Overview

overview

10

Static

static

10

2026-08-28...lc.exe

windows10-2004-x64

10

2026-08-28...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/08/2026, 04:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-28_dea0995a0f100fd7edffd85ac2e86100_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
  • Size 423KB
  • Sample260829-esbnaawdla
  • SHA256 7513075f23198742ed74a0d66264c414186ffd42cacd51341cf8d47175785270
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryneshtapersistencespywarestealer

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 64 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-28_dea0995a0f100fd7edffd85ac2e86100_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-28_dea0995a0f100fd7edffd85ac2e86100_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-28_dea0995a0f100fd7edffd85ac2e86100_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-28_dea0995a0f100fd7edffd85ac2e86100_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\PROGRA~1\MOZILL~1\firefox.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1716
        • C:\PROGRA~1\MOZILL~1\firefox.exe
          C:\PROGRA~1\MOZILL~1\firefox.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3724
          • C:\PROGRA~1\MOZILL~1\firefox.exe
            C:\PROGRA~1\MOZILL~1\firefox.exe
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3844
            • C:\PROGRA~1\MOZILL~1\firefox.exe
              "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2024 -prefsLen 27099 -prefMapHandle 2028 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {78dec329-5d21-432e-9ac9-597cf090cc24} -parentPid 3844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3844" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 1 gpu
              6⤵
                PID:4200
              • C:\PROGRA~1\MOZILL~1\firefox.exe
                "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2472 -prefsLen 27135 -prefMapHandle 2476 -prefMapSize 270279 -ipcHandle 2484 -initialChannelId {90e5bb02-8106-4ead-b31e-5efdaf68256a} -parentPid 3844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3844" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 2 socket
                6⤵
                  PID:2816
                • C:\PROGRA~1\MOZILL~1\firefox.exe
                  "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 3692 -prefsLen 27325 -prefMapHandle 3696 -prefMapSize 270279 -jsInitHandle 3700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3708 -initialChannelId {71ca61fc-a7c9-490b-8ad0-d11988f1cb09} -parentPid 3844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3844" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 3 tab
                  6⤵
                  • Checks processor information in registry
                  PID:1768
                • C:\PROGRA~1\MOZILL~1\firefox.exe
                  "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3924 -prefsLen 27325 -prefMapHandle 3928 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {ed4bdc0a-45c6-43fe-a935-2230eea735aa} -parentPid 3844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3844" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 4 rdd
                  6⤵
                    PID:3952
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 4340 -prefsLen 34824 -prefMapHandle 4336 -prefMapSize 270279 -jsInitHandle 4332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3572 -initialChannelId {40c2f657-020c-4477-b8dd-76ce770be129} -parentPid 3844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3844" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 5 tab
                    6⤵
                    • Checks processor information in registry
                    PID:668
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3552 -prefsLen 34959 -prefMapHandle 3656 -prefMapSize 270279 -ipcHandle 2844 -initialChannelId {b17758c3-66ba-42f0-93ee-e44df5dc2f98} -parentPid 3844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3844" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 6 utility
                    6⤵
                    • Checks processor information in registry
                    PID:5396
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5160 -prefsLen 32952 -prefMapHandle 2868 -prefMapSize 270279 -jsInitHandle 2864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {3689325c-13b4-4d4f-be6d-0c14aed879e6} -parentPid 3844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3844" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 7 tab
                    6⤵
                    • Checks processor information in registry
                    PID:5812
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32952 -prefMapHandle 5204 -prefMapSize 270279 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {bde5a295-32fe-4f5d-baae-19ccb9904d95} -parentPid 3844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3844" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 8 tab
                    6⤵
                    • Checks processor information in registry
                    PID:5856
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32952 -prefMapHandle 5256 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5268 -initialChannelId {22d3dec4-8a9e-4158-a4d6-71f6cb40e6a5} -parentPid 3844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3844" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 9 tab
                    6⤵
                    • Checks processor information in registry
                    PID:5884

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ACROTE~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
              • Size 86KB
              • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ADOBEC~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
              • Size 5.7MB
              • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AcroRd32.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
              • Size 2.4MB
              • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Eula.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
              • Size 131KB
              • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FULLTR~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
              • Size 254KB
              • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LOGTRA~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
              • Size 386KB
              • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              READER~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
              • Size 92KB
              • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              arh.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
              • Size 125KB
              • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              32BITM~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
              • Size 183KB
              • SHA256 326e06a3feff09750ef8675907943825564ed4519988f47264bede3e92a9102e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ADOBEA~1.EXE
              • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
              • Size 454KB
              • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AdobeARM.exe
              • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
              • Size 1.2MB
              • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOIN~1.EXE
              • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
              • Size 121KB
              • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
              • Size 325KB
              • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
              • Size 325KB
              • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
              • Size 505KB
              • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DISABL~1.EXE
              • Path C:\PROGRA~2\Google\GOOGLE~1\141073~1.0\DISABL~1.EXE
              • Size 5.7MB
              • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MICROS~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE
              • Size 201KB
              • SHA256 0f201a8142c5a8adc36d2a177dd8d430eef2b05cff0e4faefb52440e823b54bb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MICROS~2.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE
              • Size 250KB
              • SHA256 4d87b0eb331443b473c90650d31b893d00373ff88dcbcb3747f494407799af69
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MICROS~3.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~3.EXE
              • Size 256KB
              • SHA256 a6d86c1783043a4f6a5b5d5eba30ebd76925263792f5b63a226ba2ea0d5d1fe0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MICROS~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE
              • Size 242KB
              • SHA256 03044d2ffe2c87ce479dbdb722183cb7f806510a5b27460153ef9b3906a0f7ec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedgewebview2.exe
              • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\132029~1.140\msedgewebview2.exe
              • Size 3.2MB
              • SHA256 fc0701d5c47cbd883929abfccf5f6ba88f76a4d0ebfa2d28160cf6c28f018e26
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IE_TO_~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
              • Size 557KB
              • SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              COOKIE~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
              • Size 161KB
              • SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ELEVAT~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE
              • Size 1.8MB
              • SHA256 47eb0dc0cd08f4faa389621c43d6407283e3c315012ef1078a6018c117f195b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IDENTI~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE
              • Size 1.1MB
              • SHA256 94c99d3284962585c15fdb061e0685287df11c872ef930263e251d8d3084d5b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe
              • Size 6.6MB
              • SHA256 4ea8adca8a7f73fc71c7e45ef98f8c422a8b161ca6b6fcd912aec701bebd08a5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSEDGE~2.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE
              • Size 1.1MB
              • SHA256 550e6ad6b5fb0dabd28d9009c790b22e9444fc9fc30e952210727f6ac4a00389
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSEDGE~3.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~3.EXE
              • Size 1.5MB
              • SHA256 eb9bbc44c181ddef0d8b53b69bd7327f5c150c0b72d92805a9f3a9ba333f0575
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NOTIFI~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\NOTIFI~1.EXE
              • Size 1.3MB
              • SHA256 447a7ccfbece37792dfd82e6cf4e644e261dbe0f3e23a13c475276e8e4fa3561
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PWAHEL~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE
              • Size 1.1MB
              • SHA256 c57f8707c1fda09d33efc6b615c0d48174253e9869772841446302748f1f9016
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe
              • Size 3.8MB
              • SHA256 6773bf49098b9fa85725651bc789ec2bcef5dd563a356043468c1f7b235defef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PWAHEL~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\PWAHEL~1.EXE
              • Size 1.4MB
              • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ie_to_edge_stub.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
              • Size 562KB
              • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
              • Size 7.1MB
              • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cookie_exporter.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
              • Size 155KB
              • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
              • Size 3.8MB
              • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
              • Size 2.2MB
              • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              identity_helper.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
              • Size 1.4MB
              • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge_pwa_launcher.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
              • Size 1.8MB
              • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedgewebview2.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
              • Size 3.4MB
              • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_helper.exe
              • Size 1.7MB
              • SHA256 58457354d5cc9d87a03d23df516f168ab20512bc0a1ae68b469fe811451c10c4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSEDGE~1.EXE
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
              • Size 1.5MB
              • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
              • Size 4.0MB
              • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UNINST~1.EXE
              • Path C:\PROGRA~2\MOZILL~1\UNINST~1.EXE
              • Size 141KB
              • SHA256 294a66a0948d474fafaac4ab64279d58d648c488271c265f27feef305075b04f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCREDI~1.EXE
              • Path C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE
              • Size 485KB
              • SHA256 8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_RED~1.EXE
              • Path C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
              • Size 674KB
              • SHA256 c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WINDOW~1.EXE
              • Path C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE
              • Size 648KB
              • SHA256 a1afa6e62527e43b25c7d27bb24bc6bebce4e10a166a6c0526b2eec4b03caebc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCREDI~1.EXE
              • Path C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE
              • Size 495KB
              • SHA256 45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCREDI~1.EXE
              • Path C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE
              • Size 485KB
              • SHA256 8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WINDOW~1.EXE
              • Path C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE
              • Size 650KB
              • SHA256 a6180f0aa9c56c32e71fe8dc150131177e4036a5a2111d0f3ec3c341fd813222
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCREDI~1.EXE
              • Path C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
              • Size 495KB
              • SHA256 d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe
              • Size 494KB
              • SHA256 7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              INTEGR~1.EXE
              • Path C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
              • Size 6.7MB
              • SHA256 7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_RED~1.EXE
              • Path C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE
              • Size 715KB
              • SHA256 afc5cc567db1a3318c89dd0efad2ca60a353290bc25d98bbbba8e6f1492e23b1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ONEDRI~1.EXE
              • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\ONEDRI~1.EXE
              • Size 2.4MB
              • SHA256 8c6f9493c2045bb7c08630cf3709a63e221001f04289b311efb259de3eb76bce
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
              • Size 16KB
              • SHA256 ffa959c12f1adeeaaaeec8ccb87684f1f8ac28b58495da8c816403ece74a0fe9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
              • Size 16KB
              • SHA256 47e9c1077cba9782d8c29cd44519ed31c4c6b1ec2b7fc99b27a59d817df2e522
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              webext.sc.lz4.tmp
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\startupCache\webext.sc.lz4.tmp
              • Size 105KB
              • SHA256 d4bec9528d338be3cd9e73f68b2418a735eff75abde58a8640e79065d13584e6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              2026-08-28_dea0995a0f100fd7edffd85ac2e86100_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-28_dea0995a0f100fd7edffd85ac2e86100_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc.exe
              • Size 383KB
              • SHA256 84d5cdad569ceb17a5af6ecb4b74eae4b87e00631f9fe342814b1cbccd674bb4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmpaddon
              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 11KB
              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmpaddon
              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 502KB
              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
              • Size 7KB
              • SHA256 e0a94ed41a4701a55edeb3f13ce55e04107412c71a43b642f9521a6034661d88
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
              • Size 7KB
              • SHA256 a0cb6d9134a774df1930be9df675bcedda15f21bf4501ce6f2f79a284251a606
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
              • Size 5KB
              • SHA256 d27820859eda02ddb76a52a887a1d78880e6528e75ce91fe8dc28c4b34777dcf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
              • Size 5KB
              • SHA256 c8a791046d7f83e09a730a42d5c945497fae56989aab53be4f06bad27db10d57
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              events
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\events\events
              • Size 1KB
              • SHA256 243a2c187a1fe84c041e0de37c125f41427b7077e43b5f1101c4dceb6257047c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              2184f3ca-ef90-477b-bd96-367fac834a2c
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\2184f3ca-ef90-477b-bd96-367fac834a2c
              • Size 16KB
              • SHA256 418f95e9f30b53a51dea09021703d7335af3a5709b3a31d86082a52217d1800e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3074f9e7-d242-46ca-845b-fe9cc065f128
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\3074f9e7-d242-46ca-845b-fe9cc065f128
              • Size 886B
              • SHA256 9bfd50b52e8e9b3f4bf9b66f09e1749c90f02cb352c598fa592628f92eee13c6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              44dff958-a321-457e-a503-14481e84138b
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\44dff958-a321-457e-a503-14481e84138b
              • Size 2KB
              • SHA256 cdf96689418c08d5de0290b32977fabd5ade410ba7db27fbc65dd1347a8c5195
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              7608b7ae-7f14-41d3-bc1d-e68cec43bd11
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\7608b7ae-7f14-41d3-bc1d-e68cec43bd11
              • Size 235B
              • SHA256 4a5f5f690396157d652f48aa6f1821925297976c76442331a19996907aaf8d00
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              89bceab4-e94c-4874-abed-2c1918d210d1
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\89bceab4-e94c-4874-abed-2c1918d210d1
              • Size 883B
              • SHA256 7d81ffaf3a3d184b65ee8bfa02fde1ccceb67317d22245fce9167d9085f1be1c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              eb470c48-1c1d-4849-8b45-bbf9e484886b
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\eb470c48-1c1d-4849-8b45-bbf9e484886b
              • Size 235B
              • SHA256 610aeaba34560f147e0e4e97936414408aaf0d7f9f297af335d028b0437670e7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              extensions.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\extensions.json
              • Size 16KB
              • SHA256 299a35d38af7e16ad456fe6ed38d42bd8302312f77e61cb7ec36c39e3eb7c9aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gmpopenh264.dll
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
              • Size 1.1MB
              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gmpopenh264.info
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
              • Size 116B
              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              manifest.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
              • Size 1002B
              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              widevinecdm.dll
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
              • Size 21.6MB
              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
              • Size 8KB
              • SHA256 f29f882951966ed3c9bfe1f17e41035f0d9b2ec7d079bc87d28f7b94e0d0882b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
              • Size 6KB
              • SHA256 54b0a87a9ebc579a6544ddd92feddc836828ba9137e838f368eac6d9b7cbd99d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
              • Size 6KB
              • SHA256 3389f42a2b1a60a0950f885477eeb2dda5a348cf93284e5c6a0f09c2ef71a860
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
              • Size 7KB
              • SHA256 40bc38c8f623c4f4d25dcebbb05bdf5cc2c64e6c3b0df9e921762b474060f8ad
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              recovery.baklz4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\sessionstore-backups\recovery.baklz4
              • Size 1KB
              • SHA256 929f2496bd2a4662496e297801b09c810bae7349b4ceb119aa4010924fa0e5f9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 6.5MB
              • SHA256 d52088b2525fd0b372502e16f46c45098ae1ff0d31d0c6f0e536ae60d515a131
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              svchost.com
              • Path C:\Windows\svchost.com
              • Size 40KB
              • SHA256 8455d1832df2da3b327d6fb0e030643f5d5415fb3076c11ac05846c99421b88b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/668-744-0x0000017322A00000-0x0000017322B2A000-memory.dmp
              Download

              memory/668-601-0x0000017322A00000-0x0000017322B2A000-memory.dmp
              Download

              memory/668-970-0x0000017322A00000-0x0000017322B2A000-memory.dmp
              Download

              memory/668-1023-0x0000017322A00000-0x0000017322B2A000-memory.dmp
              Download

              memory/1716-592-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1716-629-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1716-621-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1716-944-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1768-947-0x000001CDD6400000-0x000001CDD652A000-memory.dmp
              Download

              memory/1768-595-0x000001CDD6400000-0x000001CDD652A000-memory.dmp
              Download

              memory/1768-78-0x00007FFEB9F40000-0x00007FFEB9F41000-memory.dmp
              Download

              memory/1768-1022-0x000001CDD6400000-0x000001CDD652A000-memory.dmp
              Download

              memory/3844-593-0x0000019EB1E10000-0x0000019EB1F02000-memory.dmp
              Download

              memory/3844-539-0x0000019EBEAF0000-0x0000019EBEB00000-memory.dmp
              Download

              memory/4104-589-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4104-945-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4104-620-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4104-628-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/5812-971-0x0000013C7BB00000-0x0000013C7BC2A000-memory.dmp
              Download

              memory/5812-953-0x0000013C7BB00000-0x0000013C7BC2A000-memory.dmp
              Download

              memory/5812-608-0x0000013C7BB00000-0x0000013C7BC2A000-memory.dmp
              Download

              memory/5812-1024-0x0000013C7BB00000-0x0000013C7BC2A000-memory.dmp
              Download

              memory/5856-954-0x000001A733BC0000-0x000001A733CEA000-memory.dmp
              Download

              memory/5856-972-0x000001A733BC0000-0x000001A733CEA000-memory.dmp
              Download

              memory/5856-609-0x000001A733BC0000-0x000001A733CEA000-memory.dmp
              Download

              memory/5856-1025-0x000001A733BC0000-0x000001A733CEA000-memory.dmp
              Download

              memory/5884-955-0x000001B579700000-0x000001B57982A000-memory.dmp
              Download

              memory/5884-979-0x000001B579700000-0x000001B57982A000-memory.dmp
              Download

              memory/5884-610-0x000001B579700000-0x000001B57982A000-memory.dmp
              Download

              memory/5884-1026-0x000001B579700000-0x000001B57982A000-memory.dmp
              Download