Overview

overview

10

Static

static

3

2026-07-06...yn.exe

windows10-2004-x64

10

2026-07-06...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 22:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_3689de55160fa14ab6ab68f6efbf4d71_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
  • Size 518KB
  • Sample260706-1yrscact5t
  • SHA256 c961fe2a62c93964347233796826eacb58ac1a9e13a575bf0d45f29044533298
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypersistencespyware

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 19 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_3689de55160fa14ab6ab68f6efbf4d71_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_3689de55160fa14ab6ab68f6efbf4d71_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1820
    • \??\c:\users\admin\appdata\local\temp\2026-07-06_3689de55160fa14ab6ab68f6efbf4d71_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-07-06_3689de55160fa14ab6ab68f6efbf4d71_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe"
          4⤵
          • Drops desktop.ini file(s)
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5748
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1924 -prefMapSize 270331 -ipcHandle 2044 -initialChannelId {50a66190-0e68-45c0-a29e-95dd783f06db} -parentPid 5748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5748" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            5⤵
              PID:2612
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270331 -ipcHandle 2424 -initialChannelId {d8845979-8d18-4b57-962a-54239877a02c} -parentPid 5748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
              5⤵
                PID:4100
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3728 -prefsLen 27274 -prefMapHandle 3732 -prefMapSize 270331 -jsInitHandle 3736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {7020dc18-f110-41d4-ac28-d28bc4f5d0ce} -parentPid 5748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                5⤵
                • Checks processor information in registry
                PID:748
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27274 -prefMapHandle 3968 -prefMapSize 270331 -ipcHandle 4060 -initialChannelId {829c4861-1d45-4807-92e5-55f3d9257a6d} -parentPid 5748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5748" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                5⤵
                  PID:5608
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4420 -prefsLen 34773 -prefMapHandle 4424 -prefMapSize 270331 -jsInitHandle 4428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4436 -initialChannelId {e55e0101-660d-4157-ab68-39f6c5342338} -parentPid 5748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  5⤵
                  • Checks processor information in registry
                  PID:5560
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4944 -prefsLen 35010 -prefMapHandle 4948 -prefMapSize 270331 -ipcHandle 4956 -initialChannelId {98afb1ec-f9a8-4820-8813-ed9108b17464} -parentPid 5748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                  5⤵
                  • Checks processor information in registry
                  PID:2396
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5384 -prefsLen 32952 -prefMapHandle 5396 -prefMapSize 270331 -jsInitHandle 5400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5416 -initialChannelId {895f190a-9bb5-4e04-b6e1-49404d47afbe} -parentPid 5748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                  5⤵
                  • Checks processor information in registry
                  PID:4896
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270331 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4380 -initialChannelId {9450cc65-1233-499b-9cec-54bad0f83da5} -parentPid 5748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                  5⤵
                  • Checks processor information in registry
                  PID:1524
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32952 -prefMapHandle 5764 -prefMapSize 270331 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {e41ee136-4f38-4f46-83c6-a6f4aa6e84bf} -parentPid 5748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                  5⤵
                  • Checks processor information in registry
                  PID:3392
          • C:\Windows\Resources\Themes\icsys.icn.exe
            C:\Windows\Resources\Themes\icsys.icn.exe
            2⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3156
            • \??\c:\windows\resources\themes\explorer.exe
              c:\windows\resources\themes\explorer.exe
              3⤵
              • Modifies visibility of hidden/system files in Explorer
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5076
              • \??\c:\windows\resources\spoolsv.exe
                c:\windows\resources\spoolsv.exe SE
                4⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1556
                • \??\c:\windows\resources\svchost.exe
                  c:\windows\resources\svchost.exe
                  5⤵
                  • Modifies visibility of hidden/system files in Explorer
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:5728
                  • \??\c:\windows\resources\spoolsv.exe
                    c:\windows\resources\spoolsv.exe PR
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4536
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5464
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:3056
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1948
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2660

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              9512A4488B00CC053350DAC32D417B4A35C11513
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6088y0oq.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
              • Size 13KB
              • SHA256 ad3b0a0c135f8b246265f82b4997094a46f9ed50a242f7506852a54eb36b8b81
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 599B
              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              1e4df7d9-b2bb-4de5-878b-ba783fbfd26a.zip
              • Path C:\Users\Admin\AppData\Local\Temp\1e4df7d9-b2bb-4de5-878b-ba783fbfd26a.zip
              • Size 3.7MB
              • SHA256 fa4bb42248df1a52130e8be56d582f50e1ab0bdc25c23f6d9f7e828a1f4045a8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              2026-07-06_3689de55160fa14ab6ab68f6efbf4d71_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe 
              • Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_3689de55160fa14ab6ab68f6efbf4d71_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe 
              • Size 383KB
              • SHA256 dc504efc23885bfa6bd03ae5710a5ac4cc0f5f5d01f41c6097310d51bd89e0fb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmpaddon
              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 502KB
              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmpaddon
              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 11KB
              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
              • Size 32KB
              • SHA256 8bd6491f28a8eac1051c2e88c481a6c98189bb94625bb40282eb4378cc659db8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
              • Size 29KB
              • SHA256 4b36044248b6401497057d267d10617691136dd0139486ddf6bae6f6174b9aff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
              • Size 32KB
              • SHA256 c5bc05252acb6657c2d57f7c88c44a6c74eef84d47ac47a0c995b37dcff8154c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
              • Size 32KB
              • SHA256 420aa86c4052804c56d19abae8a0fc65c3c18b3a629d1508f98a09f9dd1040ac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
              • Size 28KB
              • SHA256 872b6abb507a4116a2d8816a4e79a25c45cf9568ce2cbbbbe096c8ca4f4a155e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              events
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\events\events
              • Size 1KB
              • SHA256 619ce25c9c699aab7af26ed3a5e062dfd9b0a0730266a5039031a395b133390d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              0d38f9c6-2a58-4b06-b94d-d700db987eef
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\0d38f9c6-2a58-4b06-b94d-d700db987eef
              • Size 2KB
              • SHA256 64888c3c07e366b22c780149144aba64c50b4a929cdcbaf122a26b815c905328
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8617ca9e-5c7f-4c34-88de-4511b61195cc
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\8617ca9e-5c7f-4c34-88de-4511b61195cc
              • Size 886B
              • SHA256 4bb5ffbe96507ee286c84c033e4ab5ea940379a7a4e1e7cfc3a5d8314dfe647e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ab97f00e-f65d-45df-a067-e8ec833a5464
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\ab97f00e-f65d-45df-a067-e8ec833a5464
              • Size 235B
              • SHA256 69a13339e01af9313780d5c5d3ff991d4906cb44937958fe1aa7e2685bfabe53
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              d2e0f760-ba77-42e0-afbe-afafa60e95ea
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\d2e0f760-ba77-42e0-afbe-afafa60e95ea
              • Size 871B
              • SHA256 b613faaa9c0665b9223efe9f21e68572fe7be13856eaa8af544c19e461759483
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              d9a340cb-3d63-4110-89e8-250bf6479431
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\d9a340cb-3d63-4110-89e8-250bf6479431
              • Size 235B
              • SHA256 a00561843a5992a82c9e78a4ea3b192f1d986bd4dd62c150138d0c3729c5cb73
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              extensions.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\extensions.json
              • Size 16KB
              • SHA256 a2e568211af15d15a2ddd4342d28087cac4b345f737405ed721f41924199cb01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gmpopenh264.dll
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
              • Size 1.1MB
              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gmpopenh264.info
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
              • Size 116B
              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              manifest.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
              • Size 1002B
              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              widevinecdm.dll
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
              • Size 21.6MB
              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
              • Size 6KB
              • SHA256 6d822bed449218f121770fb867be56c3193b188d374601f64bd1f1ceba612b4b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
              • Size 12KB
              • SHA256 65ea234fa3b9b2eaa1d8598d03a0cc3851b06e8b0297239dd4abbca246005d0e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
              • Size 7KB
              • SHA256 f77688c25915e08884c6e54620ef35f8eb1d1a803d68c404824852e6b1640ca5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
              • Size 6KB
              • SHA256 fa8335610b3dd7559255b52428ec374619c6027d96deb83534f14b764d0ab682
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs.js
              • Size 6KB
              • SHA256 178ca2868bea2f7be3756a67e09ba3e2f7340af857b40febfff888e4e006f5a6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              recovery.jsonlz4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.jsonlz4
              • Size 1KB
              • SHA256 15915282f96ce94a68a282dcd731dd451b7feeaea318c99dfc0016818ab3f6aa
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 7.2MB
              • SHA256 f5d9a4a1e45369681a27585896c4ca0f540a534a308235d173def5f18c169e4d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              explorer.exe
              • Path C:\Windows\Resources\Themes\explorer.exe
              • Size 135KB
              • SHA256 c3b2865b464460baa38c716a4533e7b236c00d68f249f45a18b935bdb53c99b6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              icsys.icn.exe
              • Path C:\Windows\Resources\Themes\icsys.icn.exe
              • Size 135KB
              • SHA256 a2cdc0b969d25d69db7496bf35687790fe377ee260b1220d1d690a0cb0424310
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              spoolsv.exe
              • Path C:\Windows\Resources\spoolsv.exe
              • Size 135KB
              • SHA256 e3c9cb2199d168a88924c982f14607ddfb371bb2e7347b19ebb22159b77238fd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              svchost.exe
              • Path C:\Windows\Resources\svchost.exe
              • Size 135KB
              • SHA256 75f46ea35d768f24745e7f07381fc9b95df46526b24a6a506a2784d8b9f2a4b6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1556-60-0x0000000000400000-0x000000000041F000-memory.dmp
              Download

              memory/1820-61-0x0000000000400000-0x000000000041F000-memory.dmp
              Download

              memory/1820-0-0x0000000000400000-0x000000000041F000-memory.dmp
              Download

              memory/1948-455-0x000001D401E60000-0x000001D401E80000-memory.dmp
              Download

              memory/1948-430-0x000001D401D00000-0x000001D401D20000-memory.dmp
              Download

              memory/1948-364-0x000001D4001E0000-0x000001D4002E0000-memory.dmp
              Download

              memory/1948-432-0x000001D401EC0000-0x000001D401FC0000-memory.dmp
              Download

              memory/1948-469-0x000001D4142C0000-0x000001D4142E0000-memory.dmp
              Download

              memory/3056-823-0x000000000EB40000-0x000000000EBBC000-memory.dmp
              Download

              memory/3156-62-0x0000000000400000-0x000000000041F000-memory.dmp
              Download

              memory/4536-59-0x0000000000400000-0x000000000041F000-memory.dmp
              Download

              memory/5076-4709-0x0000000000400000-0x000000000041F000-memory.dmp
              Download

              memory/5728-4710-0x0000000000400000-0x000000000041F000-memory.dmp
              Download