62cdcf717e8b3f55338e3b60046ac8e6c2f0296885cab733a4ad609641fd8325

Analysis

user interaction
yes
max time kernel
95s
max time network
95s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/04/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dll-enc.dll
Size 255KB
Sample260429-tpqqcsdv6x
SHA256 62cdcf717e8b3f55338e3b60046ac8e6c2f0296885cab733a4ad609641fd8325
MD5 b09fb85e39089da9ec28958a5094bb51
SHA1 66449437308768bae13d8cec7e7c17cfa3eaad25
SHA512 1222d46380672da5d453eb8c14cf69be5cd7ea6ba616d3c068f3fadc89bbce0d4aca25f1ff5a6e7034abbd9e657e8ee90a0ba021782173dc8f330ea5b442c47c
SSDEEP 6144:Zkxp031xS2P7IzU4HOJevwxw0a5YLlohbVCeZHB0u:ZkxM1xSm754uwv/z84bMKBR
TLSH
T1DD44CF8B63A60CABE87793788863094AD372B8511B70EAEF0364475A1F237D54D3DF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
303	1280	firefox.exe

Executes dropped EXE 4 IoCs

pid	Process
2796	processhacker-2.39-setup.exe
4308	processhacker-2.39-setup.tmp
4152	ProcessHacker.exe
5644	kprocesshacker.sys

Loads dropped DLL 12 IoCs

pid	Process
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	157	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=9f3f9a45fdd01205	5

Drops file in Program Files directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Process Hacker 2\x86\ProcessHacker.exe	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\unins000.dat	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-OQD34.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\ToolStatus.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-51GBD.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-B8BKG.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-1A66N.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\x86\plugins\is-4T7B2.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-5BTAA.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-O63M3.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\NetworkTools.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\ExtendedServices.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-HQ1US.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-GL4UE.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\ProcessHacker.exe	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\ExtendedTools.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-TTQV1.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\x86\is-A2A5L.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\SbieSupport.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\HardwareDevices.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\OnlineChecks.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\UserNotes.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-FPVKC.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-KDBMQ.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\ExtendedNotifications.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\Updater.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-ICKAP.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-L1QN0.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-2QR8V.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-QKP31.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-HKJL6.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\x86\plugins\DotNetTools.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\peview.exe	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\WindowExplorer.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-F7NOT.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\unins000.dat	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-QV2F2.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-N74AF.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-FET6I.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-HIFG0.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-B2EMP.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\DotNetTools.dll	processhacker-2.39-setup.tmp

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\processhacker-2.39-setup.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	processhacker-2.39-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	processhacker-2.39-setup.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x0010000000028557-969.dat	innosetup
behavioral1/memory/2796-996-0x0000000000400000-0x000000000042B000-memory.dmp	innosetup
behavioral1/memory/2796-1237-0x0000000000400000-0x000000000042B000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 40 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessHacker.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 = 56003100000000003e5c4f1a12004170704461746100400009000400efbe3e5c4f1a9d5cd0812e000000f80501000000020000000000000000000000000000002bef84004100700070004400610074006100000016000000	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	ProcessHacker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 78003100000000003e5c4f1a1100557365727300640009000400efbe874f77489d5ccf812e000000fd0100000000010000000000000000003a0000000000249f950055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 50003100000000009d5ce88110004c6f63616c003c0009000400efbe3e5c4f1a9d5ce8812e0000000b060100000002000000000000000000000000000000d416bb004c006f00630061006c00000014000000	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	ProcessHacker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ProcessHacker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\MRUListEx = 00000000ffffffff	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0\MRUListEx = ffffffff	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 50003100000000003e5c7820100041646d696e003c0009000400efbe3e5c4f1a9d5ccf812e000000ed0501000000020000000000000000000000000000002d020000410064006d0069006e00000014000000	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = 00000000ffffffff	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\MRUListEx = 00000000ffffffff	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0\NodeSlot = "3"	ProcessHacker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	ProcessHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	ProcessHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0 = 4e003100000000009d5ce881100054656d7000003a0009000400efbe3e5c4f1a9d5ce8812e0000000c0601000000020000000000000000000000000000005fdeb900540065006d007000000014000000	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e80922b16d365937a46956b92703aca08af0000	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ProcessHacker.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\processhacker-2.39-setup.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4080	rundll32.exe
4080	rundll32.exe
4080	rundll32.exe
4080	rundll32.exe
4308	processhacker-2.39-setup.tmp
4308	processhacker-2.39-setup.tmp
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3456	Explorer.EXE
4152	ProcessHacker.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	rundll32.exe
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeDebugPrivilege	1280	firefox.exe
Token: SeDebugPrivilege	1280	firefox.exe
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeDebugPrivilege	4308	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	4308	processhacker-2.39-setup.tmp
Token: SeDebugPrivilege	4308	processhacker-2.39-setup.tmp
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
1280	firefox.exe
1280	firefox.exe
1280	firefox.exe
1280	firefox.exe
1280	firefox.exe
3456	Explorer.EXE
3456	Explorer.EXE
3456	Explorer.EXE
3456	Explorer.EXE
3456	Explorer.EXE
1280	firefox.exe
1280	firefox.exe
1280	firefox.exe
4308	processhacker-2.39-setup.tmp
4152	ProcessHacker.exe
3456	Explorer.EXE
3456	Explorer.EXE
3456	Explorer.EXE
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
3456	Explorer.EXE
3456	Explorer.EXE
3456	Explorer.EXE
3456	Explorer.EXE
3456	Explorer.EXE
3456	Explorer.EXE
3456	Explorer.EXE
3456	Explorer.EXE
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1280	firefox.exe
1280	firefox.exe
1280	firefox.exe
1280	firefox.exe
1280	firefox.exe
1280	firefox.exe
1280	firefox.exe
4152	ProcessHacker.exe
4152	ProcessHacker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 3456	4080	rundll32.exe	57
PID 3456 wrote to memory of 3424	3456	Explorer.EXE	85
PID 3424 wrote to memory of 1280	3424	firefox.exe	87
PID 3424 wrote to memory of 1280	3424	firefox.exe	87
PID 1280 wrote to memory of 1124	1280	firefox.exe	88
PID 1280 wrote to memory of 1124	1280	firefox.exe	88
PID 1280 wrote to memory of 1124	1280	firefox.exe	88
PID 1280 wrote to memory of 2256	1280	firefox.exe	89
PID 1280 wrote to memory of 2256	1280	firefox.exe	89
PID 1280 wrote to memory of 2256	1280	firefox.exe	89
PID 1280 wrote to memory of 2256	1280	firefox.exe	89
PID 1280 wrote to memory of 5320	1280	firefox.exe	90
PID 1280 wrote to memory of 5320	1280	firefox.exe	90
PID 1280 wrote to memory of 5320	1280	firefox.exe	90
PID 1280 wrote to memory of 5320	1280	firefox.exe	90
PID 1280 wrote to memory of 2252	1280	firefox.exe	91
PID 1280 wrote to memory of 2252	1280	firefox.exe	91
PID 1280 wrote to memory of 2252	1280	firefox.exe	91
PID 1280 wrote to memory of 3288	1280	firefox.exe	92
PID 1280 wrote to memory of 3288	1280	firefox.exe	92
PID 1280 wrote to memory of 3288	1280	firefox.exe	92
PID 1280 wrote to memory of 3288	1280	firefox.exe	92
PID 1280 wrote to memory of 236	1280	firefox.exe	93
PID 1280 wrote to memory of 236	1280	firefox.exe	93
PID 1280 wrote to memory of 236	1280	firefox.exe	93
PID 1280 wrote to memory of 236	1280	firefox.exe	93
PID 1280 wrote to memory of 5868	1280	firefox.exe	94
PID 1280 wrote to memory of 5868	1280	firefox.exe	94
PID 1280 wrote to memory of 5868	1280	firefox.exe	94
PID 1280 wrote to memory of 5868	1280	firefox.exe	94
PID 1280 wrote to memory of 4100	1280	firefox.exe	95
PID 1280 wrote to memory of 4100	1280	firefox.exe	95
PID 1280 wrote to memory of 4100	1280	firefox.exe	95
PID 1280 wrote to memory of 4100	1280	firefox.exe	95
PID 1280 wrote to memory of 5496	1280	firefox.exe	96
PID 1280 wrote to memory of 5496	1280	firefox.exe	96
PID 1280 wrote to memory of 5496	1280	firefox.exe	96
PID 1280 wrote to memory of 5496	1280	firefox.exe	96
PID 1280 wrote to memory of 5820	1280	firefox.exe	106
PID 1280 wrote to memory of 5820	1280	firefox.exe	106
PID 1280 wrote to memory of 5820	1280	firefox.exe	106
PID 1280 wrote to memory of 5820	1280	firefox.exe	106
PID 1280 wrote to memory of 5516	1280	firefox.exe	108
PID 1280 wrote to memory of 5516	1280	firefox.exe	108
PID 1280 wrote to memory of 5516	1280	firefox.exe	108
PID 1280 wrote to memory of 5516	1280	firefox.exe	108
PID 1280 wrote to memory of 4796	1280	firefox.exe	109
PID 1280 wrote to memory of 4796	1280	firefox.exe	109
PID 1280 wrote to memory of 4796	1280	firefox.exe	109
PID 1280 wrote to memory of 4796	1280	firefox.exe	109
PID 1280 wrote to memory of 5328	1280	firefox.exe	112
PID 1280 wrote to memory of 5328	1280	firefox.exe	112
PID 1280 wrote to memory of 5328	1280	firefox.exe	112
PID 1280 wrote to memory of 5328	1280	firefox.exe	112
PID 1280 wrote to memory of 5824	1280	firefox.exe	113
PID 1280 wrote to memory of 5824	1280	firefox.exe	113
PID 1280 wrote to memory of 5824	1280	firefox.exe	113
PID 1280 wrote to memory of 5824	1280	firefox.exe	113
PID 1280 wrote to memory of 476	1280	firefox.exe	114
PID 1280 wrote to memory of 476	1280	firefox.exe	114
PID 1280 wrote to memory of 476	1280	firefox.exe	114
PID 1280 wrote to memory of 476	1280	firefox.exe	114
PID 1280 wrote to memory of 1284	1280	firefox.exe	115
PID 1280 wrote to memory of 1284	1280	firefox.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll-enc.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4080
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Downloads MZ/PE file
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - Checks processor information in registry
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {58b67c6b-1588-40d1-8e35-16ceeb0e92be} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27136 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {e778c265-9a65-450a-aeaf-058eac01540e} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:2256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3920 -prefsLen 27326 -prefMapHandle 3924 -prefMapSize 270279 -jsInitHandle 3928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3936 -initialChannelId {b8452ea6-d529-4354-85a2-cc0ae1cf745e} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5320
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4088 -prefsLen 27326 -prefMapHandle 4092 -prefMapSize 270279 -ipcHandle 4188 -initialChannelId {ed8d18be-6ca3-4e3d-a18e-bfcbb86068bd} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3212 -prefsLen 34825 -prefMapHandle 3284 -prefMapSize 270279 -jsInitHandle 3024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3052 -initialChannelId {4099d6ff-5c0d-4197-a0a1-e29f9dbbd464} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3288
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5052 -prefsLen 35013 -prefMapHandle 5056 -prefMapSize 270279 -ipcHandle 5060 -initialChannelId {f92ccfc5-b218-475d-b3a8-df85e7219930} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:236
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5244 -prefsLen 32900 -prefMapHandle 5248 -prefMapSize 270279 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5260 -initialChannelId {e0f8d940-394d-4213-9676-e9759ed12a5e} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32900 -prefMapHandle 5248 -prefMapSize 270279 -jsInitHandle 5320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2884 -initialChannelId {eea1b768-e0fa-4698-ae1f-2faa582aef80} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5640 -prefsLen 32952 -prefMapHandle 5644 -prefMapSize 270279 -jsInitHandle 5648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4672 -initialChannelId {95cc302f-032f-44ee-a46a-4fe5d034109f} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 33071 -prefMapHandle 6196 -prefMapSize 270279 -jsInitHandle 6252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6260 -initialChannelId {80c9a4cd-9055-4a0f-8d3c-65068310418e} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:5820
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 33071 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6252 -initialChannelId {ac5bf9c3-a3dc-4eaf-941b-61e78058a42f} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
      4⤵
      Checks processor information in registry
      PID:5516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3764 -prefsLen 33071 -prefMapHandle 6528 -prefMapSize 270279 -jsInitHandle 4648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6564 -initialChannelId {af574344-c0ed-4a70-833e-a9ead2e32f57} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
      4⤵
      Checks processor information in registry
      PID:4796
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6112 -prefsLen 33071 -prefMapHandle 6100 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5848 -initialChannelId {9c1fcc2e-e38c-41de-9f56-5f5a1144f12d} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
      4⤵
      Checks processor information in registry
      PID:5328
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 33071 -prefMapHandle 6692 -prefMapSize 270279 -jsInitHandle 6924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6112 -initialChannelId {6fe78309-27fd-4fb0-b487-7da111a36443} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
      4⤵
      Checks processor information in registry
      PID:5824
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7000 -prefsLen 33071 -prefMapHandle 7020 -prefMapSize 270279 -jsInitHandle 7024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6148 -initialChannelId {8fc15ffd-986c-45ec-a518-621e632e9d54} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
      4⤵
      Checks processor information in registry
      PID:476
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6508 -prefsLen 33071 -prefMapHandle 6500 -prefMapSize 270279 -jsInitHandle 6672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5340 -initialChannelId {67ba1563-ae47-45f7-93bc-7f0a4ff2e0d9} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
      4⤵
      Checks processor information in registry
      PID:1284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6712 -prefsLen 33071 -prefMapHandle 6912 -prefMapSize 270279 -jsInitHandle 6536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6732 -initialChannelId {49934b5b-3f74-4c6a-9f08-2ca8ea935529} -parentPid 1280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
      4⤵
      Checks processor information in registry
      PID:4784
  - - C:\Users\Admin\Downloads\processhacker-2.39-setup.exe
      "C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\is-QDK8P.tmp\processhacker-2.39-setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QDK8P.tmp\processhacker-2.39-setup.tmp" /SL5="$601C2,1874675,150016,C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4308
      - C:\Program Files\Process Hacker 2\ProcessHacker.exe
        
        "C:\Program Files\Process Hacker 2\ProcessHacker.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4152

C:\Program Files\Process Hacker 2\kprocesshacker.sys
"C:\Program Files\Process Hacker 2\kprocesshacker.sys"
1⤵
- Executes dropped EXE
PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ProcessHacker.exe

Path C:\Program Files\Process Hacker 2\ProcessHacker.exe
Size 1.6MB
SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
MD5 b365af317ae730a67c936f21432b9c71
SHA1 a0bdfac3ce1880b32ff9b696458327ce352e3b1d
SHA512 cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
SSDEEP 24576:V7eokafnkAwgcU+29fR4PQviXq1pj3EDT5m+m8I:V6efnkdlUF92PGBOT3m8
TLSH
T10D857C5262E44098D2BBDE76C5629A22EAB13C061F34CADF4650F5792F33BE1DA3C711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProcessHacker.sig

Path C:\Program Files\Process Hacker 2\ProcessHacker.sig
Size 64B
SHA256 519c2c2ca0caf00db5b3eb2b79dfe42e6128161c13aeb4b4d8b86fbffc67e3d4
MD5 2ccb4420d40893846e1f88a2e82834da
SHA1 ef29efec7e3e0616948f9fe1fd016e43b6c971de
SHA512 b2a000b33d4a9b2e886208fc78aeb3a986f7bd379fb6910da9f6577603aa6e8237cb552eabca70445f37b427419beeff0b061090cb952331b8db322ce2e58bc6
TLSH
T149A0220F8220C88B333080000C880880B30C00CA2300B020202BA802B82C0020E03320
MD5 SHA1 SHA512 TLSH

Submit Download

kprocesshacker.sys

Path C:\Program Files\Process Hacker 2\kprocesshacker.sys
Size 44KB
SHA256 70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4
MD5 1b5c3c458e31bede55145d0644e88d75
SHA1 a21c84c6bf2e21d69fa06daaf19b4cc34b589347
SHA512 0d7abcc792127c37d6af58ec5b900c1754d02913794fcf37d92c400d3a9eb8981f6aa5515e48fa8fc11ac0eb51c1da260d7defc0e60b21de70a4e58413c296fb
SSDEEP 768:ZkCOeX2Yg5KY6VgQqdzfVJdf/aEB2zBdZp0IfKg589z1hEn:nzn68BaIfRn
TLSH
T1C5134A42C7551CC6EEBBCE3965E89627FF30B8468730C2EB1215C0159F62BE2A978356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetTools.dll

Path C:\Program Files\Process Hacker 2\plugins\DotNetTools.dll
Size 132KB
SHA256 b4cc0280e2caa0335361172cb7d673f745defc78299ded808426ffbc2458e4d9
MD5 b16ce8ba8e7f0ee83ec1d49f2d0af0a7
SHA1 cdf17a7beb537853fae6214d028754ce98e2e860
SHA512 32de59c95d1690f4221b236376e282c8be1bb7f5d567592b935dcd798b36b80e86da81741c5845fa280386f75f6eafc9bbd41035362984150b134d24aede61eb
SSDEEP 3072:OkF+ncOyiGt9KQ130WlLJydacG3EkLLFjSeB:Oi+WH130U/
TLSH
T1E1D34B47B3E810ABE577CA7885A35A19DB713C661B71CB9F0354814A2F23BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtendedNotifications.dll

Path C:\Program Files\Process Hacker 2\plugins\ExtendedNotifications.dll
Size 140KB
SHA256 61e8cd8de80a5c0d7ced280fe04ad8387a846a7bf2ee51bcbba96b971c7c1795
MD5 be4dc4d2d1d05001ab0bb2bb8659bfad
SHA1 c0ed9e375b447b61c07c0b00c93bb81c87bcfc2e
SHA512 31389e268fe3bf1175fa3c251ca026f77dc59361b8425c9826f31d18c5174e6de68c6092aef187f2bd2c92d89b3093a660b2fe6189af369293c1117c856b5cdf
SSDEEP 3072:ucUs2pkSTVRC6//SZDTWeEd1D6gyqAnr6rw8N9TZof:ua2zRC6ncXWl4
TLSH
T12AE36C5B73E4046BE5B78639D8634A06DB7378250A70DB9F039482961F23791BE3AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtendedServices.dll

Path C:\Program Files\Process Hacker 2\plugins\ExtendedServices.dll
Size 136KB
SHA256 5ae7c0972fd4e4c4ae14c0103602ca854377fefcbccd86fa68cfc5a6d1f99f60
MD5 4858bdb7731bf0b46b247a1f01f4a282
SHA1 de2f9cbcec1e1fa891d9693fb3cadfdd4cfe1f60
SHA512 41b39560e15d620733ca29dc37f55a939a653f99686ac86643ccc67fbb807ad95d1996b867319d98506f3b8a30772fff3c3317bbcc205987f48031923f674d9a
SSDEEP 1536:cjYKbIeoRGwasSxZVqHa0fdZ5OiRJjHlcUhzD55DBdisWpZ9dl3K+OL/VfRc2:diLhZCdZ5bHHlcUz5PaNKxjVpc2
TLSH
T11FD3385763E905ABE5B24738C8734A15DB727C110B35CB9F0264C25E2F63B929E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtendedTools.dll

Path C:\Program Files\Process Hacker 2\plugins\ExtendedTools.dll
Size 196KB
SHA256 f2805e0f81513641a440f1a21057a664961c22192cb33fca3870362c8f872d87
MD5 bc61e6fb02fbbfe16fb43cc9f4e949f1
SHA1 307543fcef62c6f8c037e197703446fcb543424a
SHA512 0bbfe53e1dd933a3080d9775ad890fcbd73f9820885efa6b69e9664261249f34eaae3870f74de8511734fc9a0114f36e1bfc529a032d303a8e3e583e37a506c6
SSDEEP 3072:kahH9o/M+4BoraGA7sYt/zVcfg8Snh/3RFjxabZ67DG3p+DbR17LhY:P0MGraz/zRNh/3RU+72
TLSH
T116143A46A3E40056E977C678C9B34642F67338111B20DBDF066482BE5F37BD1BA39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HardwareDevices.dll

Path C:\Program Files\Process Hacker 2\plugins\HardwareDevices.dll
Size 180KB
SHA256 acd49f2aa36d4efb9c4949e2d3cc2bd7aee384c2ced7aa9e66063da4150fcb00
MD5 a46c8bb886e0b9290e5dbc6ca524d61f
SHA1 cfc1b93dc894b27477fc760dfcfb944cb849cb48
SHA512 5a4d2e0fa7a1a14bc4c94a0c144bfbfcef1ecabe4dc15f668605d27f37f531934778f53e7377bab0ff83531732dc15e9fc40b16f2d1f7e925429681bd5bdca73
SSDEEP 3072:MTvTGn6NTm+vpcUVBrM9mG56i5O6wKPudbCWT08hQPpoM:M/G69bvucA56iA6EM
TLSH
T1C504095763E8006AF5BBCAB88A724506EB777C625B30DA5F0610912D5F33B82FD39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkTools.dll

Path C:\Program Files\Process Hacker 2\plugins\NetworkTools.dll
Size 134KB
SHA256 476aa6af14dd0b268786e32543b9a6917a298d4d90e1015dac6fb2b522cf5d2e
MD5 d6bed1d6fdbed480e32fdd2dd4c13352
SHA1 544567d030a19e779629eed65d2334827dcda141
SHA512 89362a7b675651f44649f0ea231f039e0b91aba9f84c91545f15e187c6cbd07bbf3648a4e232dfe5122cf5636e67c458f4f7dab49ed4de3f3a303aa396c41d1c
SSDEEP 1536:mhhDibqaA8T+B++QWWEVGyEYfGup5oGjxNj8DsDdvsWch9dl/6RHyA8E0SHBZmA:ghGbA82+t6GLYfnoGjxp8e+ZB6RSALfr
TLSH
T1C0D36B17B3E4007BE5B68675D8A35A12D77378120B708B9F079486562F337A1AD3AF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OnlineChecks.dll

Path C:\Program Files\Process Hacker 2\plugins\OnlineChecks.dll
Size 222KB
SHA256 7336d66588bbcfea63351a2eb7c8d83bbd49b5d959ba56a94b1fe2e905a5b5de
MD5 12c25fb356e51c3fd81d2d422a66be89
SHA1 7cc763f8dc889a4ec463aaba38f6e6f65dbdbb8c
SHA512 927d785d03c1ee44b5e784b35a09168978b652f37fb73a1a2eeecd3583c28595fb030e8c1f87ab9a20beac4622775777820d1a2ad7219ba8b9ae8b6fbc4568a0
SSDEEP 3072:VDy7cjwTlCAlW0InMxf08ZyIjSNVnKJ3HzuoX7o+ThTPD0r7NF4jM9Td2xOdj+C9:Vu71TtInMxf08gI2HnKJDuG73JtxE
TLSH
T1B7246B54B2E50C78ED77C63AC9634542D6727C120764DB9F03A0425ADF2B7E1AA3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SbieSupport.dll

Path C:\Program Files\Process Hacker 2\plugins\SbieSupport.dll
Size 95KB
SHA256 57c56f7b312dc1f759e6ad039aac3f36ce5130d259eb9faad77239083398308b
MD5 37cbfa73883e7e361d3fa67c16d0f003
SHA1 ffa24756cdc37dfd24dc97ba7a42d0399e59960a
SHA512 6e0bfab9ff44f580f302cabd06fc537a9e24432effd94b50ab696b35f57a61772072b7f9045a9e99fa4bf3bc316f43ea25ab6c87517242e7957eb86575203bed
SSDEEP 1536:Im0GxwvasFsbgkc+kvtRSmgDzxdXsWZr9dlnVrUv0ukc:Im0hasFs8H+kvtRovrTxVrUv0vc
TLSH
T1ACA35B69A3E500AAF5728A74C8635E15E776F8121721CFAF0294428D2F637D19E3EF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ToolStatus.dll

Path C:\Program Files\Process Hacker 2\plugins\ToolStatus.dll
Size 243KB
SHA256 5713d40dec146dbc819230daefe1b886fa6d6f6dbd619301bb8899562195cbab
MD5 3788efff135f8b17a179d02334d505e6
SHA1 d6c965ba09b626d7d157372756ea1ec52a43f6b7
SHA512 215d6c3665323901d41ae5151908c4e084a04a1558617016f0788194304e066410b92943bd6c119339727037ee02cfda893b9baf5603b2870d9fc5ae0c77ca7e
SSDEEP 3072:tOHhxKcNnCYBFNFAKIkpgVIgHAuopbQfhVV2aOQE6o0bp94wZOeb299zBw8:UHhrtaV3AuopMMeb21w8
TLSH
T133346C97B3A1089AD5668E75D4738A1287377C911E348B8F0698F52E3F773819C3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Updater.dll

Path C:\Program Files\Process Hacker 2\plugins\Updater.dll
Size 110KB
SHA256 0c11cdc3765ffb53ba9707b6f99ec17ae4f7334578a935ba7bcbbc9c7bdeed2e
MD5 6976b57c6391f54dbd2828a45ca81100
SHA1 a8c312a56ede6f4852c34c316c01080762aa5498
SHA512 54d8b39457f516d921bb907615ff60a46b6031e1444a443c9657e06d78c9fb0f637ae4756bb7b884e4dca2f55902372ad4ddba1d020abe02e0a381702ae270cc
SSDEEP 3072:yy8QoSuThifQ0gUmL1lV51hdJFxZ9l1JtB9plRN51hdJFtVpRR5hJt0rsBLsGbOd:ZiYQ5UmBNerF
TLSH
T129B34A5763E4006BE5778A75C8631E05DB76B8621A31CB9F0254818E2F63BD19E3AF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserNotes.dll

Path C:\Program Files\Process Hacker 2\plugins\UserNotes.dll
Size 114KB
SHA256 fc9d0d0482c63ab7f238bc157c3c0fed97951ccf2d2e45be45c06c426c72cb52
MD5 e48c789c425f966f5e5ee3187934174f
SHA1 96f85a86a56cbf55ebd547039eb1f8b0db9d9d8d
SHA512 efdb42e4a1993ee6aa5c0c525bd58316d6c92fbc5cebbc3a66a26e2cf0c69fe68d19bc9313656ad1d38c4aef33131924684e226f88ef920e0e2cd607054a857c
SSDEEP 1536:0fiz3P6ZDIigvpiwyXtHaGFKNQCf5FlvULnQDCdxNsW99dlhSkkOZ8DCuB8ViFw:3P6Z0iGNyd6Gi7f5/eQExdL1kY8DCurw
TLSH
T1BDB35A57A2A5007BE5B7D674C4A30E05EB7278611B309B9F036482892F637D1AD3EF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowExplorer.dll

Path C:\Program Files\Process Hacker 2\plugins\WindowExplorer.dll
Size 133KB
SHA256 282696487ea5dc781788d5d8477b977f72b7c70f201c2af0cfe7e1a9fd8d749a
MD5 0e8d04159c075f0048b89270d22d2dbb
SHA1 d0fa2367d329909b6c9efcb3cc2c2902d8cf9b22
SHA512 56440f3feddc124574debfe3789e14d908982d4d8e9516f42fab7db7bcecdd3badd2f75e005016a7b9d87a00d5646b8df722bae8fba3932198babbe5335cf197
SSDEEP 3072:FrcYzsiPpE70C5FwyJBId/GkWXaVJ32kZ8:Frc0s502FFnS8
TLSH
T1DDD34963A2E4007BE4728A75C9A34E09D7B2BC511761CB5F0754825E2F637D2AE39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Changelog.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Hacker 2\Help and Support\Changelog.lnk
Size 995B
SHA256 01882cca6f979fa23d91369b5fe7ded58c369066720ce7a2f52de1c920a6a06a
MD5 80938cb8af64d9a87a0ac3be908197b5
SHA1 173f5a811e78ba4ced8746f22c21f884c80e8f46
SHA512 8e37847f8a6f49bc4d2361b0f5e3a5dcf6816db1294f07636b66a9609e6d648c7a3a3a9419bdefc830380d44ddd2919a56cb02467e0d3b57d6f1462eca48065c
TLSH
T1FC115C2817E13B19F27786B45A755E204F37F4A29FB4032B50C9D0850A68950DE2BF36
MD5 SHA1 SHA512 TLSH

Submit Download

Process Hacker 2 on the Web.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Hacker 2\Help and Support\Process Hacker 2 on the Web.url
Size 63B
SHA256 60a172e81a2c07e2006465f8625306e385b4fe57fca02ad5da8af91527ed6de9
MD5 645c95183495f00e4175ea7a25d3ee80
SHA1 2598d44ed2d6f3cf758b9983ea2c39bda4690315
SHA512 5c8a83e774b0264e032ea2fca66bbd65606648b39f57447669ae7c8f6f141677173f650a58027a46d180f7bd2df9eb301eac10665a5d2521f547be272c13ed33
TLSH
T16EA002AF850DC06AC5624A1CA0749A218E95A0E08566C6B8E2A4CE057D5B055BED8706
MD5 SHA1 SHA512 TLSH

Submit Download

PE Viewer.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Hacker 2\PE Viewer.lnk
Size 1KB
SHA256 15d68b24134cabdd7afdd5cb28d75c50c5625800ef776d00da06389c7c95660b
MD5 85e5d026509241d5ec7caca41879a065
SHA1 c5d570942b9b8ec7122564377f4e552ffb71b692
SHA512 af3ce0defc1cc0deac7f4fa1ac6b6d4f27fa1fe3abf239928dd64890228df3cd3eebde68f57e889fefc67d1f5539556d8cf65f0969b2b26aa9bcbe841ee3ee70
TLSH
T163418E2407E51665F2B388B55A74AE200A7BF4419F75431F40C9C28716B89A0DB7EF72
MD5 SHA1 SHA512 TLSH

Submit Download

Process Hacker 2.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Hacker 2\Process Hacker 2.lnk
Size 1KB
SHA256 d934cd5a072c3a18bcd46727963fcfe28d25cddcf3ab34adc9bf6d87f01d569b
MD5 c7239308415d3ac3f232183330dac6d8
SHA1 61abe5640ff0efef7007d9124df61f0fb3b3cb59
SHA512 09ab7f405ba611b50625400a4ba7a9a5c021710c00dfa3fe901c0a2495d31371142ef40aca6e105e0f5051a87b44755c34dd9379b1a1ad08b03828c3beaad8c9
TLSH
T13F41F72447E52624F27788F519755E204EB7B493AF39072F14C8C1860AB9DA1DF39F62
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall Process Hacker 2.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Hacker 2\Uninstall Process Hacker 2.lnk
Size 1KB
SHA256 6b46e4344cc09af73a18dbdd02226ae00b11f25cda1ea7bba7a7a03d6f1a5df2
MD5 caf0d28842cd46b39892505a2285f8c6
SHA1 13cb9396fc38abfea9a1056e05efee6c442e8f7d
SHA512 64804d4c192ea8d86fc8f5d49207f611fd5e3c9b72e560dbe503d486029f87024ccb244d91367050e72f973c129ca06fbd0fee4ff3aca5a496261419822ff9dd
TLSH
T164319B2447E41624F2738AB869B45E310EB7B8529F74432F00C9C2C649B8D90DB3AF72
MD5 SHA1 SHA512 TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\luq7t40t.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 c53010820b69a4576c3e2eb99931cd5d490ea4d05b41e0d7480cff62253c5ad3
MD5 50067540c33d3a403d39f11295788475
SHA1 cd9db4f44bc03b37e8774db2245d7e0aeb2f09bf
SHA512 95b4c8b7bb6a5734aaaec8a2ef1c6eeeeb7ba23ea4c4ca4488fadbe0e8ccacf68fe841d930adc64c074dd19bbae988fac3525e6941b23460a571ffbbe22078ab
SSDEEP 384:HbaFrLiO024Y+Fuhw+5EL1pPsac4j0lpDII+Y3M:7aAZY+FuK+5EB9sac4ID8Lh
TLSH
T152527E7E9F0238BA1A2BD2D4D9EE5208CE04D6BBEEE3D15705143844C684779B4F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\luq7t40t.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 31a64fa20808d97e90f31271d00a7275c4caa2a330286df32698ce0e37816b46
MD5 fbaa109c3316318da8db05fe430c4f1f
SHA1 1334f848baecb5229b48ed6922ee04f95b18f0a6
SHA512 21a6dbbc47fbfd8dc47bd6da17338339286ae5126f999e5a42b406ed5c7ccb6149798bec233d7afaf7179c5cd14e20c6bd3fbce17ca0c70e1cc5951a157e1916
SSDEEP 384:HHMO0iO024YBFuhw+5EL1pPsac4j0lpDII+Qu9u4:nrZYBFuK+5EB9sac4ID8LQs3
TLSH
T188527E7DAF1138B95B67D1C4D9BA6209CE08E6BBEFD2D05206043844C684779B8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

processhacker-2.39-setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-QDK8P.tmp\processhacker-2.39-setup.tmp
Size 785KB
SHA256 b10cf8cdf541ca0dd6df79e66fb4b0854dcac717aba034ba0c4961bff92fd021
MD5 1c96ed29e0136825e06f037bf10b2419
SHA1 b74a55279474253639bebf9c92f10f947145ff30
SHA512 0e74854d9de4e3944b2cff9b5de7eb19fdec1fee6c9576cae6cd81741adf84eac421cb743b1df30183f645ffe849357b6a85b5be8d7f6e2efe289bbe4573e177
SSDEEP 24576:rQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafMyx9CD:102rPD37zzH2A6SBIfNaf1s
TLSH
T136058D32F2A08837D1731F789D1B82D55936BE103E39A59736E91F0C4F796817A2B2D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\AlternateServices.bin
Size 42KB
SHA256 1fa395b27beb1222290bfb65ea46359100632d8a80a75cc0d646512511aff9c5
MD5 a1d9ba732b32ac5e74873d2449b007a8
SHA1 fca093da2de770d607fccc4d89f5de034957f35b
SHA512 79641b328bc6b0332331b5de27c8a086f775442b083e85a3612b8569ed413288fcf4ad96ecbcddc8612c141b708631c68c728bba880efe7604c825b8371fe4e8
SSDEEP 96:SPkTwUMZiB4OI56izDMM/pZMkH12nzJG/GjGcGfGbG+Dq45wEPhGiGjGcMtUBqFp:zkGQZMtUBqkDY
TLSH
T1CC1350F767B5A033E0918FBA409877988C77021989A851F8DF24A09702D67A5F07FF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\AlternateServices.bin
Size 10KB
SHA256 eaf4a74efad0e0f16d50d5ebf803fef94c52c00ccc05f672ba6581a9adf7c763
MD5 42373e5cc5dc758c89ffd87c888056bf
SHA1 abdb4a06be6836c03344d361b3bd6b4b6b281b85
SHA512 67ce9eb5c59d76cfdacb59d6ebf61c8f1545e86d52a0a314a6a96afa3f506aec80b26bf32b855d523f6284a7f22c43c549397260b2092e8c20739db0d8271272
SSDEEP 24:huhMZi91DHeB9xX4M9B74M9Vvl475q9F55A5G4P9lvOWN9VxWAH:8tqN4+p4+Bl41I56G41VOM/pH
TLSH
T15A223CF76BB2A462F1A28FF4845D768C9C330325556CA1D4DA5480F742C2BF9913EBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\AlternateServices.bin
Size 35KB
SHA256 2d17223b2d904ff73b3dbd025aee7265ed0c6d4e5633dd1e7fc3f08a21d1e728
MD5 30e2b9d70eb903b2ad7a1725d8c93058
SHA1 0c4d09b1df2852425a5c8f8edeceb7f05fbeba76
SHA512 947e30afdcd638d489bc2624c7a0b7dee8354a6727cacdd52a82158c887d65f2e3ec233281009eb903a878dc318c9b831dc5cadc21564675cfab4a7ff7c71b7b
SSDEEP 96:stqN4+p4+Bl41I56G41VOM/pHMkH12nzJG/GjGcGfGbG+Dq45wEPhGiGjGcMt:/QfMt
TLSH
T1D7F232F767B5A032F0918FBA409C779C8C37021999A851E8DF24909702D67E5F07FB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\db\data.safe.tmp
Size 50KB
SHA256 3c7378320ed7cdc816342ca05b2ec29503fcf7748a9bb274914754289b7bd70f
MD5 42413a7bfe2e36dc81191ca620276016
SHA1 196a3debf44c08a209b00da70902b6b84e844e8a
SHA512 77f461cb2de0311b07652de6a2da0e130fe5ff136c33eb2dac096b8fc97e570c6790e611d6302709e5bd4b10b12e699f44c6b101d09e1d68b23f1eb4a388d20b
SSDEEP 768:1UorgiUbxRQj2Ms4cjpJ3DsO2WJGcmhuzXMsMKRg+5IZpb3bobFb9qpPP/:WbvQj2Ms4cjpJTsOtXMsMUk/
TLSH
T1F3332344EB1E513FD42812BADDA11B002F79F88A591A2FAB370C55686D872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2868355a482c78b8289c2c133df02ddec511d6a78bbb9fede2320aa385f9ff71
MD5 be1ed9d387fb7dfd387146e9b5fb9d38
SHA1 416ca5aacbc8a9a7d78aa0a30d076211563fe8c1
SHA512 d74245d8a80d99d6927ee4e28e17b8d8c3ba67401e045909cc49d0e31831c2315f6ce7a8c053a380e1e0a829f0d275c12e3706d99edf18451907c3311c133a73
SSDEEP 192:Ym1d66Joz1zgCl6mc0dfUvOv5zboBZmQCIyjfnI:YAd66Joz1zgC1jFUAboBZm/IyjfI
TLSH
T159D1E058F629463FC458023BDCB65B800F36788A989F7F25319C244D2D572CE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\events\events
Size 1KB
SHA256 bccf955698cf10752d299be03528fccdf103790e9cbbe6afd79cd06f5a0fe2ea
MD5 a849bd441b60df30a66b9fb1da53d2ca
SHA1 e800fe827166a6c0bb030a9788fcd5f0a40842db
SHA512 8a028c41652f706c45e5fc1df85398218661e2fd25d0e18eff06405e8d8efbc977777d2a9609ca83a092c9e7c85f13c930b74f239ef5ce29bd14132a57107390
TLSH
T15D21484C39F88D2AE8D6F6AC7845028E53958E0604972C830D62DFCDCDD9AD9326A478
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\events\events
Size 5KB
SHA256 68e108e06cc26c2e1d6fe8a17bc412f9335e3fc0990fcbe67b194514c15f4eb7
MD5 39fbc3545df1ff343dfea30fe1cef10c
SHA1 743453615bf589d220971c4ee57181cf51e2259c
SHA512 9bad346efa8c8cafc1ddb4122da8874d40e843830c4c67eda929ef0a84ef4fa373a5a6a2596077806333345e60e5bcf3288bc1ef6f72d99e0f2c6ae3da7f1357
SSDEEP 48:YnHbl6yAkPRLLWcKbmV/wqWH6IBoKl6NE7iB6+/64Ajrd+Qd0KEtEOGugQ4eMLfI:g5EqpioKgC2Em64AvdzduT4e8F0S02w
TLSH
T14AB1101C65A91C7FA9E7E2ADBC4503CD42D9470294DB2C874CD7CE89CC8AB8A311F479
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a74e2c1-82ce-4ff3-b3ba-66400d7c366c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\0a74e2c1-82ce-4ff3-b3ba-66400d7c366c
Size 886B
SHA256 b7fe076f9847c3cdc4409e8d2fba8511a83445a15d0d0c4fddc2c4a430f66035
MD5 65f3b83fbd78261c2019951641182b50
SHA1 0ac7713477d9100251cb207747797afafe046d1f
SHA512 98a045500994ebb41dd6945d7350351e0ddc5487051b1658471ccb9c7f6ca1a556dced62be4990757295087259b7d03fa1f7889d5c269677e60cb3f72c74d8bf
TLSH
T1F41167C06B2578B2CC78925BC5F1BB4247E8B127C0C648107E905F080DBF54E579720B
MD5 SHA1 SHA512 TLSH

Submit Download

0ac6d9a6-1a01-40c8-9516-a23e3f676d7e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\0ac6d9a6-1a01-40c8-9516-a23e3f676d7e
Size 235B
SHA256 9f3b6c30c5535123b88af003f9ed9648ea5fceb1b158d9d4ad6b4dab07761615
MD5 e45a37b32f0f56dd859a4e7e8e46d146
SHA1 01aad28d8a30f735c02f008360fbd574a3ccd113
SHA512 be21a50d32e104fb649e1936a6814607299aa8fe195bf2d48e4d5067266caf01dc646f09d4ed0dcd9612d0c6d8478ddcf49566d705349d3edd27870f8222b58e
TLSH
T1C8D097802898A39E08180F17B0F029C630844C3320B47810CE61047CAAB8DC802A2C2B
MD5 SHA1 SHA512 TLSH

Submit Download

0dffc9a8-55e2-4c71-ab8f-856d35b47d91

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\0dffc9a8-55e2-4c71-ab8f-856d35b47d91
Size 2KB
SHA256 68fa0930c3b77eb2d130f60e08bd4ce1c9817e76123af87079a5040bcdfb85d7
MD5 e5d969715ff4a48886132c13d0c0f329
SHA1 d83608f14cd4afdea7a590b076982283edb06ea1
SHA512 834c0e7597300f3a5a6c06a46b2af2e6ba7548439447c9365f658d45c0d9ec72fba8fd4b733a0711eef0c87e57b35bd8456b783dad54f8f9163cb99a62d0dca0
TLSH
T1A541215835784C7A9DDBF16DA482338E57608A2740C61C532E41DF4D8E966EA33AA83B
MD5 SHA1 SHA512 TLSH

Submit Download

54ef69e0-6ca5-48cd-8ce3-c9171388ba5c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\54ef69e0-6ca5-48cd-8ce3-c9171388ba5c
Size 235B
SHA256 bab461c4bdb6f8781d662d9036e0ecbcef752b096a4e5396b72fbc50cb5e3316
MD5 d862a75bade0f411e417d81b46dbdc0b
SHA1 8cf6d488ed65011e8389c786052c0737301fa20d
SHA512 b3fbc51b9761f362d1efc184878d60cf100be34f19a17281712f9b410a36a04790ca02613c172b3634651b9ee338c2dce1d92528a0d47a899ed02d1acb941208
TLSH
T126D097C028882B1E881C0F03B0A028C630C6CC332464E820D9A08638EAFCEC4419192A
MD5 SHA1 SHA512 TLSH

Submit Download

616b9b49-d670-4904-b39b-2f4246434ac3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\616b9b49-d670-4904-b39b-2f4246434ac3
Size 883B
SHA256 a58675cbb557ff8a47453e7b1410fcd342c9e66f0bcc933ff5f4cccb586177a6
MD5 ebb75f7252c82bb0b2c10b38fd353609
SHA1 fd7deac45fdc4f76059fcaa59220ad3b3964befc
SHA512 63fb82874a0df81c0707e01cc202e2b546f1b86551dbb9c555690a8b567f59ebf244e4cd3e6f083a618f0fb3503f8361c226f299e831de338a7da30b561a0922
TLSH
T1A81104809630B8B2CD78925BC8A17B8357E8B51780C784107EE00E080D7E55E9796517
MD5 SHA1 SHA512 TLSH

Submit Download

722aa3de-99c3-4e09-9a1c-b0dd2e5d280b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\722aa3de-99c3-4e09-9a1c-b0dd2e5d280b
Size 2KB
SHA256 8f5f0d6a97e346908ea191d39d7b3d670ac605fde7abe523ef620c8ec7735f59
MD5 788e8904350676a4798d9b399df1c92c
SHA1 cfc43f2db3faf7cc66efa577ee33e9fc528dd78b
SHA512 d96db8f1bb43965fe5761e435e26b3287613652eda0c40e72bbd00f2d7ec423f8952631c45e4aff489184039e3034dfae61f36faa6417f6cfe654628e146fb2d
TLSH
T17D5194659160CCBEC979B31BDC213B83CBF3140A409B185EAFE8AF0B117F95E9399605
MD5 SHA1 SHA512 TLSH

Submit Download

ffacde2c-cd21-4187-9147-26fbd16612c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\ffacde2c-cd21-4187-9147-26fbd16612c4
Size 22KB
SHA256 62ab58e101a08a82f80806f20cb64dd47be270d893dcf4469d4c418b1e89bbe3
MD5 ee4d26e447804d7bf880f0ce55536bf0
SHA1 1c7d5d615957dff68bb1da3b85ff77dbe6fa0761
SHA512 5834a688cccb219300b3e437c23b6508ed88f650e021d55afac8883f815914b651ae1f16063919352f4026849416629aa00045b79319dffbab5f8bc9778aff4d
SSDEEP 192:MvNqMXyZnmlfsxWmF65i7dSVAGj7SOg9XDwvC/b:iIMXyZnml0xWmF6k7dOAGj7SOyXDwa
TLSH
T1F6A20AFDDD1200473E25E62EF2E6ADAB2017193149CCC7CE29FD083A26D69B74527768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\extensions.json
Size 16KB
SHA256 96b72e7c02c44583f4f2382431f5d26f84cd191a55405cb24c44cf75dce4ffe8
MD5 9770371a473ac68e7978fd3e93d40c09
SHA1 0b9fc419971da7bd0cec68945550f37919e9dc4b
SHA512 10b99f9b58e2ab9a943712203481150f60ef340ae19f5d7a80aa303b0e73727dc788e95a2181420f08c092cdaac1a9afdf44622f0c9478bfc98f7e503fba2ed7
SSDEEP 384:ikI4vzUmldvW8dhW294zH96o1CL4He4L4PHL4HSL4HQWL4HTQ4h3:VI4bRfbX/4x6B4/4D4A4wc4M4J
TLSH
T1FD72421545048EB8298F979AAA367E01C37D533B60855C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs-1.js
Size 8KB
SHA256 cbc0087425202cc22637954d65881891ebe8c2ef2efc0cbd410b8c614d7b1127
MD5 8732f3319ea7f69169f22280b34ca691
SHA1 56a9d75293405f8b9ebaeb6079aa990bcde1e0fb
SHA512 c98c2cfdab8fc555b0eee1f3a90a12179ca903c530426b1e26a4ce2f65b5eb7753785597f51a87da5ef501b1fd00bd52e61c5608bee53503381fc9230d64792d
SSDEEP 96:xHL1TUSVqGq5feBBDNNbzSJSSladv9juCnAWRMZ0gBw88IeIMY8L4cnFS7GmGS:tcR5fejh8SSIRqBw88IysqA
TLSH
T13A021F789104CF7FA8B6367C6C2889706AB2017BB6BF68C754B944C4054CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs-1.js
Size 12KB
SHA256 cd8f4f975684f6a2b675f0da87725d8f4a22e99939aa9aaecccff0b54920d2ec
MD5 1286814d9056e9b45edb37730cb0d64f
SHA1 233308ca2f6071fdc953c9006f166655c55ebd46
SHA512 16141b3e6ebea5f8009fab68585d40cd1fcf61bcdcde28315f38b79abbfd08031c647ac7171f770d1ec39d760bec5b2c3075fadef0b830375e89518a103497b5
SSDEEP 96:xHL1TUSwPqGq5feBBDNNbzSJSSladv9juCnApwoDRMZ0Y/zmBw8OI7kmQxMFz2/n:tcCR5fejh8SS7LR2zmBw8OI7+xMFzIqA
TLSH
T14F42E03C54409B3F68B7327D6C294AB02AA141B7B6BFBCD345F984C1049CF6441E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs.js
Size 6KB
SHA256 d4c24c321816ef0c72862bcc9d8eeb911909127ace099e5b40cf481c5e82ce5c
MD5 2e5c3689700d07845c90fb796e04393c
SHA1 5c4a8f6a34e2fa657847a1225393e894daf2d823
SHA512 a3292443aaa59f971a5c6ab95e8dd6625f7b905204152c127e48433c496ea5cbeb74adc2e150e70709233fa7eabb81ecc2e3655c84031e10441b292ba691916d
SSDEEP 96:xHLUTUSVqGq5fxKjqnjV1zSrSSladv9jyDnAHVLBw88P8L4cnFs7GP:t9R5fxthSSSXqFBw88BqP
TLSH
T1E6E11F7894488B6F68B6777C6C6888316AB2413BBBBF68D710B54484051CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs.js
Size 6KB
SHA256 9b815842567c1899b29f871b9e5fed84397a64008fc9201c6c3310a54e629827
MD5 90d3b634addf50a1b561b7aea6171be7
SHA1 815d586ebb87fb05642a98b9c2fed5098bab37c6
SHA512 1b7aad51144b2b41c9bb56917d7bed07fcffd17d853a867cb8127d85fb76c7772652f4adcc4e63c7d9f4c5dfda9f243085507c92ff0c8b59f3f9d08f084a7743
SSDEEP 96:xHLUTUSVqGq5fxBBDN1zSJSSladv9juCnAHVLBw88P8L4cnFs7GP:t9R5fxjhYSSBFBw88BqP
TLSH
T1B9E11F7894488B7F68B6777C6C6888316AB2413BB7BF68C710B544C4055CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 e67b487fc19311f427b5432d11f697e6475740c0fe094f960af52a0671d3552e
MD5 8019c15f63247c324c102a7ec23279df
SHA1 2df43ca9a47b39dfa3ac44da298b0ef8b7bc1f4e
SHA512 71e10c5b8ac974c532ee1cdac6beb618821638db57912069917901dbf0c59b55c4b49583d7f7cabd746689882becb8ae0de50f12b1983fb2979f463583226ce3
SSDEEP 24576:ZCWk+tIYI0Lgrb63BDcYrVQpa9dfH9EQ8lQyjH:Zjv7LO6pcYrVEa9d/9EQ+Qyj
TLSH
T14BF52AF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 8e4cf9bc0660838551a7a2c6c6ee8b649e8564ae3fefe0fa68a563a6f684b450
MD5 a8022bd63ed1c5d8ece0d0d571f355bf
SHA1 3a2eb44ed1c229a937e2a5370c456ba92738c235
SHA512 5a2a4cfc05e463576ae49a7501b8af1e655af73f3b9bf207651dd72dae1d1b3e2e9604489a2d0f4536c984fe51113dcafc7e0a11bbf3b7ef2ea02873bcadf213
SSDEEP 24576:bCW++tIdfnUarz63BDcYrVQpQ9pyi9P28lQyzH:bjUvUs6pcYrVEQ9p39P2+Qyz
TLSH
T1C1F53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.8MB
SHA256 42ee923b1a22ec92dacb0f6b6d51aabd1074799c5e3f9ec13536c4509544395c
MD5 8b639bf9ec89c7f4bb7329e9ea0a2354
SHA1 5f5e1fc2965304ff517841253d89f0ee603493c4
SHA512 0a9da4cd02592ee69b843fdb54039c7cb2436d66ff72b61c30420c68a8521a7266367b78802f1177ca57e6e4b3cff339564730fe8344ca7e0f42811734defa11
SSDEEP 49152:YCa9vC/6wT3LkrA94Q0stMNNecYFEO61jVu:JaYF3wrA94Q0sKHO1
TLSH
T1B4365BE860D1A343F3418073B589A3EB21BFC00C60779D44579956E9E5B8CEF8E16BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Process Hacker 2.lnk

Path C:\Users\Admin\Desktop\Process Hacker 2.lnk
Size 1KB
SHA256 f2dfc105957383436b0ee2b88aa6f6c00d9c9a0806a39f194a5e453efdfc48a8
MD5 9894b7539176c917509e648cb45871a4
SHA1 5b9788c754052419f56765e8012195181fa05ab1
SHA512 aa7de49d5e4f0c65ff831d6e6cad348a99b1b3547ee2a259e0cdc540e32315d75163003fd75778514c266b0977b1703fd1860749185623d897cee7481594bb90
TLSH
T1304148244BE91124F2778CF519B45E200EB7B4935F29062F14C8C1470AB5DA1DF3DF62
MD5 SHA1 SHA512 TLSH

Submit Download

processhacker-2.RGHO043i.39-setup.exe.part

Path C:\Users\Admin\Downloads\processhacker-2.RGHO043i.39-setup.exe.part
Size 2.2MB
SHA256 28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
MD5 54daad58cce5003bee58b28a4f465f49
SHA1 162b08b0b11827cc024e6b2eed5887ec86339baa
SHA512 8330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829
SSDEEP 49152:l9hfV/U5NkLXXzGZjt6kFTCVP6hWE0wvmk/eE+FrAl+NGsOSE6IX8pq:Dh9/ULkjKxtTGP6VZd2rAcvOSE6Nq
TLSH
T14CA53303DF540D3BD5B79B76973FCB154E6A734528346C63B20D5C8E8BA47A288923B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2796-1237-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2796-995-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/2796-996-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3456-1238-0x0000000002940000-0x0000000002941000-memory.dmp

Download

memory/3456-0-0x0000000002730000-0x0000000002755000-memory.dmp

Download

memory/4308-1236-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/4308-1235-0x0000000002280000-0x00000000022DF000-memory.dmp

Download

memory/4308-1002-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/4308-1003-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/5644-1245-0x0000000000010000-0x000000000001B000-memory.dmp

Download