Indicators of Compromise

d23l50n6ubud7p.cloudfront.net

http://app7570.s3.us-east-1.amazonaws.com/js/set36418917.exe

http://app7570.s3.us-east-1.amazonaws.com/js/set36418917.ahk

http://app7570.s3.us-east-1.amazonaws.com/js/set36418917.a

http://app5805.s3.us-east-1.amazonaws.com/js/patch3265343.a

python-3.13.3-embed-amd64-with-pip.zip

d3nh8sl98s2554.cloudfront.net

subprocess.Popen

api.json

da1cf68c9dc1cebcebf8ec7d1cf99ac9c0291db7b21bf279b9cad24c7a49948c

Obfuscator.io

3199ff1aca5f78f4284304bc58513fe0

extension.log

environment.However

d385m5skczp5q5.cloudfront.net

d7xpwoah6gdv2.cloudfront.net

d3434apz0x8t7d.cloudfront.net

d2g6dl71gua1qa.cloudfront.net

d1jp293q9tvi92.cloudfront.net

patch.html

e88c196a86c74ea0e53dfe77c93f577cb441ee590756cf7f3284522a2d6a6be5

WinHttp.WinHttpRequest

dream.js

dream.html

s3.us-east-1.amazonaws.com

232bca658c585627830623fcdce56647dc291666b25c901ee56212681198067a

hosts.Attack

cgbasmlfsbxgvpdobvyly.txt

helper.html

CoreUIComponents.dll