4sDD5SNVF1X5ZNU5OeQpLL:mzVkw3TIwQ/VfJMya5stX5ZNUczLL

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\thwDny9tMpkljL\b7r81_Scu_.jpg

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\thwDny9tMpkljL\b7r81_Scu_.jpg.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	92.13 KB
MD5	59f510dfce0cfd20cd99e5b476fdf8b9
SHA1	ee4e5c1c5d17bf46cbe5f9e5f9770e9599d2c42f
SHA256	992d098b68ceec22cf50d13b09ba5cf318d819be01039630169596a3092a9e40
SSDeep	1536:70iMOR/hj8+haWn1hKhQt7tE1KcYBjNWuOwgM6jjkduFAN7D0GzUUJwaosn59XVu:70iMOR5jNha8KhQt7HN8QW4uElUUCQ5u

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zAupK0t\kgYaSl_t9.gif

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zAupK0t\kgYaSl_t9.gif.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	96.54 KB
MD5	fef86ff7b259c0fb0144dac5cddf7fc7
SHA1	63cf2081927646dcaae38ab064df07cbaf4e6468
SHA256	28f9c003106af3c08458b1298ab843c912b21724ee03998df6c451d204d21f3a
SSDeep	3072:8bpU+TxEE+RzHTy3JwbcFCKgrTjmlJgyv1SG:iU+TxEE+RDAwczQmT5d

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zAupK0t\Ryd7aiOIUUjfakeRLt.png.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zAupK0t\Ryd7aiOIUUjfakeRLt.png (Modified File)
Mime Type	application/octet-stream
File Size	10.77 KB
MD5	32d93f7b5a74ded9e1a071d7b13b6790
SHA1	f18998c0ed470b1bc762313256a6b7392f8e96c3
SHA256	36e56b6dc4957c6a4a1071bf46d4c43b843a5c53fc56dd12ddc2e2ea5b432499
SSDeep	192:T3CmhI8fEvjGKiqQm6slwjhcOPo2o8iy0uKS+HQg88qMJQOf3VYBFIO:+0emm6UChfofE0bvNHHMIO

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zAupK0t\yZ_qbMH0dwR hFM992.gif.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zAupK0t\yZ_qbMH0dwR hFM992.gif (Modified File)
Mime Type	application/octet-stream
File Size	52.50 KB
MD5	5c5a7b8312d00b865ee26dcccb51ca55
SHA1	9ed3db1f55d8db1635ae2b2f5fbed5dc7c7f4a0c
SHA256	b5926ee039f739e0e18cb30fc145ea87232163d6357b15852917a8dcd5d1cd50
SSDeep	1536:J4FBGXnSMTeT/C6gnfNmu8gf5TmyIXQjci6XYKVYn9Hc:2F8iM6T/AfsMZjyUQXTYq

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zAupK0t\_DBoxYrZjyO.gif.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zAupK0t\_DBoxYrZjyO.gif (Modified File)
Mime Type	application/octet-stream
File Size	13.96 KB
MD5	25e77f5746710efafd7cecb22f5a2cf4
SHA1	026e3c103554ba62c183d93b3e40689670cda7a8
SHA256	21c68b395f47a7387215cd878e9adc4a859eea4124dae7e1208c3cbc50e473ae
SSDeep	384:CwTPrUUIKTgWA/J0cuzqLSk/tS4NVW6uY:CwTRIK8WkWxzeSJ4B9

C:\Users\5p5NrGJn0jS HALPmcxz\Music\-qsMQ8oIACs5c5i5Ui.mp3

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\-qsMQ8oIACs5c5i5Ui.mp3.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	93.36 KB
MD5	87491428dac8fb31ca1111a956f6d368
SHA1	7664e1763230f3e552855accfe4b9255cb37b7f3
SHA256	b6740a311993927666775d0ffee952d3adfc5cef82877f2effe6ba1b4692a4ed
SSDeep	1536:3TBjFc4fLfsW5DsyaEIpkKicsRm0xYmvkhRhLKmQ7/aY4jjsUrvgu/j+pYbsReaq:NhzjE+syDIpkKiLM0imvpmQlOzb//sRG

C:\Users\5p5NrGJn0jS HALPmcxz\Music\5jp0nTVZcIPwKdnvx6.mp3

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\5jp0nTVZcIPwKdnvx6.mp3.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	69.17 KB
MD5	679bba7f95304703a2131ad145a1492d
SHA1	e7b836a3791e940e1ad3a0038c709fdfe65ec8b2
SHA256	9b57303551997e35d4981ae8ef8c04653a04505a4904ee9454280a4904a4a1ed
SSDeep	1536:FpBbrfmcAJmrHbKn2EntgtQ4JZakC8YSrf2TGh3G6q5hg+t0b1Y80Pp+ZO:FpBbr8KU26OQ8ZrnrfE4W7dtqYxGO

C:\Users\5p5NrGJn0jS HALPmcxz\Music\82dvFSVj1i4MetTL.wav

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\82dvFSVj1i4MetTL.wav.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	88.88 KB
MD5	1ac919c7ad97ef943ce17466eac97c86
SHA1	362f0f13a9d3196cfefb8ac44175b1a02b540ac2
SHA256	b0b715278b80f867addf54921dd0225170356d6e93b3ae4178e0523bf61c829b
SSDeep	1536:BlRXXfw5BGjPdI4wbW1Qj08BdY55zbx9AneCsIi3IdPShhwLUhYbQ9il:BlJ3mboQRdazbxOeCzi3YPSLwU4Qsl

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Ed YmmgXUPEE0QtKMw.wav.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Ed YmmgXUPEE0QtKMw.wav (Modified File)
Mime Type	application/octet-stream
File Size	41.27 KB
MD5	24fe072c5cb04294cd7a3ecb713b1952
SHA1	6a975aa28d4501a05f9d46abf537622ee14673c3
SHA256	aabeb4e3171332005cd55d425f83c7f2133e3a6c212b906a0d832119721d8751
SSDeep	768:GbQMNQ23eEkhg8OjnFn07RZ7tkeG9F8UTTI1AbSztrZICproce:GbQ723Bog8OjncRdtkNRT013ztrc

C:\Users\5p5NrGJn0jS HALPmcxz\Music\FMsp.mp3

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\FMsp.mp3.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	18.37 KB
MD5	81533b1bc99660213c2b3a5ec20b289f
SHA1	128899b9e98d221e2a70ff4c8f5bd8673f611cf8
SHA256	dd812bbfef416993437592728802a664b017e59fc001cc5c69ad4a52706c6cbb
SSDeep	384:+rJsaeTr49O2zgt/X39BmjPakvUKABS+Yeo3LNffa4S20Y7HY4:+rJsxI9OggRn9ZkMOygLNKQ0it

C:\Users\5p5NrGJn0jS HALPmcxz\Music\8mJLvTqgcpH-zx5\R6O_-2m.mp3.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\8mJLvTqgcpH-zx5\R6O_-2m.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	88.39 KB
MD5	62126275e295dcf7650d8127e499b172
SHA1	5485746388dc10e9cc096471a7fb3493284e0bed
SHA256	62207b80d350f9db0f23ae1185e4efe1ab154ec1839dbf02216ea01f9b0c9bb8
SSDeep	1536:jbj4rMtksw0xT2C+N/gL4fI1rdiQHHmTLtdnhpkuNvsU4zs5Bb0vn9sgrJvVqTYy:XsMtkr0xTdOZwVdBGTRjpkuts5zsvk9I

C:\Users\5p5NrGJn0jS HALPmcxz\Music\8mJLvTqgcpH-zx5\TdxPn0J.wav

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\8mJLvTqgcpH-zx5\TdxPn0J.wav.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	10.54 KB
MD5	aece6192abe032e93adef1e1009cad62
SHA1	3a817ea921207881711fb2083909f39866cc5de9
SHA256	6fe82cf149d477505f7c8aa2a87197a1895363409fc01201d082f3d9e5100773
SSDeep	192:boTIJEOSCDgILNOEIjl+cZs/nX7Qythf+EJEFYbTBPSvJX9TflZTOCM8:EISD25IR+cZy7QytxEq5Sl5XTOCM8

C:\Users\5p5NrGJn0jS HALPmcxz\Music\8mJLvTqgcpH-zx5\zWKyoNetE\Alu-gLjTHy0.wav.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\8mJLvTqgcpH-zx5\zWKyoNetE\Alu-gLjTHy0.wav (Modified File)
Mime Type	application/octet-stream
File Size	52.33 KB
MD5	4cb95a1f6a07f37dc4e5511593cbba62
SHA1	b092b91c15366fc7b7740c983c9fe66aeae6ceba
SHA256	2fb0333791559736ea54f4da7c951e9235a40b06ac43c196da17212f5c852824
SSDeep	1536:EYAsSZkbXtX96qic/uRFCRSjsrK4lIEoRD8Q:rAsJbX3XwT4IDB

C:\Users\5p5NrGJn0jS HALPmcxz\Music\8mJLvTqgcpH-zx5\zWKyoNetE\S4QDLec4ri6xhS-e7xZx.mp3.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\8mJLvTqgcpH-zx5\zWKyoNetE\S4QDLec4ri6xhS-e7xZx.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	81.65 KB
MD5	c838438cf2541c0bb98fcbafda973cad
SHA1	0977ba582c1429db1125686a408fe75b4c7de089
SHA256	26a3804bfac2f212741c4a4b365f96c33919226e60483ca8fd3105c0fa1968ee
SSDeep	1536:AAXGY8ZpOrdnw35i649BpiRPiZIivXHtyIRDYXhGvSqKTu:AAXGPy5nw8v4sZlXNzRDMTu

C:\Users\5p5NrGJn0jS HALPmcxz\Music\8mJLvTqgcpH-zx5\zWKyoNetE\Xa6dqDXAiBT.mp3.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\8mJLvTqgcpH-zx5\zWKyoNetE\Xa6dqDXAiBT.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	94.31 KB
MD5	09deef701f36ce7e0adf7852e84472c2
SHA1	4869c844eaecb9fb3410f1befc210681e71185ca
SHA256	d897a5dd72d89eb1b4ec092165d8f2fb53efe71ddbd189a2f7d73ccb44f14107
SSDeep	1536:NKL+xnJGYdjpEQMV4ndCff/gd0FwOAk9w6jx5306qFShcP8QVpwoGVAttLTv2O1J:aanJG0jplMVy8HIdQwl6YfFSG8FoEWLL

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\9 PusT_xUl8yxwQc5.wav

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\9 PusT_xUl8yxwQc5.wav.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	13.50 KB
MD5	7f21c0a7ce2d46fba822ce83d2af0ad5
SHA1	59342a7207e23af32ee937e5d7fc795f0c69c70c
SHA256	2b1c7c7739fa5290e4a7b8fd06a304231cd7b35d235a911a71da663369265444
SSDeep	384:oshgF8oWtr+IALYdzORnLZVH0sC3/qesSLdap:1g6rynLf7C3/qeA

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\hZ8y9cVu_SLf7UwSI\2A0DLKOFhEu5rZhVLsaa.wav

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\hZ8y9cVu_SLf7UwSI\2A0DLKOFhEu5rZhVLsaa.wav.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	24.56 KB
MD5	450b81c79ca9de0a4c84c9b29372aa17
SHA1	3ee5d267b6a6f357d83a376cb75e5e07887a6fba
SHA256	6043dfe6ec0c3d3d5db2ab355f194d55b8bbf78e85ea2acb03aa83d30ec28e63
SSDeep	384:03c2+eS0ioBGLD603I4QNn+ISAVv+KpF6Xuv1HREGPt1aRwRdHkYT0Na5v:03cES0pG6Cm+IfVv+nXuNHv9dHkYT0NG

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\hZ8y9cVu_SLf7UwSI\5j3T.wav

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\hZ8y9cVu_SLf7UwSI\5j3T.wav.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	78.02 KB
MD5	53b3bb21fb0e1fe60587bd6819364fea
SHA1	969a071f8cd58acbe2b1cc4a1acee4bbdb030273
SHA256	2c298f2928bc175ad2cefcbd5d4d128f8f76febb6982ed06014741a8e0278ff0
SSDeep	1536:rPMBn4ypsv4npDLRou9BLew63nAIkzBMXtrFmZjumbJmSlgGx9lOJ92h:AB4y6QpxfIXANdIjmZjj/1xy72h

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\hZ8y9cVu_SLf7UwSI\HqV0pMbvvY.mp3

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\hZ8y9cVu_SLf7UwSI\HqV0pMbvvY.mp3.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	52.04 KB
MD5	a72231fb8afa676df128b12797c5fb8e
SHA1	4304cf12ab23dc4b1eb250b96bd5d576a1c1a49f
SHA256	d6bf63f5841bddc727b14e84980a3b17e9ee788f1ee88cc94c641e7ca939d5af
SSDeep	1536:a2fXUkloyvuWkIwoHlA1MNuIIMOQ6szBgq:aKUs7vuWk5oHlwMNtlOY1D

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\OJ6PNr\b4gt1wUJEZj.wav

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\OJ6PNr\b4gt1wUJEZj.wav.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	22.32 KB
MD5	45956509cf13b4f23c8e5cad6f564e0b
SHA1	aeb0fd0b4071edc3544f3da3dcc027cc1c803554
SHA256	569e1a73b75e538adad3670c2f75a97db15ff127a2b5a03d8305bf7bbf18d970
SSDeep	384:T9aEkD+0NRIMQsYDp9+9mFPODHnB/kQmd6vfvyv2AgJpGr5s9pdIWoE017YC:T9aEkrhgD3+9kA/pDFJw5DNND

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\OJ6PNr\mA9-.mp3

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\OJ6PNr\mA9-.mp3.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	82.05 KB
MD5	b0f7969f215a8813abd7847a5ac44dea
SHA1	b5d5a4f75708b1bce417c808dcdfde12f6d051c3
SHA256	55a53f0897168c72d41518e1ab0340534ea3ef968569f7e53de25a52c0e5f1a1
SSDeep	1536:Q8+jQvD8hPFAj9cUFz68UCqrxbvNQHAHb3cHLkOo/BGzR:Q8oyQRCjLJ6XxbYib0viw

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-vk7O.mp4.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-vk7O.mp4 (Modified File)
Mime Type	application/octet-stream
File Size	46.86 KB
MD5	5da5980cedd7c0f190fc04dfb9807f62
SHA1	fe57111dda9f7d2876e55de1dc2ca4065b1a2832
SHA256	2dcbb485597553e9ee7f8f75c00187c6c114a27f8b707ff5db2022f4fc10da89
SSDeep	768:hZv3jgQNOl+zo/vMsHDy2LfyBwEZD+gyQf23+rn8vCi/UCorsl6K0F0tXAwzbnFH:TLzNOsU/vMgGtZ6Bbur0CWl6K0Fm5bnN

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7KTLrr.avi.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7KTLrr.avi (Modified File)
Mime Type	application/octet-stream
File Size	54.51 KB
MD5	70ac42cbc6763f86bea7aacc8fdb7ae0
SHA1	d4d051f87de4771bef0305eb6e093bb3f597659a
SHA256	415ee21aa34cdcf2f3a0e957485f7dc6fb792ec123d5cbb0dbc3205ffd398d4f
SSDeep	768:lHlUQDaOHAafNAleUBSK2RAUUhQq87qpaGdYJzSIg1npgCMoGW0gDq9WdybtMWYa:l4PaTUBF8UhQqV0yc0q9WkbiLFbp6

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bNjaz.swf.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bNjaz.swf (Modified File)
Mime Type	application/octet-stream
File Size	72.72 KB
MD5	c1fe9709a6729e225027c11a49bc943b
SHA1	cb314a2e9b069b39c98811de5ab06503045c2c42
SHA256	d0f4607cecf0c3472aa930e2fcff068e13649bd8bfc58eeb807e8f40328b8c49
SSDeep	1536:IUjGS2G4Zp5HZBMp490iEhVa2Mr70iHLq3kSeVrPPRr6K/ywG+mf8bFj:IUj5GZp/Bi490JhV01LgoblZ/HO2j

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mn7dUzVEpT7myW.flv

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mn7dUzVEpT7myW.flv.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	55.90 KB
MD5	e8c05ec25713ef2cd6ccb7dd37477969
SHA1	e5c82e03d97b6e92efd72eabb4abe0a9ef6701a0
SHA256	e0a762b944d9fc6c1836f1dceb4ac1cffbf032fbedc56aff3c7ca9d81c9bb420
SSDeep	1536:/oe3FjgBYHrXZ7fEs4fX+fw3dtu6rYK1GijMtN:/oe3ZgBs+x/3dR1/MtN

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\eI7QTrX.flv

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\eI7QTrX.flv.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	20.95 KB
MD5	89226efd1fd0c5564bede149620c57e6
SHA1	d336adf1831bd4613803bad3bfbf1c5a70665b6d
SHA256	c7a94bb32d9a385a3292913a9c1df9f3a4a103a971b9bb925463dc0ca62d53c0
SSDeep	384:F6rF94TR1BMJj9ynkNvB393T4fhIeFDX+JjsGBzGHVb4SvqaJ1d7qQrW4b72:F6Z9WR4JjEk1xMhIMMgP182dq74W

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\gelf7T_E0h.mkv

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\gelf7T_E0h.mkv.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.45 KB
MD5	181da3035c42ef586a28131e73b31b02
SHA1	30a1734ac82d843ddc0d533cd18f3473f8a6c654
SHA256	f634c81e3b165f3dace6cdfe79e14536fbb5aed3d3c2039092f57c905846ccee
SSDeep	96:H6cS6g0ZNHA7wGbAQSZT8NkgyoHdxUqrwAc4VwPiXRacSB6vME4XbclUaNhaEjwg:H31DnGJSqVqqrbcgGbIcIxhxwg

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\JEKNUD R6LeQqq907mjy.mkv.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\JEKNUD R6LeQqq907mjy.mkv (Modified File)
Mime Type	application/octet-stream
File Size	55.03 KB
MD5	9785112b5e7b53d27fcb27d201a06324
SHA1	9d166d3aef1f307f3a808b7946697ac85dd728c7
SHA256	f45fa629b7605b76741ea6bbb7c3835a054d7bc768e37b5c171907d332d68008
SSDeep	768:jQ8lEGk8NIP7HSBLMUKly9zg4oEDc5CTQCYbyA3vFmX9deSAMAYW1Kz:E8SGNiORMSBg4okcYTQCYbyA/Y/fOkz

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\ol6zlcAm4.mkv

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\ol6zlcAm4.mkv.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	90.07 KB
MD5	3503363617716aa50927a1ca082331e7
SHA1	dca2b22b3e1fa7ff6acbfd730ae2816438d8d738
SHA256	87d99e6ea0598357b1c958ce1df9e1ad0dc092004ab05b06807b0d5627b91d0f
SSDeep	1536:QUPbDQIq4k7yidJVu+Pw6SJjSB7vRSYWsufxeVGrPl9vAHj1DdLz+gh9qMdHjF2:QKbDnMxdm6Sp+RfWXgVO2dHbXqMtjF2

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\rBVR.mkv

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\rBVR.mkv.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	54.35 KB
MD5	a575e2bc60ef1f26d99e6cb21108a1b9
SHA1	eb83c71f4e6f5ee3f91e7488c09db77dad0998e0
SHA256	4c57c6141d30718a12a4a15f8112baf49c94710caa56e520eba2047856f66f30
SSDeep	1536:xm2DLXvxMW1s+qlSE0WUduhxF5d7N9DCvI:TL/iWX0z5d/DQI

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\S7H dN43m9UROqOa-N.avi.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\S7H dN43m9UROqOa-N.avi (Modified File)
Mime Type	application/octet-stream
File Size	15.64 KB
MD5	aaf5341cc400b307ffbd121ee0bd8eb4
SHA1	e7bf999ec82a7901f506f49bf21d3bca4308f326
SHA256	cda254473e27549400ab3bb88e82dc2832e57ba4b6640752cf606a1ebd1ad855
SSDeep	384:tAY6wzWe3XPoKDTT2qg0YSvOThLvj3Igm5jr9dgSoXcBcFXZ:uYZqQ/HD2qg0XONLr3Igm5l2dcBkp

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\t6M5.flv

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\t6M5.flv.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	32.87 KB
MD5	15c80b688f00a388b65a54d49ac25809
SHA1	313c914827dcba65afb5443b031390dfb97be357
SHA256	5daf37054905035c06ee80bf520a5e6c148cb29456329d2429b7523a63d6b034
SSDeep	768:l4EkN2r+OyyRaxYBiBvrpRq7QWZORWpN+VewIH1usroiZ:ldkXOyyRaxYErpRUIWpN+q4sro4

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\tujdUs.flv.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\tujdUs.flv (Modified File)
Mime Type	application/octet-stream
File Size	14.30 KB
MD5	6428b3f1d6eb159e58e219b508eab0c2
SHA1	8ff6455d4ec04c389c9ef16ad828924f6ab39efa
SHA256	35c5a7dfa48f9ea7a6a168241b267b237fdf3a31a0f197b20fd9a1c68fc81e82
SSDeep	384:hF8POiEv/TmG2LedvsdGbkMD8DksKv57+vU2H+:P5CGyGDDwn+

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\UEfz0xncbCAxVBW_BJZV.mkv.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\UEfz0xncbCAxVBW_BJZV.mkv (Modified File)
Mime Type	application/octet-stream
File Size	88.70 KB
MD5	12478f8c62767a23717589b0f9f730be
SHA1	5129af53ccd073da5da21aa7da0022ef9a4db7ac
SHA256	172125a9daaa9e6fd3275e64832f0026b611bc201d9c604b04f090e522b6a7f1
SSDeep	1536:M1pxXRklqmqJErEPP68+/bjMdG8+CnMGQBW8l8iJQy5qDvkrdWMZ9:MfUlqmcwA68+/HZx98EQy5qQpL9

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\yJyNSGoNWgeIH.mp4.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\yJyNSGoNWgeIH.mp4 (Modified File)
Mime Type	application/octet-stream
File Size	57.51 KB
MD5	60f3370c9b6a77fd3dba168068e3de1b
SHA1	263b68059a902e38e268338456153cc8740e1220
SHA256	55b0f8d0dc004dafc5fb95edd5236b7f456af52acb0b271cd02df464a6ab2b9a
SSDeep	1536:o3UbX4zLDcY8Taz4s56xL9V/PI0l4sY7Z2CR3:oKX4HDc1cf56xphPHl4Z7Z1

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\5WmPRJ5suanW.mkv.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\5WmPRJ5suanW.mkv (Modified File)
Mime Type	application/octet-stream
File Size	43.13 KB
MD5	ed54e738383a6e6d38a9553120578d97
SHA1	420d745928e081addd1caa8ae3e3ffdac0b751b4
SHA256	5a8ec567853e596deef00877bee691bba8a547d06728fc2d7fe78d461e7a22c0
SSDeep	768:67j/BmC61CbvMm7OcwlRZXc3QI4AoByqlT94UUoVaFIgED+ccdWsXyPLY:aoPCbvPOnbZXKAACp4XoVaFIn+CjY

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\eBQGIu.mkv

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\eBQGIu.mkv.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	20.75 KB
MD5	61b3d50aaf6d9187f0d7cd6618a68ab9
SHA1	072eeb54a60f3794005c9c109a29cfd238be7af1
SHA256	1426d1fe93326c8bfd9fc75861412a194901c3a1af993e12ca5964af2ee79b28
SSDeep	384:D9hjLLK4VVzgBIw3CT3Z3NFFgonUZV14ry5p8RCuDrtCEItBTT:D77BgBI6CTVr2onwV14rRCunt2T

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\TVSIDkjkr9GfjtwR.swf.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\TVSIDkjkr9GfjtwR.swf (Modified File)
Mime Type	application/octet-stream
File Size	89.07 KB
MD5	9f5d3a7f89bcea4dfe90294cccfcf8bf
SHA1	2ce908d553f17eca455adbf8cc41a74d363a518d
SHA256	354500a4317f54bdca14764168224116aade733bb14d7b76b2e50508624a66a6
SSDeep	1536:kgiS2w3T/ghPcQ5Ul1NuFc/e86erwuQnEEqGvPi0Ovl4PgQ9:k1w3Lg7SNj/eZPnPX8v+4Q9

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\AalPBDgDSgBqLTp 4TZ\JPFZDi_iA.mkv

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\AalPBDgDSgBqLTp 4TZ\JPFZDi_iA.mkv.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	13.29 KB
MD5	af4f4e05ac0a9272180da9e5e44061e1
SHA1	4d717b93ee3800bca652be737a29b1357fc4a44d
SHA256	fa3bc4721e6184c7507a63474bae9b74040c9a70829421473ae9acce9e935258
SSDeep	384:A09urHyRCRZgSuqYwmW+E9kEoRchpTg0q:QrHaCRfuYgEqW6

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\AalPBDgDSgBqLTp 4TZ\Q-XQdp271EKlSpC.mkv.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\AalPBDgDSgBqLTp 4TZ\Q-XQdp271EKlSpC.mkv (Modified File)
Mime Type	application/octet-stream
File Size	11.66 KB
MD5	38e6fe6e60acdd80848e55593788fdd8
SHA1	135d3035f2508089eeb2bc297a32cb452db2ff3e
SHA256	17dfa28940090f4948517a5e832ad3ea9b1e0aba735a89c3edeb04a1b5b788b1
SSDeep	192:H130VXGfszIIDD5LoRBy9YaLLQzwy+Qie1IIHmJy3Yn1qB8OjWC:V30RGfTIDlLv9YaLiwy+Q9IlgIn1qBSC

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\304-.xls.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\304-.xls (Modified File)
Mime Type	application/octet-stream
File Size	18.58 KB
MD5	622126ad0845c7597a45b2b7e2649c19
SHA1	0b629698f1d5db1001b4505de9f219a71f53a7d8
SHA256	6ed808bb0199c9928bb98fd81abbee7c462a9e906dc787edf55cbc4887900338
SSDeep	384:/h9Pkdn4t908LoerVkH4tykc8SF0C1dokh4TyE3OFK3y6wTzt+qDoc:/h9Pk54ti8LH5w4tyclC1doj3UMuoqD3

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\75ATlPjUQW.docx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\75ATlPjUQW.docx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	50.28 KB
MD5	9bf6c7a2fdd94d23bb5685cc1e3e8989
SHA1	0262ccee1149bb15ffe10f69d46015a02999285e
SHA256	7452996576eb968606fff70dbaf69e970e671d30d7640e19712283f1c164b88a
SSDeep	1536:nRWJDPxzhJEdutIQBu1qVjrfySJZjVkfMlr3grxZjaZf:kdNBtI0u1qFHjVkfi3grxZm5

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\adim4yK7GC8JdG2.docx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\adim4yK7GC8JdG2.docx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	89.50 KB
MD5	1dd85d62ca6ec9c7a06a5024101c71ac
SHA1	4a7b7bc537d835cc49005611ebbdd845bf2ed667
SHA256	ebb74d0a33434dd1b54cd9b431c030ea83faa988dc50265e222631f48c369803
SSDeep	1536:AttrROKTfXbgEtPNXlEvTmeM1Z2ThHDpWN6d0NSzl2bdbwaouk2aNUmsJtvHxz43:AJd0tSmThHDsNzSBOdlHmsjm6dfNbC9

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BQPd1Wx n.xlsx.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BQPd1Wx n.xlsx (Modified File)
Mime Type	application/octet-stream
File Size	73.84 KB
MD5	0eb7d14ac0978c5603c01058c56f6893
SHA1	f2e3cfd695cd1df0233881b1ab4ec6a485babcdf
SHA256	0f958e997b00653735ffc90178da4f1e9d9f4214279af1a4e65b2c6ebc3f8621
SSDeep	1536:ISPQtjHoKRMgb7gy/bUaFK30g9h4gFEmP+1JcIWw6wJmI6:EN2gbMrkIygvPfQ6kl6

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\e6OEO.docx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\e6OEO.docx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	66.46 KB
MD5	470779e5fe0abc4a84c4a103ec607b0b
SHA1	5e2d6f3c7bd2f1e87451a5dfd0f13f28869f4613
SHA256	8effca07c0876523917aa50b704f79786b575cc28d45d09d3bf8e9dffe1b609a
SSDeep	1536:JrgU01OHAw9vMEBJlSqnRBOXEfKI06PgVJi0MU67w:pg51OHFvDbRCESH6sJDl67w

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\gsQ-EPB.xlsx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\gsQ-EPB.xlsx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	11.24 KB
MD5	1c559a740970bd2efd271847f8e78cd3
SHA1	759171960ebee02afb42429e8517e1155e316260
SHA256	bd15ad5573a93bd5ce20987326a4bd5c8ea7c081201f3dac45017a0d04a985d4
SSDeep	192:b7bVOObWsCJ7VxChNZb+YdwdCbE1JcgeLqcMtTs7y3omNQJ+8b+OAlT7Moo5zZFH:b7bVOOqsCNab+SwA0JdeGcMtSyKfvqT4

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\i_4q7DX_I75G.pptx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\i_4q7DX_I75G.pptx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	30.04 KB
MD5	ca9b2cbfadd397a2ed35ebbf5840026f
SHA1	70e41a37083241bf39fa361f7315242f5075242f
SHA256	c405845d7a4d7b85d2dd74c84ef2377cf0e9fe66c4af4f5b1c0faae265d9ec11
SSDeep	768:0ZWtwRJ4rNkpc9EhQmx5vfCbwJBW434swaZp/QAol:0ZW6Mry0AQUfCM13tZ/k

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\K6Fg-D7HYSFMMUE-mo.xlsx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\K6Fg-D7HYSFMMUE-mo.xlsx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	87.49 KB
MD5	5ea4ed1fb35a28810996f96b3cbbb8ca
SHA1	210959af9e9917bd7ea5cf4c9a116bbfe9430d9d
SHA256	02ed003db7026768be00dc332f48a86cadbbe3fdf74df4af56571e43931f30f6
SSDeep	1536:6WLO5rkRIQnxjlVu2qqLIcGO22hu6ZSimyrwBGmAC9nZrQqoYbXwFK9ge3Nt5KAr:zIrkRIQPLU4hu6oiHwBYCNZlo+wFK2e7

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LM5ox.docx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LM5ox.docx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	28.87 KB
MD5	5faeb7bad6c7638044649b5d959a8223
SHA1	18a215a79a2bf52f6f68059b7a0702a8e2ee6772
SHA256	d2532d00463462087d478099e005ce4c745ea208275a259284f2ead8ff5c044e
SSDeep	384:0urxZL7PvI2puUMMBXTOscjvGLTP8/uOZgOoP5WIf1Y05MdYHaJWE6u90md7HVkU:0uvzA9scjvGXnOoRjf1Y0OYHFE50mdye

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Q7YgBSupm4tFcrhh.pptx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Q7YgBSupm4tFcrhh.pptx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	55.15 KB
MD5	f0e0cbf23143ed063b6c25010368645f
SHA1	fa4528e09adf2cd7825045fc54daaf7a15330a74
SHA256	79a943d0ef202e7b7867c91cf4a4e188cd212c8cee5a929570ab9fe2eaa8a8ed
SSDeep	768:RbAqJ2VvaT7lcmFO7XM4+XjGqK9a6v8AnvsqEASoQbr85hT28Nj6DYXuSOhFKhjr:Rs0b7lcShpXjdKTEFAXHNMoLoKj7U16

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\UU WaPfo-9Vt J3.pps

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\UU WaPfo-9Vt J3.pps.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	67.30 KB
MD5	287355a20e26540dd5ba7b09a468d686
SHA1	3c5b4a15583efe45c9cb537beb6e4a3d0e2e9e78
SHA256	ffeded63ffc3648fb57d6018354a5c585418743ba0a76d2d95acde05017a1ce7
SSDeep	1536:wN7YMiYudD2A8HKTHNvsWpls2KpmKfQSrCiqzXT6J:wN7YMiYu0A8yNv7I2K3fQSrCtLTk

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QDgIqb7kwW\Vy34OJ3fIYHqzOmF_.xlsx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QDgIqb7kwW\Vy34OJ3fIYHqzOmF_.xlsx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	20.04 KB
MD5	affe209925bde42bdb59c9b4df873752
SHA1	cd455006356863810e11e992e5b5ef2e2f6e40b9
SHA256	9cdc8795d891a6c721d603744abf63c47258a98d294ebcf9a9b3c0d1636cdbbe
SSDeep	384:bvS9EdfGLIDAn8kAOTbpmN9v8FNWPJFzd3WgfEAsDF3N+/432Tcds:bvS9V9n8kfp4Z6kd3ZEAsaQ32g+

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QDgIqb7kwW\2Su5IHZx-\7Q9liHaXsdf.docx.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QDgIqb7kwW\2Su5IHZx-\7Q9liHaXsdf.docx (Modified File)
Mime Type	application/octet-stream
File Size	7.65 KB
MD5	a4a103279ebf3c796865643c9db53df5
SHA1	fb30c28cc7efe6d8a498f6c7873f9ea10521775c
SHA256	ed456fc6f4e039b9fbb0f5c05ca1d8f801f113a3c92c1a6ce277742d4531e1ed
SSDeep	192:Jxom8tpHmayVRXBseoi5FTc7fXG/B+vwHU+ysjf5lk6sVe4rixK2tVG:JoyV8eHL8vA+vqDWe4rl

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QDgIqb7kwW\2Su5IHZx-\OwPoo8f7 R.doc.Deniz_Kızı

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QDgIqb7kwW\2Su5IHZx-\OwPoo8f7 R.doc (Modified File)
Mime Type	application/octet-stream
File Size	69.72 KB
MD5	752ea0d63c2bca0bf47bcd4df15300f2
SHA1	31513a0cb61a60705b444399f78a5fdd86b9517e
SHA256	f3a2727f1205568c5c6541bfd3dcfa2b591f2d037ec22d2858da03ae7e22d253
SSDeep	1536:URV1rBGTfHTK2+TV+WG4gg3z1CHFgZRobOgy7:UVrBGDHTK2+TVNbRCCfoagy7

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\0MuspYycE4HM8zyuw.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\0MuspYycE4HM8zyuw.lnk (Modified File)
Mime Type	application/octet-stream
File Size	1.02 KB
MD5	d0557951895b9ecde8bc3d4ac9e21822
SHA1	ffd4e62a2a8bf90d618705b4162f6cbb5b141b21
SHA256	9d1e5f057cb91578f373c131add494426806c17d622d34bcab8ca07b07aa94fd
SSDeep	24:kVbp/E4NGKc2kdo/eLFxv6h0bjKWpOl+WbkZBJVLBipkKiUsq:k1p/dcZVrvjKTbkVVLgoUL

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1ZDZeKwO.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1ZDZeKwO.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.53 KB
MD5	95b2eb2f26bed89869aaa6258b4d2b9b
SHA1	cbbd912c624fb385924a5b1dbd0b1de305cde99c
SHA256	dcd870f614d3b8e486695bc29c6812d484c45d3601f62f9ac3acaa52e4de9452
SSDeep	48:bs+iZf9ICdVLxCt+dZmnigtOqxKMB7/rVZStM/4g0QK6kprEkVI7V:fizdVLxCtYZm/tnKS7/rVZ6M/4gb/l7V

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2Su5IHZx-.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2Su5IHZx-.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.58 KB
MD5	ddc1fee23a5f68ec2b976e632e45f02e
SHA1	86241b7b7dcd965962790a2df936b4eec038109b
SHA256	4c74e0c659a841699260d15507111c929a992f89b272d79f48f457c9daaac744
SSDeep	96:R8csSmpQ5ZWAoTM4nrLgYb0kBV9UrlpXYm:R5sSmKRan7UzX/

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\4sJkr706m2YQI.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\4sJkr706m2YQI.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.11 KB
MD5	be6e124cff9080d037a66af38396dc47
SHA1	467f0f6470307dfaa189fcf6253788c003c844bf
SHA256	b8fe4e4d9aebbaec2a33d15136295d225cf03e0107ec9f87282eb11267c1558d
SSDeep	96:pj1HMtzbcrC0ON2UUG1GJAd8plmrZzpaZGa4YwkHy/4otTJKKiGb17+/Fn:pjQzo3ONJU7JCO+ZzpK4YDHy/l/lrbkZ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5IDq.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5IDq.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.68 KB
MD5	d020ed861219a7ebd55b3ea0a58e884e
SHA1	9c59bb0d5fedce3ca75abc9ca43fb5b24fd42017
SHA256	378a06f80d584a792f971789d29c9945719bb62cbc279b0e7710eb5d4514f6f0
SSDeep	96:BirD+7aF5mXFf0vEBUamNQPaq4XQtXvnz23CLiFwWYg:crD+7aF5mXFcvEBUtAh4XQtXvzGlN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5igNP.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5igNP.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	696 bytes
MD5	6b1c52772795c6a42ae154a4f5113c38
SHA1	85620fc19a40bebe989fee1c26acb587d217888b
SHA256	08a16f32e851e4223252652883354d1e612689368983b6e6df7d3b1a03c74fa5
SSDeep	12:PahTcH8OwHzLg0dg4BMtU3xjzps+o2Rbu3iIqrcNFRlSsPdoUm0bxd6fptxcRQA5:PBcOwYIRatU3xjzC+o2pu3fNFfSve12u

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\75ATlPjUQW.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\75ATlPjUQW.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.55 KB
MD5	fc733fed8acefc8b406cd5a2ef933518
SHA1	61f75560dbb56e28b5adf5caabb82dcbe60a366b
SHA256	4872adb5d58f4fd30d80440d0642ab68ea741085031fb186de73c1fa1f642832
SSDeep	48:BWWcdwQHcPHzYJNwEa8o/9KdUfnSgWoCk6q+wUp3FP0IUMn+OvzvziVf:Bncd50TTD89oSe1cVP0/Mn0Vf

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\8fTFRoJWao5.ots.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\8fTFRoJWao5.ots.lnk (Modified File)
Mime Type	application/octet-stream
File Size	930 bytes
MD5	0b74f644a2e7704cf13e7633ec211727
SHA1	69b61812bb3ef632d07a4dd1ca84d84a9ab9b1a1
SHA256	47701dbee751ec8d65aa29da57cbfc32d9151217cdfead9f12bf077843e3e438
SSDeep	12:V0tUkiSIg+bnvI+RKD/mOtbOQdAtomCsb9rKYt84XxsJSRIFNZ+uoHhJLZi8O:V0tUkPKbbKDuOxMomT9PCAxmXBaJLK

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\9F_umu6e.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\9F_umu6e.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.50 KB
MD5	59ccaa76ea31e6aba9841fe60805a95c
SHA1	771bb493da9df3f63170bca3ed39f2a92e738e1b
SHA256	d4a4c6e84290434de3b6d3279bca8b674fa76483928d05bff692b769ae3ff505
SSDeep	48:ERCU5Ka7zNW6YBxlePIGDk5Ke5w4pg0xRjYk4hT1Vfx8bPN+p0vmG3YyS3SvgTEw:ERCU5KGeBvWY5KMw4qsC9ePN+p0vmG3+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\b7r81_Scu_.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\b7r81_Scu_.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.79 KB
MD5	418631a5fa8403857a29c377c8eade8a
SHA1	87421ebff476eea80cceaa120a43d8810d95c49b
SHA256	867ff43b85ea8f4194cf75ce14e90b0d7c98aed67aa6a952239aeb0a472ab87c
SSDeep	96:n1nGTyR7FHuB16Gk+jYVr1Dx/NckIm7BB85:ncB0d+jYDDuWB6

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BiRcK.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BiRcK.lnk (Modified File)
Mime Type	application/octet-stream
File Size	550 bytes
MD5	caeb4871c5e523acabd94b96032e61c8
SHA1	caec1450c4bb99219671daf8094305d574b65f45
SHA256	668d5596c34c489532840eaeb5dede63b2ca92f8cab05e9de7035a118ff5cbbb
SSDeep	6:w6tf+y5JlHTKgwiRSPnSy04vYfcQratMZ7ThXQUjz2HxLNG38wlX6i55+K9yELkZ:jf+sz7wxSG2HaW0UjeZNg8wwY95Re8rq

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\cD17.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\cD17.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.12 KB
MD5	05ad048b05011e2bf88cc0b80079be22
SHA1	d00f853b29c9b41f4a78bbad1af0cad0d1bde2ce
SHA256	eb13486dde3c5ad07c21bb7d8ec5e77de8f4483dbc8d7d89236718c31268c6d0
SSDeep	96:llX3/jYNWdTv8ZEPpiydY3gfsJgLJE5LOgN5H4t2X7VbkDEfWgTTg0aGl2v+ZB:bbuWdaU0yY3gfsJgVcLOgN5HJLiAfWWH

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\cSALEuB-e.flv.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\cSALEuB-e.flv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	1005 bytes
MD5	ba5f4832ef43e1c03c6b001896ca9489
SHA1	7825f33b93abefd0f8a8822145b1f78bba6be99d
SHA256	4afb08313f2aa88b048bb63f14791d9ba38198103fa944189a5e674205f3d9fa
SSDeep	24:1VCJ10tkq9cYePF45xJ3sKZLb300na9XxT:eHwIF4/9Zv300a9XxT

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\CThkRua8DGcy8Z3z3pOJ.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\CThkRua8DGcy8Z3z3pOJ.lnk (Modified File)
Mime Type	application/octet-stream
File Size	919 bytes
MD5	92cefac199a2c293a57cf3bfa66b9c16
SHA1	5349ee804165407a205f7822ad590f689f631883
SHA256	3fd0269519c9026148657191dd64dd83d8da5113ad0f14f1dcda7d851f2e7296
SSDeep	24:FUzN4EvDxSxJeexUtsiarlF0PiELv12ojlhz:uHvtSx5OirXqLv1bjlp

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\DhCgge2gD0JtlCIZ6g.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\DhCgge2gD0JtlCIZ6g.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	7df6741bc8d275aa2632fecd1934a688
SHA1	780d62d47a68d2034492bc9f48830774f76bbd21
SHA256	78e8c297aab22b88b55e9c0eee195394d5c22bb2063b5da4cedad78daffc2992
SSDeep	24:G+wsalhbBJ9WvYMzM1gwK6GV77WRkMi316Uvutp8RFSNTfEr:gsiQwMzZx6GV77WGzQUGv8/SN+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\DzW9r_NQT.flv.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\DzW9r_NQT.flv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	4.95 KB
MD5	5a44213aa144c067a4960d90c02c220c
SHA1	d248a05f7f34f9569e108007e42301127908d2e3
SHA256	fb21af43029a4eadb739b4990f578c2a19a322d303000c8ff1f7a7729bacd4cc
SSDeep	96:B7rT8KVZFqgiNHxuU/rHk504Kbs5hxdtOr0eID0er5lOXtPWJG6GKUl4VPY1w:dRV/5kRrrHk5DKo5hntOsD02OXoqQVPF

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\eBQGIu.mkv.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\eBQGIu.mkv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	6.48 KB
MD5	14051b7470a247267c311fadc0ad349c
SHA1	440f9a82e0f50e5e2069c6ba48a132301040ddc8
SHA256	74111831f38df0d1c126337ff6f232f73053557f13a33fb8b091aeee9aadf384
SSDeep	192:BycdBG8Gkf8onIqf2pgjlwPImHrHt/BjE4X/f+KbD:xE8AoDRjlwAgHNBhXeKbD

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ECv RTfReX.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ECv RTfReX.lnk (Modified File)
Mime Type	application/octet-stream
File Size	1010 bytes
MD5	f09ca81ee2589e7df26da565dcf0b2ff
SHA1	43c8860d5cc7cfcafc0803c4a07387892656ef22
SHA256	ae169d2e352b4ba8d738684a1898a2fb04c6471e25d0553bc9a3f19d66e35c28
SSDeep	24:Eg/MA8+wODWKUQe3AsJqPQZGVF6oUhHOQGyuyeef7ew0lNqdKPb:CAUODXoRJuQwVUoouQ/fKAKPb

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\eZeXpyHo6-2BapYTUu.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\eZeXpyHo6-2BapYTUu.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.34 KB
MD5	80a73eee9b43a2fd48694d21a5392504
SHA1	215531dee0371b865b59470a3eec0f760bf20be6
SHA256	2838461ad9671325137dc7907feb06366304ba040953e8a2cb9d205225ec69ad
SSDeep	96:ZuebmXNGvZUuzMktMy84h1H8e2Q3MSP2pZms89kA3jWR/MPczY7diJ:ZHeK3Msx1ce2Qc0EZmJrIodO

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\GbKks8NyOc3CEP.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\GbKks8NyOc3CEP.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.60 KB
MD5	c98e69d639c84369436da89f410061eb
SHA1	e869a44cd71de7d8493aa71f670265149e5b13af
SHA256	d14f25c8c18ea6fb68b577b97b1a6394c0e8133879b864c2a7383f3cb876a487
SSDeep	48:kXXnJhrCLCGJ3igG25FOuY+0cB3c1U6MNefQD+mTZUy6XpzGYBU2iJhSkvKJ8FSH:kXXbrgCFN2yqdcvMNYunoXf/ifFSH

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gelf7T_E0h.mkv.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gelf7T_E0h.mkv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.58 KB
MD5	c010f0efb431c978a3695e6d3bfea905
SHA1	3b62dc071f9ec4a7365d071c75ff9714d9265351
SHA256	c14e8e4a2685ad9d4d8685babdab2b705fcceb6554795616bbfd655b76aa4546
SSDeep	96:M6d8TB9DcEk5To7Z5ZEpo0H9FFnC20NuC:Pk66ZrE+0dPC2iN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\h9Zg.mkv.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\h9Zg.mkv.lnk (Modified File)
Mime Type	application/octet-stream
File Size	4.90 KB
MD5	aebaf834415143541334d49fed0c8bd5
SHA1	e12d3769da35c60f3a58a6dd0ec4ca4eaf36de10
SHA256	b81d3b2131f9b00dd11bbc2ff36755be2452a29800fe8394f63aba7be1a9abbd
SSDeep	96:MKhFIGs2KNzdm1rSmf/LJH0St+HbvfOjn4x+Ua5z85OFYSBdkt8XNV3K22zB2gcV:MEFnsnNBYvVV+HDGj4xy5z2aYOdkt899

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\hZ8y9cVu_SLf7UwSI.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\hZ8y9cVu_SLf7UwSI.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.73 KB
MD5	591cd156448c67c170908998f43d6809
SHA1	d8e26bfa236baeef3a73b0df90247952b7df5e08
SHA256	77cc5c365a87205b1fcb27db0113385068b47969d76d974294898fe45ddd82fb
SSDeep	96:X/aJaGXN5VLpsPLIeXb68k5p5gRbDPdxODnObzjWxdlDepMhfc:X/aMGXTVFsPZ+L6ZTODmjI0Mhk

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\JVyf.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\JVyf.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.06 KB
MD5	b26e3d04d1abaa001b1bc067015f1e71
SHA1	9ff24f7ac66a2796a9eafa45c80719831538250f
SHA256	c6aa14db4c5eea797555bb258943c83f67a95099374c21085ae56c27ca24b072
SSDeep	96:slHxCSsSCZYRGBS7h7xzCkoyfbcQRGz7mSstOtZa0xx16KjaDuauAl4ytJW:slZ6YUSNzCkoRrPHwOSsjRByy

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\K6Fg-D7HYSFMMUE-mo.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\K6Fg-D7HYSFMMUE-mo.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	8b731342ede3eb870911e34d0f6fa62a
SHA1	ee39f54ed1ec63663bb84cfb6387b26296d851a2
SHA256	9a42393d6e9f36ff0e030007e1982f5ca4d50938aa6402d085d54668d4527f29
SSDeep	48:a2/+5IfCnhYqkTAslBmzKhnxmksgZ+GoLf0IPf9NoHpTmiQuOjDvj:XgiC2QMNhxmk70LMIPFNoHpTnOb

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\lD4T0jw2Q6.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\lD4T0jw2Q6.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.26 KB
MD5	380105d78be1e24cf85616e3ed88ea9a
SHA1	efc8d4854719ecd450d7972c217e9ed4970e62ce
SHA256	7bd8855930d815da6291268e70dbd82d983e52e778aaba6a30df233edec99dac
SSDeep	96:H5uvvpa5+dG0+NGWVIRZzHbyM5fy2QhRjx0T5x17T5GS3+Fq:HgRTG0FJDbyM71b7kS2q

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\LM5ox.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\LM5ox.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.50 KB
MD5	09ba2f3b5c01bc6d436fbbfa23d2c69a
SHA1	be7a1c932fcad07f20c69457acac9ab687fe1a5e
SHA256	fcdcae70ca8efe6b41462605320ac8544515d30bb202c439df7d63a2575d2847
SSDeep	48:8vSAnRr5loFj+8rsp8jDOu2kOO71z4jk/n5/EJ8aO0ojHp:8vJnNDIlfjCY1Ejkv5/EJVOfjJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\LYXJ.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\LYXJ.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.04 KB
MD5	afa86bd4cbf602cb1804b29e41e7a292
SHA1	f114ba5e110fb0dc4a9d2106c0376d183605dbce
SHA256	8665a1dfb563271c96b609b8f1ebcc63f8c3b57f541006879271218c720f46fd
SSDeep	96:1YcEWiA+UQBRpw+KOTXW8Irjk1g1+boEYVzc4:KcE4+pwfeSXkXYzc4

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\MWmp1xmM8xsMui.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\MWmp1xmM8xsMui.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.62 KB
MD5	9a5a71b3a55c0fc4ef17f3d5ea980a27
SHA1	2269bdb5ecc5a2e97485b77d346f6635867e5f12
SHA256	ecc02719374aac004d47a51bb37f6cba1c6abceadab89618e1311fc5411bce50
SSDeep	96:eXin6olS+iaOnRH5oMqmB/QYhAopH1eOevYpqOYr8:eXipTU5D5hHV5m8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\My Music.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\My Music.lnk (Modified File)
Mime Type	application/octet-stream
File Size	1.29 KB
MD5	0519fa1d73c7f443cd1209436f4088ce
SHA1	b6dd6333c5948b0c927756bb91ffa188ea93604d
SHA256	9beb114802988b2da8af5dfd5f8481756bb7a285cf8256c7e141e94ca129f527
SSDeep	24:/OUl5NMj8QZ/sVqwYwHCF1BaeQjhZd3FPo4GafFXoFU3s6wkoFkV2t6/D:/DlK8IMY2CF1VQlZd3l7lfi+34kSkgEr

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\My Videos.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\My Videos.lnk (Modified File)
Mime Type	application/octet-stream
File Size	1.31 KB
MD5	ad11ac974943ea7e29948e30eee26624
SHA1	4ceae7871420201109061df1609383f57efc24e8
SHA256	c375b5cb1fb896f87bd6da9078d154a99b0d873f8f4165065bae4448cef9fb2b
SSDeep	24:xGnbcdDByvl9A+Mx/wBeHu2vCyAdKB5bQJZ9XHW6GiBwF1NUfb0Bh4nvuHHdzWE+:QnbcdlslO+0f5AMLEJZ95GmMVhev2FWP

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\mZiqtoI5-CUDhQFEL.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\mZiqtoI5-CUDhQFEL.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.19 KB
MD5	045d9bddaf4128a44cf6d61e17e0fd5a
SHA1	6da0bfe8181855421876e21518c54215aebb14c7
SHA256	b1b33b6423c3922495fbc7487dead2e869d7df74e5e0531b77a9ec6e9e9f5e51
SSDeep	96:8qNX7naU1/vYxLq4axqJl3Qc3HqnUDSdW9Zg8KLdIUD5S67w3haiu43ks+TH1/hf:82jRE+HuAVz4gdPJ7GhaekRiIf

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\OJ6PNr.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\OJ6PNr.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.61 KB
MD5	9d9ebba9f62d2064e8069f6b7171a008
SHA1	a11d58e6bf01aad1841adb66df3d51a57336008f
SHA256	e3c3519c575f9df04e1ac857e5b3d1d7cca630b12556f6913b98314f6c3cafb1
SSDeep	96:MsEwqExjm762Luz2BojNbJXn8HI3ANsqCGhEmdMC4AQKuPP:gom7yzWo/JIoGhE8tFQKuH

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\OJlBF0pBs.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\OJlBF0pBs.lnk (Modified File)
Mime Type	application/octet-stream
File Size	1005 bytes
MD5	a0650a304727cf0b525561d2126fd1ff
SHA1	a07618413065f134e826c1d397d509fa8dcf87da
SHA256	9c34b2938beb5d301c7e7faf3e93089ee22948d48d80c45d474d791e61cf9288
SSDeep	24:xioUEK5iue9xBDgL/8rDAgBR+GXbRUOGes+HirxCP9czX+3Gg:wtEKQXjBML/8rDAyUKOOM+HSamzXu3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ovLe8xyIEfAbQ.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ovLe8xyIEfAbQ.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.10 KB
MD5	b067b326654382a24075bbc45f34592a
SHA1	95d8ab0abb6e8252ee6677b82dd15bf8377a1aef
SHA256	809ad6a1c6e88ed28fd6e50e39b1b52519c57a6a9e230c26e30aeea46cc0127c
SSDeep	96:Kow44rXLqfwulrrpsRgvUW4rlagI0HFbGct+u3hoQYynHaBCjGe21sdUR3E0oTfK:S4aulrNAMUW8lagI0vpRjHasGe21aGEU

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\OwPoo8f7 R.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\OwPoo8f7 R.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.05 KB
MD5	4c2ec842692212c93208cb80dca71632
SHA1	f68964f75f037ed12d19d9362bcf5140c36260a5
SHA256	83dd6ff8fea0e816f758a261a9ca8e8d0a73038a5ca51581970abedacc750534
SSDeep	96:/H+4Dnjrrgz2//bjNymOWukuOunmp0clCi/YuTcoE+nJjfbVI253GB2P4:f++pbgmDutOump09iA0EsJjTq253GB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\PCQbPMub0D.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\PCQbPMub0D.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.40 KB
MD5	a9fb628282608ba648d7112548848fa0
SHA1	c9de7194e2d316cc5c129fc4eb6def8b55f5860c
SHA256	2e882b8063679836f3ceb40391361616dd880826a8f26601f3f94d03a018ef79
SSDeep	48:c8yoIOFJ74XmHuy0hX/fXU82nbE50IvX54Tx9g/Uv++Wzd4QlY6aO6t9hPEJ:/FLOy0hX3XDFpr/Uv++sd4QlyDtTEJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Q7YgBSupm4tFcrhh.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Q7YgBSupm4tFcrhh.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.62 KB
MD5	0d9dfa6cf92c24a5f7c9f06f4b5b2e74
SHA1	19624177de2679e62f67ed07ef58edc44baaf625
SHA256	e2014bb314ec3758f0ffbe72a159c631e367977866855ebe02fab0a99591b335
SSDeep	48:ms85FE82X9JCsa/jPrsBnaMhnErsDdcIshanekmSaviUPaUZWf4mYj:5oUVajrsBaunErwIhanO5zPa+f

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\qADM55YkNC5.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\qADM55YkNC5.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.05 KB
MD5	6bac3a10037baa8cb97444f1a0f80811
SHA1	6b6ffc6acfbb4c8d03ed7f4918ecbdab513547f4
SHA256	e885477fc114dc3ce388c375101cd414def099c544019942c90016bffd524b01
SSDeep	96:oLuorGwQFj7DS8B80xG+rPJwIWmH5a8ZGSdbZe63fhaEqu2tAv8nG:Fnw8vb80xG+1WmBUSdZd3fhZJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\QDgIqb7kwW.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\QDgIqb7kwW.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.41 KB
MD5	3ff6c5aef7293f0838dc6f54c5123714
SHA1	5080597ae71359dc5449b2e76a1da7a87e9c8b3f
SHA256	963609f073e1a680ed13481a876aa311bd01059a2794a99d5e2cb6f05730081d
SSDeep	48:fDO9xUUK9m3ca6uCqJsEqZd1siUkX5PAOmEQB6yRt3GW9y7I+jW:fDmGnmsaykzuUkplml6Wq7xjW

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\QTdyC7KZmvwR.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\QTdyC7KZmvwR.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	589 bytes
MD5	03cfe961513161e6f53eb63cb7f7e584
SHA1	3ab540798a3380362b4f98366e4eb7039e7fc3d3
SHA256	3743afd57b0866775d1c80d292da0701eb26bade6e4fe9110fa7fb66e97ccd84
SSDeep	12:NKDd5fqCJbDIh04IbcxX8a4pDED1dsyj+WKXKeuJuPS6QjN:NUd5fqwb8vnxt481N+bHflQjN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\R9 umVY3s S.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\R9 umVY3s S.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.74 KB
MD5	dd5e52b34e7d231c6f2652dbbea320f0
SHA1	efbce1843e626962d8d70a8e2a575292147c8993
SHA256	1cb4c9cd1ee77bd88b8a7cce43065e51f38c08ef92c3aa2b3919506ec76ddb42
SSDeep	96:4MmtNm5t6rG9ImYnC9lk2HfZ4tBy5Kr8QtE3:etNct6rG9TY4uk8M581G3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\RAwb Q.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\RAwb Q.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.48 KB
MD5	503500390a1e50c01a62171f61e56267
SHA1	9bf61bfddd3246e3fc9c5199221c6335fa6ac023
SHA256	2328fe9ed82e4616da09805a70ae8059255ea08ec5a73a4d6851b94f1fa7cb3e
SSDeep	48:5Iy5K+V6A/irv5kGHKQw4UCAvR+4U1iSHv34rRb181sIf9HCc350GA:xKo/2v5kGShvUF1iPFb7If9HCZt

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\rBVR.mkv.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\rBVR.mkv.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.52 KB
MD5	08089ff6c4e8bf170e29206d751f1860
SHA1	470b91b3020f50063dc60618c3ed07c87c3e40f1
SHA256	ad0f97e549cde9c61bb936cb027a07d78ec6fe31e922eea42edc981b7440b2ea
SSDeep	96:oi8LD/ASxQhseGusQavXEUi5NeNUE8hHDfY4iNlpD5:oiODYoysBCcXxiaHzX

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\sdHHfCv04Sz375nv.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\sdHHfCv04Sz375nv.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	1.02 KB
MD5	3d4829fadaac948637c69c91f6a0d4ff
SHA1	af51c2e02cadbc20bcb84fc57cbb7d152b20b2f6
SHA256	48b0330ce03a4fc89c622f923360cdf5a36f9607e9231804c573a8384b91aff1
SSDeep	24:zeraJ+VSOh8zveR41wTzr6Ogs4furpYZ1NgaoIYea6fFRe:a4OqzveR4SX5gs4GrEsNea6q

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\sePzVh.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\sePzVh.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.03 KB
MD5	d77d04f54882d023ff8d5558d16a3667
SHA1	d85dfb37637d2a5a03ca395fa4fc3058d72dc4d2
SHA256	84a3b2e195f7df23da47d7a925e2aa296e03fdd247f9185c8acc560177a23904
SSDeep	96:XIESXgvf8+AM8OVDQd4A3Qp4GIOwhUaAPHX3pL:XhSw3QOZeQQhUaeHX39

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\SoYt-rrIjdE5BbmIf5WS.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\SoYt-rrIjdE5BbmIf5WS.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	2.63 KB
MD5	bd142540a7a3e85d5300fc22b1d3531f
SHA1	99d5fe74c5a92ac2ae60e6322aff234246d070db
SHA256	9d30d1ed3efd1ce04699a039c82f07c9d1f8b604be7131fbc56e39992f1cc4b1
SSDeep	48:Pkz9bMnJxRwyNA566V/6c9N6c1S29yAuxLEV4ozcHVybvpfrDjw8:UhMJ7wwy6Jcf6c1JY9oV4Gc1ybxfrn3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\TdynWW3NMOli7eh33s.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\TdynWW3NMOli7eh33s.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.13 KB
MD5	bd5afed86232415f20a97decfc23ed72
SHA1	5876c3245676d981fb900aa7f7c745f3b8115f20
SHA256	d1b560e3a67a2c2b62f6da7fcc9185af10d804a0fac4a88adb1bf979ab0cb03b
SSDeep	96:vyF7QTMKJZ3ktbURQncp+ytNUP6WjQQqHfOOxgX:vI7QIMcmbNUPfQQCHxgX

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\THTxDDVtYDMIzykk3K.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\THTxDDVtYDMIzykk3K.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	b2ad1b5802bad6295a5c62a8d6a35423
SHA1	94cd026486814284a0e094ff94f53721d88713fd
SHA256	47cc6f42a9f5a2afb35fe779914f187bb43bda5d3830ae99f24daa277dcd2848
SSDeep	24:62V/xQiGjFJkvKR72szUJKLxXOwZKWr3iy9lC:P6Om21JSxX1QYNa

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\U-CMugAGR6Y1R8GcK9.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\U-CMugAGR6Y1R8GcK9.lnk (Modified File)
Mime Type	application/octet-stream
File Size	1015 bytes
MD5	fbce1a921e335343aff4215a22832e38
SHA1	04f50e07941f7b822fe67a6793c5bc3e9df8f93e
SHA256	973097576a91dfd2aec6b054dc0763a8dfdaca9f37ae8f16549ade9296313438
SSDeep	24:fyNAcaVVl2lADcRpjR32b/xpCnn6sfpa/IwBI5voCf7AU:fypaVVl1cPgLeBpeIAIzfN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ucQXAw25ykhb0B5VMNx.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ucQXAw25ykhb0B5VMNx.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.27 KB
MD5	41814dfd251f31c967ec24006fb500e9
SHA1	85da6d8be26b55a3ffd82f2adc806ae1eb3e199e
SHA256	bba3d50fc2fde1648a7558ca20fd99f0b65d0a61d0eb0ea9fd7bb29d096deff7
SSDeep	96:PmFCPnYV4yVuQl0XxqbAP2Jxs5eqGsnl3N1s2NMqfDflJem5JXqypAT6d:PLPnYdVuQl0Zwekqnnl3N1prlJewJXqO

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\UEfz0xncbCAxVBW_BJZV.mkv.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\UEfz0xncbCAxVBW_BJZV.mkv.lnk (Modified File)
Mime Type	application/octet-stream
File Size	3.69 KB
MD5	def847552c55d2d0f6631f94e643b03e
SHA1	2ca5ae027b51ac11626034ec8cf7987b31496324
SHA256	ffc4fcab2b06722ed3b7b5245743ce9d54c98d2cc31b4e13bf00aa999f4878f2
SSDeep	96:wLU5GQuAUkX7V536vboTYegGMqSmC/KmgC8SQu:lGQckJ5qj8YB1/Kd8Qu

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\VsvgMblZ.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\VsvgMblZ.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.24 KB
MD5	a588ecc67535eb64953c66d32711a6ce
SHA1	e6ccbae190af96914282abd834e20a519366a49d
SHA256	1229ee92c3370f953738f0adb230f30fb5117c5c64e0f6e3961af21c185ea4f4
SSDeep	96:aADMnO4okCuah7AlAKPqJcf8GwoqzaUcZk0nO46Bv2CsFjXjA0gufc3FQYi6iq:aADMiAlAEqJcfaZaxx69sFrPdc1Qz6iq

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Vy34OJ3fIYHqzOmF_.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Vy34OJ3fIYHqzOmF_.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.83 KB
MD5	bec66a8f00ad92d535e5e655c3f43df2
SHA1	8041d36f9a339ad9646dfa0c3aa514973aa7f341
SHA256	344bd22fbf5ba4d0afdd8f527efff186b585e42350fa9164770f77f15a12a1a9
SSDeep	96:e+XUOJTqr0i3oO9RfnoiO6HJShddNVzMjauWGt0Edfw:e+XUOZqrPoOjfM6ohddNFMjNjt3fw

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\y2KG4nPdxt.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\y2KG4nPdxt.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.19 KB
MD5	a3db4f239568c0c12438133f7882c30c
SHA1	4bc6aad7229b41610fe38bb72cfcd5e98ffa1201
SHA256	4ccbb8e5de7c9716a03438bda308188fef21c36e65bd648f9eb78afd1c9583ae
SSDeep	96:SYeNw2RggKxFczQFzeri2i8Ju3GlJz3EW2yd6hoVVIIkwFqYqBDe:mNwhJxyz+Qit8+AzUWSGVuIkDC

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\YaB2.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\YaB2.lnk (Modified File)
Mime Type	application/octet-stream
File Size	5.11 KB
MD5	84707b0f2728335d1d7a6c30a87e3e6d
SHA1	13823d2ee6fa2cec0f9aae624d9fb17f0dbcc300
SHA256	629532c4b1fa95b79fd43a98fec38aa4a13bb5b906c7db70e6b55b64b59cb38b
SSDeep	96:1kzgusZe9OC9wuzudpnRULZOob7YTCKnuiquasa2tkQYUwzU9TDU:PRWOrtROOob0mKnuiosXkaG

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\YdacGeTA.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\YdacGeTA.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	5.08 KB
MD5	8f3f95090e9898e744c3d94279ea2014
SHA1	b9d507e5e6a28cf660d0f51d53d638ccb93035b1
SHA256	ffc61e3b90a5d4a07efa87898487b40b4a3ac74386a72827276a844caf428d25
SSDeep	96:SIIvq+/s980hPmyN/G+/Nnkhi0Ol/UAZSgrX9wjcrDVAfH5ur:SIIP/saYzhkhwSgrtwgra+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\zAupK0t.lnk.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\zAupK0t.lnk (Modified File)
Mime Type	application/octet-stream
File Size	2.36 KB
MD5	0dd387a631f47c94ee4c1d4d4cd0200e
SHA1	5a7f34751d94e7513917977fc3f5b075c6024aef
SHA256	533d403fa865a77de88a81562a8ca32c2840f2f7f36c87cd2d6af9cb9553890b
SSDeep	48:JCWmLCBh3AvluK6dh686RvcrbH+fsHZ4YmbnghjLvbyji7y9dnHei:8PWMvMK6q86RvU6fiigtXeLH5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\zWKyoNetE.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\zWKyoNetE.lnk.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	3.57 KB
MD5	5e67a416094a389559bd3219862e956b
SHA1	b3748f96cdb5edc4a6766b44421c806154707b80
SHA256	6cfab0fc1815feff160a8e1b9fa76d7b5aceb401283f29813108b32bac8ae304
SSDeep	96:+l1MA3Q/kpjrgvldC/ZG3apZXX+WPjz4nAwyXOmB:+pA/k5rgvGEKyWPjz4nheB

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\9F_umu6e.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\9F_umu6e.png.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	27.29 KB
MD5	423a14e9689b9fe10a780372ccd8ec6b
SHA1	dbac55fa1144e84b9975ea89f8113e9ee5077359
SHA256	c402da79254741fe21fd54c98a18be1bb910e4390ad8c7f8511c36bd5f1d4a29
SSDeep	768:ekmC8xC/CLeBSM7B4mVhe8Pq3zOjbyj4ewE+FCog:+wqe1y3OKjZDAPg

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\SoYt-rrIjdE5BbmIf5WS.bmp.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\SoYt-rrIjdE5BbmIf5WS.bmp (Modified File)
Mime Type	application/octet-stream
File Size	77.85 KB
MD5	a049eccb93ace11e4a7ad411455fba09
SHA1	5a1da3d6ae0d84e7503daa5539cf04201580c16a
SHA256	eee17e57e1f8cdbd453eeb4eea18f2a20c9f2b8be463269bd49aa574062c3afe
SSDeep	1536:Y+tPcl0ZHH88q1g7Zpxl7s8iMiBsf8ctAOzxlj+Dl:xPccHQYZzdsXMAsfjvh+Dl

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\tsg7m_edB5q-IyPB_Uz.bmp.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\tsg7m_edB5q-IyPB_Uz.bmp (Modified File)
Mime Type	application/octet-stream
File Size	77.20 KB
MD5	da5595c8f034900a54999c5e710330e9
SHA1	1fa261025efdf6de41b8e69f29d2448c930d0798
SHA256	6bfcc333bbb0b0c725523512276fc5064aa45ba398f2b2cd5ad0f304e8e137a8
SSDeep	1536:vCuzN+PlcmHgLoXPp3T80D42PZmqOeNx2q+HZI1MIMvj5Y+N84lTyIXAl6Imk2GU:vlolcUfpDFEqj1+HmfMv6+eeTyIXAlGj

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ZroSs UxTGYvhkTzvhb.jpg.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ZroSs UxTGYvhkTzvhb.jpg (Modified File)
Mime Type	application/octet-stream
File Size	89.41 KB
MD5	54eb7e9c855fb88e239be3115e8df74b
SHA1	f288c5775a676fa53213f66ab055b82272446309
SHA256	f66e7f7ac91f99bc25712996c5381dcdc6b163ff1b9026155cf3015c980be0c2
SSDeep	1536:PR64ualRRWZL+NcM544MSb/ni+nsmfD4roYukyq3mrsJWahpRssLY3:PNpznx54Wns64roYjyCmQJDzRDLY3

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\2hc0nLdqeXfTqNl\eZeXpyHo6-2BapYTUu.gif.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\2hc0nLdqeXfTqNl\eZeXpyHo6-2BapYTUu.gif (Modified File)
Mime Type	application/octet-stream
File Size	22.07 KB
MD5	1c25648c74c4cc14f5908fe060b89201
SHA1	65063b6b3ed0349527b7d28e82d353d0eb55d596
SHA256	ad484dd1f6324fc63b73dfdfe6cc1103cf1a2057f92e8b3632a1d558b870db30
SSDeep	384:B7pAA08o18LRg4zSaXqPxNS6mlLlIpfh9Kqu2nchJ4hUtvy0:hpARV18LjIjU0ifk5Uta0

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\2hc0nLdqeXfTqNl\VsvgMblZ.bmp.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\2hc0nLdqeXfTqNl\VsvgMblZ.bmp (Modified File)
Mime Type	application/octet-stream
File Size	10.01 KB
MD5	391ed649cab8b476cf6d8165c8f2dc16
SHA1	f258dce9f86d452cdcd50e96540ae9cb5c97fd7c
SHA256	daa4f212fd69211a00ca91c7d7443242c2ef21c9d108db11f4fdb39635d6f1b3
SSDeep	192:GMSrxJ1oGG5aitSZSOpghzvNnKOtjC0Nb6sDACHh3h7Yj4EQDp+E1oBqnwJ7jBwe:GVrL1olBJbFnK0WRsDACHnYj4Ewp1WJ5

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\GSlIX-wE3J\YaB2.png.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\GSlIX-wE3J\YaB2.png (Modified File)
Mime Type	application/octet-stream
File Size	82.49 KB
MD5	cf9d585a3511e5cbe7a3ddd677da4a16
SHA1	88f4768c2a8cd2f156b53a69fc71d027a4683c54
SHA256	4667a1f5f91304f711e0752c551722a4ff0203701a9a7b14fbeb244f19405419
SSDeep	1536:FLy/dvaHzljGxb4LXrCPZx4RbWHXEi/QL3rp/FSJnPYMC9hVrY/rsR5Jzk2noVHg:5gdvaHzlbLGPZWRbW/i9F0JefmA

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\PfT_29aBkkq\7xqky_KR1phllF0lUBH.gif

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\PfT_29aBkkq\7xqky_KR1phllF0lUBH.gif.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	32.83 KB
MD5	c83cf162ae6f71ae2ac9fd36d4597f9b
SHA1	eb182a98f31df26c5a07d971dadfe2bdcc33a570
SHA256	c73e676115dc6ebd599030b227188dbec874bc8b681cff54037931457d435741
SSDeep	768:ME+U0wDoVGqf1p9YHf/LApkxdG8u/XtuhrINm0Fwg5GfvJf:xZsVGqb6BquhpWZ5Od

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\PfT_29aBkkq\cD17.jpg.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\PfT_29aBkkq\cD17.jpg (Modified File)
Mime Type	application/octet-stream
File Size	3.96 KB
MD5	79564be06a483c16823f651490b78c5b
SHA1	622735e131158f819a469dcf98a7832454783417
SHA256	8158ae966c59c8ee4b94ab6095bb9e80be93a704fa36b961a886bcb0adad1961
SSDeep	96:L0f+H68oL+kgNe2b9wnfve47+VhD3VQgfwyvFQAL:wf+a/1UesG2HQ09CAL

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\PfT_29aBkkq\MYYdIUQVESzF5yk.bmp.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\PfT_29aBkkq\MYYdIUQVESzF5yk.bmp (Modified File)
Mime Type	application/octet-stream
File Size	49.91 KB
MD5	47106d068bc75295796fd98861ac2446
SHA1	ada411d42c5909d1a897fd9fcc0341771c71a3f4
SHA256	78113c78645e3bc7abb115f23de92c2e3fc834573fd827a99d4f1b783e03e40c
SSDeep	768:YOnWg0IigTlEXgv+qVIXcZjEIOnZ/vqM0Db8nmcrmtmiTozItNYAohtoGUhF/6a6:YOnWAv+qVMchvQ/wPAMjkMnmhtwtM

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\PfT_29aBkkq\y2KG4nPdxt.bmp.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\PfT_29aBkkq\y2KG4nPdxt.bmp (Modified File)
Mime Type	application/octet-stream
File Size	53.02 KB
MD5	ad1b2050213380f229db9e9f0850f325
SHA1	f34b25742a84ef726025a68551ca55b19fc10cc5
SHA256	bb0d44ef7dfe94c08c582e7c6a165ac691719e8305541d3831c613247661a105
SSDeep	768:wFROeOjyh4uNeSD/Bd2K3conoOlmgfr/HgLofESOYATd+kn9tHWxYtoumYqbEPUy:6odM1H2KsxOj/gocSJ8dPn99mYmVlF/c

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\zGvXwHlK4-1z\-vbAQ74ugAbPjkEt.jpg.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\zGvXwHlK4-1z\-vbAQ74ugAbPjkEt.jpg (Modified File)
Mime Type	application/octet-stream
File Size	44.73 KB
MD5	b3f398a56d1261dfd63fbde6afd81d90
SHA1	631a06ae1e2cb900c8e1e54557c6354cc055bc9b
SHA256	e44df8610eddd4e1df9374b249cb44e1bfda86baa07d983d9d709266bfd7816a
SSDeep	768:+/h2v0eURsqC3nGZ1eOq1pQbe0GOtdwe3lKfUS0TbiIdiyNLHEpcQn5swv1MTnXJ:+XeURa3+1eOq4be0GOtN3lKfkTbiIIgH

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\zGvXwHlK4-1z\n_x6gNftmTgsMiPC2h.bmp.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EaRTC6ALkAKwp34VQ\zGvXwHlK4-1z\n_x6gNftmTgsMiPC2h.bmp (Modified File)
Mime Type	application/octet-stream
File Size	99.44 KB
MD5	0a9fe9aee8f2e23efc51e7586856b8f8
SHA1	6992223405b3afe612bf46c5845900823baf65e8
SHA256	ee1274c85b7cb24691e9dcc637b617a906209de58f9f5c30424022273dfc13d3
SSDeep	3072:ngyo7oIADBgNEe8j6GB5Igdc3fnSy2ZFLC:ngyo7fk76GB5Avx2Z1C

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\cGWVj3zjOM.jpg

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\cGWVj3zjOM.jpg.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	70.54 KB
MD5	3e22ded8bb6b47afc0328df3a6fbef74
SHA1	6600f814436673753c51a8c695aa0a2ca4e4bbc5
SHA256	9ea78f92f1b15870e60f56cc3d1cd153cc3f181d85339fb9a368a62834f6178d
SSDeep	1536:vf2IXZnZuA+YbMY6wl+qkHnV980Jj82fB5rETsDMa5iSIZm:2IXZgA+YbMY5lkHnVi0227GSIZm

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\MWmp1xmM8xsMui\Dy5IW1xWAqSu23GIuS.png.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\MWmp1xmM8xsMui\Dy5IW1xWAqSu23GIuS.png (Modified File)
Mime Type	application/octet-stream
File Size	92.34 KB
MD5	4cd8c830762db53ca0e3c1270ec1471f
SHA1	3cb4b4600c76ca14fe2f5afebf0c481296133c4b
SHA256	274317b2e770592e9cca9019ceda5e15dbb36b48019a1c8da761119aa40c5600
SSDeep	1536:S+KnEyAyujrj6rzD3HlTJOPgvOoi2bpGgDPpc6A4jLBN/3QfEyUFKeiI+c78ltWt:S+KEyXujrOrvXlVOovrBPTPBN/3Qf1Ax

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\MWmp1xmM8xsMui\LYXJ.bmp.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\MWmp1xmM8xsMui\LYXJ.bmp (Modified File)
Mime Type	application/octet-stream
File Size	38.12 KB
MD5	2105a07ea17086b38bdd2003ff2cfdd0
SHA1	36d8a546a55301fc6ed9c0c06fc89c2cb51652be
SHA256	e3df749599419f7a19aeaa7b4c60b900efca2586c02d7ceae9357d960cc3c108
SSDeep	768:BPCRy3UH1nHkggerKi1i4/iBqUIkKyWlv9sHm+1Zb6TXJcSCJWl5nUZpPz:BaRjHRHkh8f/MIjZum+1xaQWl1UXPz

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\MWmp1xmM8xsMui\YdacGeTA.jpg

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\PCQbPMub0D\MWmp1xmM8xsMui\YdacGeTA.jpg.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	28.11 KB
MD5	c549484c72128ae5ca45b8b5ffb94316
SHA1	6dee0758bc339832dd65f9ee3dc9de78f5fd01f4
SHA256	a1280e3ab40b2fcc2b33a399f63605e323f80b781963a62e7a4c6fe483652daf
SSDeep	768:RzHEVZPaeZs/AQa7a597z1p1nrNFeuJybdgu6:RMwx3a7EdrNFHJwx6

C:\Users\5p5NrGJn0jS HALPmcxz\Music\-c9KV4u0veAyezl.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\-c9KV4u0veAyezl.wav.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	25.29 KB
MD5	143af73a9d49961061392de3d347c313
SHA1	2516ea131b0c3f0a3b761cdac1c460961a0a6a7d
SHA256	72c264063f7474fed09b7875f31ff7d53e90b9242650f364da94810d50a1cb96
SSDeep	768:Btzs3wIcqekQgyFDuJ/uciQQJh2xqlFmwDSoD:BASNkQgWY/uc0hFFmc

C:\Users\5p5NrGJn0jS HALPmcxz\Music\DKdwTNXjmeWg9.wav.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\DKdwTNXjmeWg9.wav (Modified File)
Mime Type	application/octet-stream
File Size	68.83 KB
MD5	72205716cae4a4d97115eaeec2d6aa7c
SHA1	4853b3ba874e4627d3efb3c9b1682ac20c81e17b
SHA256	cc619d5afad5ae14d09d618a9b49354b108d16b304e2f6f0071902276da5bdc6
SSDeep	1536:KUGITyz6TJWAKoCD5jPFdK1sbDsJwzbpXhjyYRG70mMkl:KlIK6nED57F7bDsJApXgZ

C:\Users\5p5NrGJn0jS HALPmcxz\Music\hw2y.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\hw2y.mp3.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	90.41 KB
MD5	08427c6488ece85b1a0885545fd04563
SHA1	1570b00f98611fccedbb0dea681fd3030eb925a3
SHA256	20f140e225245b1db59777f304d2dda7e27feb6cf0872774f7bf4596b2190bfb
SSDeep	1536:ZUT18kTSqdrqjeONYqNkRa0l1LlL3lfW/PqKiXr0zPM7J9Ba65Sq18W:Zw6a2jeOWIkRaO1BL5W/Pe70zU86Uqp

C:\Users\5p5NrGJn0jS HALPmcxz\Music\8mJLvTqgcpH-zx5\zWKyoNetE\r5lrOCXC7xed.mp3.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\8mJLvTqgcpH-zx5\zWKyoNetE\r5lrOCXC7xed.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	40.53 KB
MD5	c6abf7fa584d81f8da2169c01903293a
SHA1	2f0d14e06ba41fb21d47fb16de49b05a55a37ed6
SHA256	af48461ee60d9e8323e955d93993fd7027d97a2777dc2483bedbd70265e06729
SSDeep	768:tV8sFOsj6XLz/m1WkejmAblk5FKJMqXgtTg7Rm0GKojrjjEXf1R:tfMsCjExebbRrRojnjEXtR

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\hZ8y9cVu_SLf7UwSI\Csd0.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\hZ8y9cVu_SLf7UwSI\Csd0.wav.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	64.08 KB
MD5	1c73672543bf0920a002d08efd571d1a
SHA1	4b7f3ff1978284a0eb1095cf250013be6cb8d734
SHA256	f979a412f933347af521cfa4681ea51e5cdb4bc19818f4752ce936418f48c856
SSDeep	1536:jDZ/Y0ORTplfNUAATBFu6IHkSKTOqlKFnVJKdgoWrzIy/qoI7PU:RQ0wlfNUAG/hQavyVJhHtqvs

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\OJ6PNr\V1K 45gc8vgXNc8CT.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rQP15tFZwPwBe-xpD8mB\OJ6PNr\V1K 45gc8vgXNc8CT.wav.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	26.96 KB
MD5	67b3c4361b89b397841a262107a06c10
SHA1	b27637363abbbfb3544e0ba818678e4914891d6c
SHA256	471e5c06282acd3689d6ca0dbcf992eb1a7773b711affc41f3ed80b4b96eccfd
SSDeep	768:vsKW8cPXiGHdKzm9MyO1Bl4TsEHDhwoQOoBB+:vsbXiGHYz9ySBl4TsCDuoQtBB+

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\6y6A68kA8H.mp4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\6y6A68kA8H.mp4.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	68.19 KB
MD5	cdcf5d3a0cc360bc79ed3e636526ee80
SHA1	bdd22c4c187ef24b83415fa055310256905de542
SHA256	bc23a1ee134acafc71fbba0b9e8fe783f2ef79e66cfae3e4ced841b375536265
SSDeep	1536:kLx/s12kPauak2B4Wnsnllc81FQzwMJG48hkLjuOAkzn:kLrkPaQw8n88kwwxuOA8

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\eY5CTJo11te26D.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\eY5CTJo11te26D.swf.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	45.58 KB
MD5	b1fe0ccf67ff5ed8c79cc9573a905698
SHA1	9f6977dac503629c37971c71a5068c468d13633e
SHA256	b345b9582749bfd232877d7a80084cd7582accbdb4312b037c650f12b3cadb72
SSDeep	768:ttGAUr8dThRkNFL9OUkA98JsmDeHcVgwXe9ebfsAo8qT1Z0bi0+4HSNKJ5+xB96t:zGAUQ5YNV9pGZek48DihZ6iqS8f6BMPF

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\KjT4 HwzgaTQ5.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\KjT4 HwzgaTQ5.flv.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	81.50 KB
MD5	a6d08ed05a998dc4724f8e855d3ebed3
SHA1	649f8e058c4abed5cf3c690ba7b7753630ce3457
SHA256	cd4317cc687b814eb22d8ad9f3d2baeeb426f1fee2b0801a99eed6f0f1f74859
SSDeep	1536:/iGQmhFJX3rR8dWSK9S1FNfOWNQ36I6RskCS8PrqBSMAd2u2C45WIwbQ5DSqZVsK:/i6jX3rBOHNQ363QPWtAAPWkVLI+

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\sn5vakIDi6gvvQd 6.flv.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\sn5vakIDi6gvvQd 6.flv (Modified File)
Mime Type	application/octet-stream
File Size	53.95 KB
MD5	c5b5f3818e610fb518c11d76eb1fc872
SHA1	5abfac3cb253c291b3cd80b2b199ddb51a5d0fc2
SHA256	7e2b601c9e03e01a3816dd8c487840ecd239fd6ee9aee621ed290a1e79f142f4
SSDeep	1536:s2h0zeBCbIlCdFKWhDzADprb6+7q+JSlcJhOY:e0CdF5tMDJ2WTJQehOY

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\C-flingYTURAdr0.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\C-flingYTURAdr0.flv.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	13.97 KB
MD5	10b4f6f85de0933044c8bc4a96b3e573
SHA1	b24deecc37315448ad3c71dbfdb14aa3bc768fd6
SHA256	2476585b4284493f653fc19f98c5d8e530ec895ba48116ca903d485600a1e530
SSDeep	384:1aUSjrNS6gvLPP1qlGWywHKyWOIpJcVvMTJi:1al5mD3IhvyEvM0

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\hV0evDP.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\hV0evDP.swf.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	28.81 KB
MD5	974ca70c630c54af7b96fb0d66bec935
SHA1	afa169486983b2fd963bb9fdc1714b394f58be4c
SHA256	a8f7667326fd01e43791b75fb24d712ad312c4f8983af1e4dccec792243aa56e
SSDeep	768:KbcAeBna7skh2gU7T0loePMde2XkA4/5XuPnTfN9:Kb5InwDWTHmMdGK/Dv

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\6ulWcr3Xhn_as0bd87.avi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\6ulWcr3Xhn_as0bd87.avi.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	95.35 KB
MD5	1e8b8282537ddb58a5dcc8cc22d0d055
SHA1	660c271165fd9f497035fbc45b1be58cbf33ae64
SHA256	11ce8c4544b2ae3211d95a6175e914457344e7872d963e80a4f83398368844c7
SSDeep	1536:btoztInJ69NqAOr4QRSLga5M/B6cwXacwzTfUvV6xP+JdcstQ12YlLqp:EIKILSLu/0JqfbxDwSU

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\DzW9r_NQT.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\DzW9r_NQT.flv.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	93.72 KB
MD5	f221dbc9abdcfc281775abb8f2062c56
SHA1	a23b3907be752df0385b7e4956cf9c3bad68bd41
SHA256	2b20db58e936f2e6f618edf0810d3e83ab644cbc22e7cb24358d1ff8519d6afd
SSDeep	1536:3gJzNGtSNaFuiSygBd8HnRbuHmM3SAvTLFojVF/tW5gRdD02FSaFdrv5HXnc5:6GtBggReN3TbLqn/tWwlFD3b56

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\h9Zg.mkv.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\h9Zg.mkv (Modified File)
Mime Type	application/octet-stream
File Size	78.03 KB
MD5	1468620c13d15fe6d6e82d792c79e3cb
SHA1	851250026861ea76fcbab5dd798ca189fd653710
SHA256	c33aca4a6671cdb388edd4b809427b680a3ffe3b5f412113367931178f0fb4a3
SSDeep	1536:jl8hyGMHiGMpdmbv1lw1B2gihTecAyjrz/nBhL1n/BMlSyryvTu:jl8hyGMCnmbUj2gxc1Tl/BtmyvTu

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\ijdz6BW1MN-tNdRFNN.mkv.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\ijdz6BW1MN-tNdRFNN.mkv (Modified File)
Mime Type	application/octet-stream
File Size	89.54 KB
MD5	e5b11f6ec1752ecb8879cfc8fa9b280b
SHA1	86bd7a61520f6a0e295f35bdddf66fcf87b76084
SHA256	7081ae1bdd6ba2fdede88a2069fe9126100ea1b9b3f5a610900e65f360a37622
SSDeep	1536:47anZw5Mw+jyBWRVPbtqVQfsFP9iM25AFX8jkdY8/vXTCRDfBGfZyb:4a/w3WRx4VQUPiM5l8jkWoT/Ib

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\lVAuwOohxgl-3h1Jjv.avi.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\lVAuwOohxgl-3h1Jjv.avi (Modified File)
Mime Type	application/octet-stream
File Size	61.01 KB
MD5	f3bfe23979c46d05e933f5d2c7223f17
SHA1	a4f0c0d2aa9eb282f0cb3a493e44c59620eddb6f
SHA256	b7be13c020fa2bff403320e31439d6973aa48f9aae5173c28a128d868498e4cb
SSDeep	1536:E1241TtpX85QJaQ8Z3FLfNuegMJdKBlCUL6NyxhBr3lm:E19WQuFLF3JdK3CULZhM

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\V_J Zwq52Ighi.flv.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\V_J Zwq52Ighi.flv (Modified File)
Mime Type	application/octet-stream
File Size	70.00 KB
MD5	aae5a12aec7f4da239cc8237225066c0
SHA1	04298e8e72a0b9ef45a58b90cbb7a737390b2331
SHA256	ca295f40e2730c0445d7079522224bc2f986598b264a322c61ef6542b04979f3
SSDeep	1536:4slhAeQL++8fRlU2HqOB8CDMReFeNSYC1Zh0O6YV6:4j+RM2HqOFzF3Yeghj

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\-GXQ5Lbgzz3YUKdy.swf.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\-GXQ5Lbgzz3YUKdy.swf (Modified File)
Mime Type	application/octet-stream
File Size	65.77 KB
MD5	75351157c9081323db78ea93e07a0bce
SHA1	c556629a0603dfffadb5a0209fac5daacf75a46e
SHA256	2dd92c1d27c24842c5e77b3585df086b2daa841d3a8006c27e2a361ce429adeb
SSDeep	1536:v4rBQ3+4xXKpRxJHdTaOrFWXsCD20CBEUdgmvJEknhN/yhOc3viR9gYnWDXIFrS:Am3+gXQ/9naPD2bKcgmRDhN/yhOc36RU

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\JoZda8UuU66Z8AW q.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\JoZda8UuU66Z8AW q.flv.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	75.33 KB
MD5	74f3be92dbc943eb123bf43d3d53bcec
SHA1	f6e328f66e4e26f2b6f29fd49daef69de51ab4b2
SHA256	c20e1cd5e1e053dba2ed085f0668f94e70dadd0dcf9afe3f4675209db02ee08d
SSDeep	1536:ZfboQgTkT5l7DHCKk5jlDBpEy+soka9m3zkaqRRVJHnj:ZfWYTrPCKYf+ijIRRVJHj

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\AalPBDgDSgBqLTp 4TZ\b53_noBMJxMq3W.avi.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\MFW8IZ\maHvK_h22n001r8G\-4ij7y-zIo-dhcoiIV\AalPBDgDSgBqLTp 4TZ\b53_noBMJxMq3W.avi (Modified File)
Mime Type	application/octet-stream
File Size	5.42 KB
MD5	a4896bdba36bc72c800434c1449da007
SHA1	af3574c2fa99fe0f0b1b5e1d5c36a172f2ccd196
SHA256	e375dbd811d622860e17b6107689b350ab54d423dbb10fa33c18ad1eb154f412
SSDeep	96:OJ+PIHz8XILpXw3zenUCzOQAWuZq7O0Xli/US0N/Rh4naj5Uiafld7Z:OJ+w6ILdw3zEzo5qo8SoRhEI+fld7Z

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1ZDZeKwO.xlsx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1ZDZeKwO.xlsx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	45.07 KB
MD5	5ae6c7011661ff7d11ed69f49f5af806
SHA1	3eafaf5830a28578bb068f5affb35ea95d73d7c5
SHA256	7b345290ebab0e1b34e36d76532578d41c0efbaf5c4538937f9bd6e6ed353e3a
SSDeep	768:b7HMWUWfPz9zHHMLZ2UvI1ZCEhPHwe07Wsm+4tg1LDZXENp4fD42igsPUOYJw:3BHzlnyg1ZC2QS+X1LDyCDUdUpJw

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9zcK9yFvhp38_3ycric.docx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9zcK9yFvhp38_3ycric.docx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	46.74 KB
MD5	6f012760d46d4ef5439bfcb853a1a6f4
SHA1	94b59b3269c075dc2fc05ec99bea4a224b8b35a5
SHA256	987ab08b417b16b22ad6d7cb77d8deb149f912483f5b6277796d54f384955f9a
SSDeep	768:xHG4KBu6V1J8B5iTKpj47NK7iGEnjp02n4fiMCErY+M8RoaDNcn:xHGN7J8B5+KpExBGAmw6iMCEr57RGn

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GbKks8NyOc3CEP.pptx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GbKks8NyOc3CEP.pptx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	80.48 KB
MD5	ec988852717b9dce8e9670ce150ab08f
SHA1	40b22e76097b6db1d69bf3c309e46dde48766723
SHA256	f9a2e6aaf80ac2d2d1b095bc25abc4b357d8ca19389ce73c6be6df44cf952a5f
SSDeep	1536:45feJPAoHaWWoIb3ePoy3IIJFlJPxxBxEf2TQ0Zh/3BTspTX3WszK3:4525OsDFLJx8f2TH/RW6szK3

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\n3ype.xlsx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\n3ype.xlsx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	14.90 KB
MD5	a01e12f585241af697d2210a4c972a67
SHA1	e5c69b83eb9ba470c409c19cc16a5d5acc6d07d7
SHA256	e6064fae571e1d0f411e59f31523bd98ed445f9168194a4e12e865fa52108736
SSDeep	384:bcHVJUM59J5ldm40uyMgO1ys/CwEwI8ZL0RQvIzlwB6wXlold:btSldmkv51Fm8ZLZvzllW

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\pp2-cOmu2l2wp3nZR.pptx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\pp2-cOmu2l2wp3nZR.pptx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	51.79 KB
MD5	5b65252ba10241123a0e09f0ce316f7b
SHA1	5b4051a5d818f19e73f3dc6fac3e5d1c2b45e717
SHA256	87195c786c9333168a1e886e187afc75342be04c9b4427230b10f43e7d8263a2
SSDeep	1536:BJIFeGJoC7zEEMbqDB2/xwkexejIYa3+4mIXJ2:Uc2oCvxMbqV2JAxWIcmQ

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yTrX8T6qEOaWaHd93_.pptx.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yTrX8T6qEOaWaHd93_.pptx (Modified File)
Mime Type	application/octet-stream
File Size	29.05 KB
MD5	356f00fe7ee7c7719e67db72c728eff0
SHA1	cb186b9b7c140cd9e3e533e0182d8fb5fd4e1778
SHA256	ce65ef6ac6fb8b5c965df587c28707f78219ec5a9c72e87e4d1b55ed1662b331
SSDeep	768:N/ZiBlg3UlnUY0l/iLgzxOZUBAlBHuqmI2x:NeoBHiEl0UBAlEqmpx

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst.Deniz_Kızı

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst (Modified File)
Mime Type	application/octet-stream
File Size	265.00 KB
MD5	94b9b83b999b9c47a4671276a589756b
SHA1	07d88558ea33144eafb266edb142352b48cbd14f
SHA256	3c6c638ebea674620f199c704827007f0bf725004243f1286d175b4aee989e4a
SSDeep	6144:ASk3MRw485SicKcj3kXid65qjC3gAavBaiQS7gPyd9isYwWhjpxb:Aer85SicFLpUqC3NessIsY7b

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QDgIqb7kwW\Ia7vXnn.pptx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QDgIqb7kwW\Ia7vXnn.pptx.Deniz_Kızı (Dropped File)
Mime Type	application/octet-stream
File Size	4.97 KB
MD5	64e32e947365ee7f2f7d2e6ecb5ef771
SHA1	e314b1343dbb1b52add8e38573dc985503b210f8
SHA256	01bda84494c50693f9e92ad5eb7038e9886d0360d8d6918e46fd9577ea2901bf
SSDeep	96:TlduxQrTSMHSq/52st3JQJhpJRO+yyktugKGPQBvqyCiOseOkDiFJ7:TLTRSe52sRQzJ/vmugK0iCyCiqDIJ7

C:\Windows\System32\drivers\etc\host

Dropped File

Text

Not Queried

»

Mime Type	text/plain
File Size	40 bytes
MD5	1721dd2411428a6cb86973d86419cd6d
SHA1	72fa137685e7948292484e4412e5eed0fa23fd41
SHA256	bfb93c4da0828e5c59679b4dcaf9425cab7ea8f87b11a3e4d44ff34f18be1b1b
SSDeep	3:OSmPEqKWMIH+tDn:OSTqpe5

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After