Overview

overview

10

Static

static

10

2026-08-04...lc.exe

windows10-2004-x64

9

2026-08-04...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 06:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_76acd46cb81e2fc96871402408ed528a_cobalt-strike_coinminer_hijackloader_icedid_luca-stealer_njrat_satacom_stealc.exe
  • Size 6.5MB
  • Sample260804-hjev5aef37
  • SHA256 f94fb4fd7581b179e98ab593aa06747c51555424d93b409bdcc120d8d2f91df4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 5 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_76acd46cb81e2fc96871402408ed528a_cobalt-strike_coinminer_hijackloader_icedid_luca-stealer_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_76acd46cb81e2fc96871402408ed528a_cobalt-strike_coinminer_hijackloader_icedid_luca-stealer_njrat_satacom_stealc.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Users\Admin\AppData\Local\Temp\1446066200011131.exe
      "C:\Users\Admin\AppData\Local\Temp\1446066200011131.exe" --binder-child
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Users\Admin\AppData\Local\Temp\7zS8F2A6579\setup-stub.exe
        .\setup-stub.exe --binder-child
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4288
        • C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\download.exe
          "C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\download.exe" /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\config.ini
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3432
          • C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\setup.exe
            .\setup.exe /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\config.ini
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1836
            • C:\Windows\system32\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:5080
            • C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
              "C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4724
              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
                "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
                7⤵
                • Executes dropped EXE
                PID:4660
            • C:\Program Files\Mozilla Firefox\default-browser-agent.exe
              "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CB
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:6132
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:1504
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  PID:4232
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:3700
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks whether UAC is enabled
                • Checks processor information in registry
                • Modifies Control Panel
                PID:5268
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -first-startup
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:5316
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -first-startup
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks processor information in registry
            • Modifies Control Panel
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1392
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1808 -parentBuildID 20240606181944 -prefsHandle 1724 -prefMapHandle 1716 -prefsLen 24253 -prefMapSize 251204 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b917c0f-ad43-4a9c-b14f-5ebf667792c5} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" gpu
              6⤵
              • Executes dropped EXE
              PID:4092
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2204 -parentBuildID 20240606181944 -prefsHandle 2196 -prefMapHandle 2192 -prefsLen 24253 -prefMapSize 251204 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16faf1da-5685-49ad-bb33-90d8787333e6} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" socket
              6⤵
              • Executes dropped EXE
              PID:4592

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        install.log
        • Path C:\Program Files\Mozilla Firefox\install.log
        • Size 5KB
        • SHA256 ca21fbd800a4e6b52b00a3276619250497f1bdf6451724b2c5966bfdadf5f86d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install.log
        • Path C:\Program Files\Mozilla Firefox\install.log
        • Size 6KB
        • SHA256 c5556629aae9529a8c7d01a72ed20b51e326bee51b4ad2b8606e53fb0ca45a57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shortcuts_log.ini
        • Path C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini
        • Size 222B
        • SHA256 79d1631316cd79bc5127f745aa6707b4445f7d0432b685ef2c3ec3cf3a62ecba
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox Privater Modus.lnk
        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Privater Modus.lnk
        • Size 1KB
        • SHA256 64558657f52f9ae65649e8a70e9413d8d06f30f1e7cf1034348bd44b33eeddcb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox Privater Modus.lnk
        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Privater Modus.lnk
        • Size 1KB
        • SHA256 0d146e85f43860721285e32c4d808981b019fa43ca5dfb2077a75069d220f6ec
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox.lnk
        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
        • Size 914B
        • SHA256 f82d7dc23bf7cfe2db5c61298a6a7dcd1cc715a12a6c3ad9a39f76604eda62ba
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox.lnk
        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
        • Size 1012B
        • SHA256 8c72558cbf54db55be8157f5e51f4089a2445c10905d3b712f241999ac5f0766
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1446066200011131.exe
        • Path C:\Users\Admin\AppData\Local\Temp\1446066200011131.exe
        • Size 341KB
        • SHA256 8d0e6a04a748452823319990a2917abd39ca9af478f0a834242492a3fee4299f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AccessibleMarshal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\AccessibleMarshal.dll
        • Size 30KB
        • SHA256 430c38583db5894d962925687bd234e69a47aa1366e3740281e8f2f0244ab618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        application.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\application.ini
        • Size 891B
        • SHA256 4befbbcafdcc0a0aff0420e84469b824d1bb5c83c04978323a86b03ec16b935c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        crashreporter.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\crashreporter.exe
        • Size 928KB
        • SHA256 e5d86f6040c144ff7676a9bce1c4c77447006814454573763aa3f496f6b32202
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default-browser-agent.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\default-browser-agent.exe
        • Size 32KB
        • SHA256 942e98f96302bbaf0e444f26b5ff9e630bbbc6c8fe21e75773607edcbacd5e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dependentlibs.list
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\dependentlibs.list
        • Size 55B
        • SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firefox.VisualElementsManifest.xml
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\firefox.VisualElementsManifest.xml
        • Size 557B
        • SHA256 3b25ae142729ed15f3a10ebce2621bfa07fda5e4d76850763987a064122f7ae6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firefox.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\firefox.exe
        • Size 659KB
        • SHA256 5218a481b56474bcd4630174f3610011aef30f8b5ce2b162c2401eb1b0ceb5d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        firefox.exe.sig
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\firefox.exe.sig
        • Size 1KB
        • SHA256 3a99b564600c2a39b66edfe4fe493c74beb6e3523b8a94a9596aaa622aac89d2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        freebl3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\freebl3.dll
        • Size 977KB
        • SHA256 826977fe4476062c842162406e0a4a2c5ade5b6ae5547afc75b427d34fcadfcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gkcodecs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\gkcodecs.dll
        • Size 9.1MB
        • SHA256 aa4a973b896035590687f23909d359a96e4eb0043ede2cdf86f404906b3b7612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ipcclientcerts.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\ipcclientcerts.dll
        • Size 203KB
        • SHA256 557905481764bbfb09e2c6610411dc65233fd5ad33c6d7a06e5b9c0843e722fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lgpllibs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\lgpllibs.dll
        • Size 151KB
        • SHA256 015416a1f39dfe40a2f659f058c8b95bfed2ff1ff38fe8aa1cd02bcd8275c4e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\libEGL.dll
        • Size 46KB
        • SHA256 0b4baae6980b41c6e81d7dc28481739802962245894ea525c3064ed25d0823c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\libGLESv2.dll
        • Size 4.8MB
        • SHA256 cfd1cf812c15f9b08431ca4bfea537c778b45442b03f3bbfcb7303d5908c48eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        locale.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\locale.ini
        • Size 19B
        • SHA256 81df279bf08e12181d8ad06bed345490db187b51a8637bddb22c8dee10ea371b
        • MD5 SHA1 SHA512
        Submit Download

        maintenanceservice.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\maintenanceservice.exe
        • Size 269KB
        • SHA256 a45b4b6e3ea4055a8e2302e4a268d527ed7e9acea5ac1e982ef09fd0dae38f66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice_installer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\maintenanceservice_installer.exe
        • Size 183KB
        • SHA256 22e0581491bacaa48b5e20f0459fde0ecde3c7e383756c87fa4831ae0117e35e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        minidump-analyzer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\minidump-analyzer.exe
        • Size 752KB
        • SHA256 529c2900639682b41a27a9a2fd24cccb5ef22dcf4cec798652842aaaaac144cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mozavcodec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\mozavcodec.dll
        • Size 3.0MB
        • SHA256 64e4ab387da542eeb5f7c3e94d78325613407eea2b20c423e189a7d5b7a861f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mozavutil.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\mozavutil.dll
        • Size 560KB
        • SHA256 0a3fb828cc9e1c67f31e6d8a2c40431182c89cc312b1f6e9e8a019f4c75f2f8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mozglue.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\mozglue.dll
        • Size 1001KB
        • SHA256 30a42964ffc0ef3d86b96231ee59b1d0b706e0e72449aaa62a4ace21ae93cc4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mozwer.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\mozwer.dll
        • Size 322KB
        • SHA256 d8a6117d8d8c76b33c24c206b43b6a36424b31a488965edfb8cca3dfd2b486c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\msvcp140.dll
        • Size 559KB
        • SHA256 1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nmhproxy.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\nmhproxy.exe
        • Size 626KB
        • SHA256 6165c719e77098f65682b90df4372e4399cb65cae3997790a6aace9b7d6580d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notificationserver.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\notificationserver.dll
        • Size 59KB
        • SHA256 dcafb39a979e3e3ae860fdac4e73f0a467b8f8e21e8f717c9525d9fca3ec1eb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nss3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\nss3.dll
        • Size 2.6MB
        • SHA256 8b408fdcab20e6dbd02f2caed4ecab78deef8fe9014aba2211e3b54ab587a4af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nssckbi.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\nssckbi.dll
        • Size 365KB
        • SHA256 75301e616641cc4934ebd52d47bd72f513d0a0f59e398f88131476040f1f4459
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        omni.ja
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\omni.ja
        • Size 32.3MB
        • SHA256 65eef8ad0c44a587a7249024253c2152af293bcd8329243563302ea859e7aed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osclientcerts.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\osclientcerts.dll
        • Size 355KB
        • SHA256 067057ab966050247628e91b8d2d702315bc6f14946d18cb86672b120fbc9858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pingsender.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\pingsender.exe
        • Size 77KB
        • SHA256 9a686e1f26212e1f48b1225412dde7f5e9dad7389802db4eb9ce20ecc509aeaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        platform.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\platform.ini
        • Size 165B
        • SHA256 a592ed5e8c8a2f50f7969374d3c34ec145064782d10d57eb39cc080d9c886dce
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        plugin-container.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\plugin-container.exe
        • Size 282KB
        • SHA256 f9c85db13e3117df748f3e7871d9763f5bbe80a217562fbdc5fb2f09bcf51bde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        plugin-container.exe.sig
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\plugin-container.exe.sig
        • Size 1KB
        • SHA256 48f64ec0295fe25beaddc70099f5a4b698ef6a1ba4d0301019468fc81481be96
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        precomplete
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\precomplete
        • Size 2KB
        • SHA256 1c95f61bb51a50f12769db3179c9b9cac731e24150923043c23901ba8c1e308e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        private_browsing.VisualElementsManifest.xml
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\private_browsing.VisualElementsManifest.xml
        • Size 559B
        • SHA256 9ea86a18d41112e25b17454044ac29b458f508d9814700a6f4c0f9370678f3ae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        private_browsing.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\private_browsing.exe
        • Size 63KB
        • SHA256 f7fc3afeab32161896bd31c82f7348310334ab4df22637e49dc8c3eb722630b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        removed-files
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\removed-files
        • Size 16B
        • SHA256 52523da24287c4d459131c2e4818a713a732765e06e9bbba1cf353888ba34f9f
        • MD5 SHA1 SHA512
        Submit Download

        softokn3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\softokn3.dll
        • Size 314KB
        • SHA256 f9e9fe54b275bfc0a4c752f9f53b495129bad91eeac357b7b9d510f7bcc339c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        update-settings.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\update-settings.ini
        • Size 132B
        • SHA256 c18489344fdc21ae366b4d957a0b9f11be772483ca46f9ffab6ed0356f946513
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        updater.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\updater.exe
        • Size 452KB
        • SHA256 2753f0953f6ae91768e1f150bd491a083197fa3c94e2f0b62ea0c09965bf9bff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        updater.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\updater.ini
        • Size 1KB
        • SHA256 020a367e7c9dc66d85ca8efb5065b91d26d0e01912d7be0ee884f088a6a3a91f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\vcruntime140.dll
        • Size 116KB
        • SHA256 a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\vcruntime140_1.dll
        • Size 48KB
        • SHA256 6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmfclearkey.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\core\wmfclearkey.dll
        • Size 195KB
        • SHA256 b1a2fdfcdf6516d0cf39c31c0bb367e952b1b422a2fac638e4cf42e2b60ebbb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS86DF039A\setup.exe
        • Size 938KB
        • SHA256 19f880d446006c00083cbb5c6b03d537e001ce4958e353420dcefae152e818b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup-stub.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8F2A6579\setup-stub.exe
        • Size 551KB
        • SHA256 45fabe4b7336d0356b02a765fbc590b3f1b3b2ae15d4562fba00a766b4e483c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\Users\Admin\AppData\Local\Temp\log.txt
        • Size 1KB
        • SHA256 844a799fc7206e0daf88b099381dd644dd5e23860a0942a5a40cedbf38342203
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CertCheck.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\CertCheck.dll
        • Size 15KB
        • SHA256 d56e2407b6050d669e94e452f1a54ee1859a1751179a3f1e2b4253305a23a0cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CityHash.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\CityHash.dll
        • Size 53KB
        • SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InetBgDL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\InetBgDL.dll
        • Size 17KB
        • SHA256 dc98ed352476af459c91100b8c29073988da19d3adc73e2c2086d25f238544a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\System.dll
        • Size 22KB
        • SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UAC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\UAC.dll
        • Size 28KB
        • SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UserInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\UserInfo.dll
        • Size 14KB
        • SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WebBrowser.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\WebBrowser.dll
        • Size 103KB
        • SHA256 281a0dc8b4f644334c2283897963b20df88fa9fd32acca98ed2856b23318e6ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bgstub.jpg
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\bgstub.jpg
        • Size 66KB
        • SHA256 4b7e441d51b790ee1c0baff19e4e968392a937877dfa8b84e74464f5ba7a4cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\config.ini
        • Size 187B
        • SHA256 812217f840657b7d310c406d7224eb1c339079ad48541d922e3f15f1b2e3d913
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installing.html
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\installing.html
        • Size 1KB
        • SHA256 6259f3a41a703f13466503e6fbd37ca40e94f565a2f4b4087fbcd87a13bf3ee1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installing.js
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\installing.js
        • Size 2KB
        • SHA256 2c286b6eefd38f032a385f3ac6a1f794deab3bac0fbff71bd0ba21453f477878
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installing_page.css
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\installing_page.css
        • Size 1KB
        • SHA256 43c38801c1746880625f97eee3fe37fe94d1300adf812bfe26e47b094b87523b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        stub_common.css
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\stub_common.css
        • Size 684B
        • SHA256 4d9495b6f0e18331659993b79440e414a6e607fcdaeacbc7477e0683cc0fa98b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        stub_common.js
        • Path C:\Users\Admin\AppData\Local\Temp\nsq5EFF.tmp\stub_common.js
        • Size 817B
        • SHA256 0e28aa770b0afade30be85c6dc1e50344db8f8cdd3fa01989d81a9e20a4990bd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AccessControl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nssA00B.tmp\AccessControl.dll
        • Size 21KB
        • SHA256 ef4b548b27a6edab3bcb25cff0598918c645795850d62f232909dee851e04c6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ApplicationID.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nssA00B.tmp\ApplicationID.dll
        • Size 55KB
        • SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ServicesHelper.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nssA00B.tmp\ServicesHelper.dll
        • Size 14KB
        • SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ShellLink.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nssA00B.tmp\ShellLink.dll
        • Size 14KB
        • SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        components.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nssA00B.tmp\components.ini
        • Size 638B
        • SHA256 de822477bd396df2d1eb2d4f1754a40157c9442360f5bf4a1ff7df4a4027737b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        extensions.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nssA00B.tmp\extensions.ini
        • Size 402B
        • SHA256 4e3f2413784c7e3666c667eb2c35084154536edf9335d96f24d18a1d17590066
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        liteFirewallW.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nssA00B.tmp\liteFirewallW.dll
        • Size 19KB
        • SHA256 708fb54cffb6aea3547fc5ac745d1435ecc814df563bef59ba7a94f57d082bbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nssA00B.tmp\nsExec.dll
        • Size 17KB
        • SHA256 7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsJSON.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nssA00B.tmp\nsJSON.dll
        • Size 33KB
        • SHA256 705f4947fb94254c4e5084e6a962045f6a4e790dfc1ecf59cd0fc3feb38bcbbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        options.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nssA00B.tmp\options.ini
        • Size 1008B
        • SHA256 f26f4a73edb356236b528872bf93897d333c96f86b0a76f168f66ae01ea68e8f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        options.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nssA00B.tmp\options.ini
        • Size 1KB
        • SHA256 e5e9ddfee7c287ae7776ea1e828bd2bbb1bc0ca37e280823ff9a0fef63409339
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        shortcuts.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nssA00B.tmp\shortcuts.ini
        • Size 678B
        • SHA256 9273d5dc8f4b67cd6b00594c7cf5797b9d0a54e74bc2e69842ef5cccd6e6c172
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox.lnk
        • Path C:\Users\Public\Desktop\Firefox.lnk
        • Size 902B
        • SHA256 cdf0ca0491a82e5a5d141d4798ffe92f9de023e6d237acafffbb8ecc45b041d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox.lnk
        • Path C:\Users\Public\Desktop\Firefox.lnk
        • Size 1000B
        • SHA256 c02470e2745f48f7b39f71a5ac6f20add4939e70db6b7f6e5d424b5d6b71b502
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3432-736-0x0000000000400000-0x0000000000446000-memory.dmp
        Download

        memory/3432-157-0x0000000000400000-0x0000000000446000-memory.dmp
        Download

        memory/4856-9-0x0000000000400000-0x0000000000446000-memory.dmp
        Download

        memory/4856-113-0x0000000000400000-0x0000000000446000-memory.dmp
        Download