Analysis
- user interaction
yes - max time kernel
83s - max time network
77s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/11/2026, 14:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
takeover.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
takeover.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target takeover.exe
- Size 280.9MB
- Sample261107-rmybbadx2l
- SHA256 f37e11e61db2c8d630d5b9d61c77f332dd90bac49453e4d72c1974b37344ccd4
- MD5 81d908a7d9a4d36996b91c48aa42c15d
- SHA1 faa11c22491f7b57c39dd7a5b4e90ca06825ba15
- SHA512 92ba7319761a5db3bcf2d60acf91adfc87364e4a6f8919d13c798abbbf790abe120b1462ffaf436d7a486a110e009acad3223b5684612a07b68bffb065c40314
- SSDEEP 6291456:upC6m0QDRxbAliq5yNjp5zaJCi/Byg5e5BAjpeN94SS3F4Fi0B0lSOutxZ9im:upXJQDfbW7y/kJCG5e5GjpE41a8lKt3J
- TLSH T174E83312FAD696BCC09BC470875656665A3134CF0F316AFF41E096383F6ABF05A38B19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies Control Panel 19 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\SizeNWSE = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\10Diagonal.cur" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\SizeNESW = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\10Diagonal2.cur" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\UpArrow = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\14AltSelect.ani" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\Help = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\01Help.ani" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\SizeNS = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\08Vertical Resize.cur" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\SizeWE = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\09Horizontal Resize.cur" takeover.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop takeover.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\Arrow = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\01Normal.ani" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\IBeam = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\06Text.ani" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\NWPen = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\07Handwriting.cur" takeover.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\AutoColorization = "0" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\Wait = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\03Busy.ani" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\No = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\07Unavailable.ani" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\SizeAll = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\13Move.cur" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\Hand = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\15Linkselect.ani" takeover.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\Scheme Source = "2" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\AppStarting = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\02Working.ani" takeover.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\Crosshair = "C:\\Users\\Admin\\AppData\\Local\\NosferaTakeover\\assets\\cursors\\05Precision Select.ani" takeover.exe - Runs regedit.exe 1 IoCs
pid Process 2344 regedit.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 4660 taskmgr.exe Token: SeSystemProfilePrivilege 4660 taskmgr.exe Token: SeCreateGlobalPrivilege 4660 taskmgr.exe Token: 33 4660 taskmgr.exe Token: SeIncBasePriorityPrivilege 4660 taskmgr.exe Token: SeDebugPrivilege 4336 taskmgr.exe Token: SeSystemProfilePrivilege 4336 taskmgr.exe Token: SeCreateGlobalPrivilege 4336 taskmgr.exe Token: 33 4336 taskmgr.exe Token: SeIncBasePriorityPrivilege 4336 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4208 takeover.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4208 takeover.exe 4660 taskmgr.exe 4660 taskmgr.exe 4208 takeover.exe 4660 taskmgr.exe 4208 takeover.exe 4660 taskmgr.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4660 taskmgr.exe 4208 takeover.exe 4660 taskmgr.exe 4208 takeover.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4208 takeover.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4208 takeover.exe 4660 taskmgr.exe 4660 taskmgr.exe 4208 takeover.exe 4660 taskmgr.exe 4208 takeover.exe 4660 taskmgr.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4660 taskmgr.exe 4208 takeover.exe 4660 taskmgr.exe 4208 takeover.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe 4208 takeover.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\takeover.exe"C:\Users\Admin\AppData\Local\Temp\takeover.exe"1⤵
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4208
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x404 0x40c1⤵PID:216
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4660
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"1⤵
- Runs regedit.exe
PID:2344
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
- Size 64KB
- SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
- MD5 d2fb266b97caff2086bf0fa74eddb6b2
- SHA1 2f0061ce9c51b5b4fbab76b37fc6a540be7f805d
- SHA512 c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
- SSDEEP 3:mnlllGlll/l/lXp9ZjrPBY06llSl/gX/ZP:mll0dPBY0O0uXJ
- TLSH T1D053019562930667C852033848CB0BA63A7A9619979345A282A49270D8A9B6584A2299
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
- Size 4B
- SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
- MD5 f49655f856acb8884cc0ace29216f511
- SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
- SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
- Size 944B
- SHA256 878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
- MD5 6bd369f7c74a28194c991ed1404da30f
- SHA1 0f8e3f8ab822c9374409fe399b6bfe5d68cbd643
- SHA512 8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
- TLSH T18811924A3AC71DB8F37A6D71006991242202B2275CC2D61C4AC4C6A98B35618E476FA8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\frame\completion_owned_by_realnosfera.png
- Size 960KB
- SHA256 0ada793530f2ab9d57fc793756d0bd94304fd9e84e1a52fb8ff5ddad5a371581
- MD5 e6ced53b7dd9e18409e310e1a7bf9221
- SHA1 f220e092d5a33ac95601401658d2becb4e402a53
- SHA512 1a55330def812b80b82d1a14a9814ac148891d7505486a59f7e633f91e3fd3d764232e4f96d4d4fda33fe5c7a5020067db8acad6ee3fa147519d77e7248ee764
- SSDEEP 24576:E3WLllrnikh3ASyVn+fkGsUxio1u0n0npClFM0o:WMl1nBtAxtNQrNot0o
- TLSH T1F8252387E8F4FE256F8F243342001F038A67D48B16CD9A1AD665FF4D52B1E368941ADE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\lockscreen\Belle\1FHD.png
- Size 1.6MB
- SHA256 72d01730491af149ebfc08c5d7b492440289bcd95d5cd79e45f241ce351b1f1b
- MD5 758f87c6da69655eb5861e30e69d4cd7
- SHA1 d6238a1864ceab4c41832644e9e8a90ee56720e0
- SHA512 241c8cf273ec061bb50e65efc419eda089a459e2f4d03038a7d216977d3481c9549955de56be3f94d2645c0b9f0410f1b3ebcd13f67b8c254d428ea14aaee5de
- SSDEEP 24576:3r0KZolixnc2LtdCUm1ByvFnlWbVdpuHmfT4WSLgToZkegCSXeusJZHCredB/mnp:WcxcudCUCqUbVL5sWS3ZfgT2DkH7+SD
- TLSH T1B37533EFFAF38669F151F1C14871B7256DAA744BEF9511C089887C80E12EAC38795F09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\popups\Belle_Pixel\b_1-fotor-20261106231644.png
- Size 747KB
- SHA256 69aa7010fd2e71606f17f8692ffb76f95ca8a6250f6c0739f1b41005f1b5bbcc
- MD5 c88e663eb2df0998b6ec459639c5dd45
- SHA1 59672bd2ebe37d96a05bbb27f76432f54ba422ba
- SHA512 52d3b956d1b1fd986481f555917989220dc4d714242927de3728ab8c9ea4d2a3420bef5fc86222126902ef35ba6208ccf0940123bdb7e31dafbd322b19f2db3d
- SSDEEP 12288:HF9pv0cH6rly96QBihM6/0xjbWSjzdO2UYB8fV7URmxGTzFW4m3DGFarJpG8EIxF:jpv0cH6rlJhM6/4P3PWd7Fk0qF6Jpz57
- TLSH T1D0F4239A7190D7B5EFA324144251DAF46D1BE2123BA1F36A1AF8C30D1FD7F008AE1D5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\popups\Belle_Pixel\c_1-fotor-2026110623158.png
- Size 603KB
- SHA256 fbd40bd3297ac3dd5c87cf0bfa20e965914f877824af1a1582353a6048f8a6a2
- MD5 bb6e51fa835be0e8e5d8b5e18a35ea92
- SHA1 84f28ce9084f4c62b0836a2ce2573b4ed4e31048
- SHA512 961b43bd102b501cd6f826bc0b5a7b70bb1d0f69fdfef1cdb0fc49fa7635aa4f7d3cbe7431811f800a3482a16774356d1d7c6f76ec3ef537611aa8be877dcc21
- SSDEEP 12288:HKN6Ec5zafrP/gBfRUvvxA+evNUi5D2+o9rCAipA1VUka:HKYEcJafrqfiHwU+2+otCA0G+
- TLSH T17DD423FEC8C04EF860B353B9E1FDE7D91282145B07F959A248FE060C662D72A4835F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\popups\Belle_Pixel\d_1-fotor-20261106231453.png
- Size 834KB
- SHA256 5546941469445571cedad6464baecfb14d90917d426043303bb362d0c2de26b1
- MD5 80f296d6a3b6ed6764c3e06c89b897e4
- SHA1 3bad8a334b32318349876fbae4730a9715710bc8
- SHA512 7a947db79d12c18e4ee7b47ae6196853ad90f5fb8a10ca08e2acb887e63a9c9e799b9bc93410c21efa769feb9be80eb85dedf8433b49f02cf24a5e79d87aee29
- SSDEEP 24576:qQADHPiwB3G8+/YVnQC17gd0P5Odpm5fncLs:+DvllGPwV70dO5O4n/
- TLSH T10405232DD5D177B2C8D3CBCB1ECA349AE48066E1E6D48852EA2BC5434E5C74EE7D1E02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\popups\Belle_Pixel\e_1-fotor-20261106231635.png
- Size 683KB
- SHA256 4aeb064837f924c1d4526ecdb069b62322e40b2f7f2584551377b185b625e1f8
- MD5 abfaeb3018896c97aede05e27f8371c2
- SHA1 9c2bb08714a4545aa3789555f897aa148eee838a
- SHA512 641ea8fbfa8fdff1fc717b4a1f58cae40e487b86c2ace19e157aef29b299fbd2111df910468cb5ad0da7230d39cca46ffb016e25becb1d260ba2f36b854d5b1c
- SSDEEP 12288:wqd1ObU1Q5LI46ZMa99lqhaeSmwn1DJC4K7tBYvikp5f6xt5dqkkCqLpLBhT:KbUII4EM8f19C44LkS9d7k/1T
- TLSH T122E423E0C5CCF7F2D07B4382FC265B41803B96A113D5C35CAA66AA1D2866F1D97A2F85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\popups\Belle_Pixel\f_1-fotor-20261106231623.png
- Size 471KB
- SHA256 8bf33d7b3f558cb77761234fc6992318956333b275f3a04c26c25478f1bee040
- MD5 d510375fb14e15da4acbf6a64a5b07d2
- SHA1 d85210eb2c588e3ed7f6725c6ec817f6e5509739
- SHA512 20941f58d241667b85f48541a14c1cb34c5931f6239fe4677744c43630cab746501a736e82da563d47cc5a5a161e1b7a125dc0b0b6e2590d2b29412b8b6a8dda
- SSDEEP 12288:BXaqANvZzBlxJe507MHPGH81+xlPZoINou9:B2vpBHgGH8exnoG
- TLSH T1F2A4231E828DDFF6408E131EAE76172052D98C987331764CD7E4496F21B7792B80A7EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\popups\Belle_Pixel\g_1-fotor-20261106231614.png
- Size 376KB
- SHA256 2c4061f87651c030860a96c01bb88059f2bb3df592db4f8e3026544c5a8db8a5
- MD5 e1f4b3acbb242781f0910de2ae691560
- SHA1 5533932c9be31f110cae10b674f7750b702659b6
- SHA512 c7f5464b3aa2974307e7b04dd4348c494f495b3772e515e710a02f8e37572c0d50222aa4b8bc13ef82f0dba4d9f5f4fa19a61c9139e08b2f5a3520c56ececd54
- SSDEEP 6144:VZksZFl55mZtC6nclfoYZ+JRm4mpv/RQ2Q7dXJv9myCzJKD9v+ez32Zf:T7r3mm6cNodfYSzJgyCwx9m
- TLSH T1B5842349E68AE3F2517A47E39856AAD730CDE44227033509AA38F4DCC81535BDDF2D89
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\popups\Belle_Pixel\h_1-fotor-2026110623165.png
- Size 528KB
- SHA256 bc97058daa63ca6e8aa0ae1064dd2c2da9ee39ed0f5615fc68982a3bcc0cfff7
- MD5 4ea3c0fb116887c0c4e94c74b3a25971
- SHA1 c32ae82f04cc1c5e0edb416aa51a5dca19d9fa9d
- SHA512 eb620d9d4ae6c412621025c9ae05d876bdf28e660b8dce06b1cf4833d8c2b6876c69a1be4bce42bbd33464f79bef89df3b3a83b590564a1e69a598a4b2e76577
- SSDEEP 12288:+bREBdhb33DM3ZMcyD7YhPCsKTcW2Ag68yh:OohT2S7D7Yo0l8
- TLSH T13FB423DC64F108F1CE773C6249A855D014A5E1C382B95F88B2B9E527D6A3F0A1FDEE60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\popups\Belle_Pixel\i_1-fotor-20261106231553.png
- Size 658KB
- SHA256 7e29d82b8abd5b880781b51381f8349cd1948f17a4f16be31393989911df8b72
- MD5 bb53989b417494302db2d1c874276719
- SHA1 8468da6b5b458ea469156d96f3792615f9b38b08
- SHA512 57ebc021316b16070037eb0b80c2a6956d23d37b057bdb34caaf00011cbd643f86b14f41f66a712aa441dc4c9e13f7ab3ec144040ff138438e8012e8bbd9e44c
- SSDEEP 12288:t1h6dp5/gTuVeR4cgwldJDmWN1uxXXBl24lfbP52iPd65:t1hUpJjafgsJaWNk93lfbPlO
- TLSH T1FDE423118CE192F9FDC3848A0AD9AC4D4248E199B638729C187A917D64EF7BF4C47F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\popups\Belle_Pixel\j_1-fotor-20261106231544.png
- Size 263KB
- SHA256 1adbaacbb0f2e3a9871f02eaa4596f152dbe336eededac3550c270be512019e9
- MD5 88d97ea177a2ba9e41e1d868a002f70b
- SHA1 d1b818f35552846b70f63fea64e6d74d2cfcf58d
- SHA512 43807feda5d39daf813edf7a395c42f6ea0d00b0417bd00b7f09e6035bb27777aacf982bba7b61d61609ecee4a9ae41c14f21e5552d1de3969bcec125c24e85b
- SSDEEP 6144:QR27FPdEmmsrpuMa79tWQ/NpV1hIpg/AzKnmqlCx51qmcVR:8OFEmmsza7zWI71hIpGiTnCVR
- TLSH T1A5442386EACF936C500AA7209439CE3B493106A7735107FF17FEA965CF1861686F94CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\popups\Belle_Pixel\k_1-fotor-20261106231532.png
- Size 278KB
- SHA256 50c1fe49fc3dc9b6c3f45074519dae86d96645f1fc152ec33b6b03852dd9b256
- MD5 cdc0edcdf5d5dea5817f6817aa6e396d
- SHA1 c959155e3f7a9812aa2806932ce5ab441767382a
- SHA512 004f9848b258231629ea630b994a323a3347988766801cc6eb016265e4a4a8278f5680e24a164249de85d70160d2e7bec59229488708ccd0f48425418f4f64de
- SSDEEP 6144:KSnpbhNM4t+ROIgSOWCN7e43tO7b6eH+37U:K4pXYRIw43k7bFC7U
- TLSH T11454236891255BB8A973959CD0CD607C9690C8A13B20F6E1B153313E753AFB5C09E73E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NosferaTakeover\assets\popups\Belle_Pixel\l_1-fotor-20261106231519.png
- Size 792KB
- SHA256 186930e732b08a6111cd4c8213498766950005ab4270495664657e51a01f45ac
- MD5 c63102c16391323225dae083bae808cf
- SHA1 87cc694fbb311988501435e2662d51931adfa176
- SHA512 75f189d004f131d4478f1d3a4fd9038c6636247b95471a9dee932998b244099ebfd4d09e0a231e4c4517737ce685d4da6a37c2c43928705803df72a309474c1a
- SSDEEP 12288:XTGDjtIUVXGGu21JKdwYOME7HSexhK/uPiWZNx8hpNwvsaeNl1THQiJOHv/0F3nY:jGDJIUV2GuqQdwY5Mk/oHZNOwvuwZ8Fo
- TLSH T18F053367FDA107E3F07392756222310EC69798792B8DCB18A83A845F16777B3C487E46
- MD5 SHA1 SHA512 SSDEEP TLSH
