Overview

overview

8

Static

static

5

43_FlCHƐR...05.vbs

windows10-2004-x64

7

43_FlCHƐR...05.vbs

windows11-ltsc_2024-x64

5

_.exe

windows10-2004-x64

7

_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/09/2026, 12:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _.exe
  • Size 325KB
  • Sample260909-plgwtsem8w
  • SHA256 28225c5622637cdaed8342e14560e8de7b53dd6ba145d973643fc4b5bdd67b75
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\_.exe
    "C:\Users\Admin\AppData\Local\Temp\_.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Users\Admin\AppData\Local\Temp\7zS834CF749\setup-stub.exe
      .\setup-stub.exe
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3672
      • C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\download.exe
        "C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\download.exe" /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\config.ini
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5336
        • C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\setup.exe
          .\setup.exe /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\config.ini
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4648
          • C:\Windows\system32\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4932
          • C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
            "C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1428
            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:2228
          • C:\Program Files\Mozilla Firefox\default-browser-agent.exe
            "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CB
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2956
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:6080
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:3908
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:3372
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks whether UAC is enabled
              • Checks processor information in registry
              • Modifies Control Panel
              PID:4084
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -first-startup
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:432
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -first-startup
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Modifies Control Panel
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1748
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1800 -parentBuildID 20240606181944 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 24253 -prefMapSize 251204 -appDir "C:\Program Files\Mozilla Firefox\browser" - {16e92496-6b33-4054-b876-417c66ce933c} 1748 "\\.\pipe\gecko-crash-server-pipe.1748" gpu
            5⤵
            • Executes dropped EXE
            PID:1552
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2208 -parentBuildID 20240606181944 -prefsHandle 2200 -prefMapHandle 2188 -prefsLen 24253 -prefMapSize 251204 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25aacdc0-9ebe-4fca-a775-dc4132e24a7c} 1748 "\\.\pipe\gecko-crash-server-pipe.1748" socket
            5⤵
            • Executes dropped EXE
            PID:1216

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        install.log
        • Path C:\Program Files\Mozilla Firefox\install.log
        • Size 8KB
        • SHA256 e371dd3159c928e551985a17a0c82b4ca785dcb4edd6c49f662167442d6b4458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shortcuts_log.ini
        • Path C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini
        • Size 222B
        • SHA256 79d1631316cd79bc5127f745aa6707b4445f7d0432b685ef2c3ec3cf3a62ecba
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox Navegação Privada.lnk
        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Navegação Privada.lnk
        • Size 1KB
        • SHA256 0d512dfaffe14f850348b2f719502128cf9638cfbe237a85c034eeaba89adc45
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox Navegação Privada.lnk
        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Navegação Privada.lnk
        • Size 1KB
        • SHA256 f7c831a852bcb174fa544b454aae0442a5bc72a616c1342af3b23ebdfda36c15
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox.lnk
        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
        • Size 914B
        • SHA256 8afbb9a5adf33952fb60035da24b7d8e2e8b7f584d3c0200b216a980a2f208da
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox.lnk
        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
        • Size 1012B
        • SHA256 626cad0775ca539ff294dd0121b5bcf8ce4a3db17fabc6ac8107c946d2e5b00c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        setup-stub.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS834CF749\setup-stub.exe
        • Size 464KB
        • SHA256 d7840eea40a5a88af824f24473e95d0227e69c4439d6ea791d50cb94bf0cfb2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AccessibleMarshal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\AccessibleMarshal.dll
        • Size 30KB
        • SHA256 430c38583db5894d962925687bd234e69a47aa1366e3740281e8f2f0244ab618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        application.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\application.ini
        • Size 891B
        • SHA256 4befbbcafdcc0a0aff0420e84469b824d1bb5c83c04978323a86b03ec16b935c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        crashreporter.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\crashreporter.exe
        • Size 928KB
        • SHA256 e5d86f6040c144ff7676a9bce1c4c77447006814454573763aa3f496f6b32202
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default-browser-agent.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\default-browser-agent.exe
        • Size 32KB
        • SHA256 942e98f96302bbaf0e444f26b5ff9e630bbbc6c8fe21e75773607edcbacd5e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dependentlibs.list
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\dependentlibs.list
        • Size 55B
        • SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firefox.VisualElementsManifest.xml
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\firefox.VisualElementsManifest.xml
        • Size 557B
        • SHA256 3b25ae142729ed15f3a10ebce2621bfa07fda5e4d76850763987a064122f7ae6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firefox.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\firefox.exe
        • Size 659KB
        • SHA256 5218a481b56474bcd4630174f3610011aef30f8b5ce2b162c2401eb1b0ceb5d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        firefox.exe.sig
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\firefox.exe.sig
        • Size 1KB
        • SHA256 3a99b564600c2a39b66edfe4fe493c74beb6e3523b8a94a9596aaa622aac89d2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        freebl3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\freebl3.dll
        • Size 977KB
        • SHA256 826977fe4476062c842162406e0a4a2c5ade5b6ae5547afc75b427d34fcadfcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gkcodecs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\gkcodecs.dll
        • Size 9.1MB
        • SHA256 aa4a973b896035590687f23909d359a96e4eb0043ede2cdf86f404906b3b7612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ipcclientcerts.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\ipcclientcerts.dll
        • Size 203KB
        • SHA256 557905481764bbfb09e2c6610411dc65233fd5ad33c6d7a06e5b9c0843e722fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lgpllibs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\lgpllibs.dll
        • Size 151KB
        • SHA256 015416a1f39dfe40a2f659f058c8b95bfed2ff1ff38fe8aa1cd02bcd8275c4e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\libEGL.dll
        • Size 46KB
        • SHA256 0b4baae6980b41c6e81d7dc28481739802962245894ea525c3064ed25d0823c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\libGLESv2.dll
        • Size 4.8MB
        • SHA256 cfd1cf812c15f9b08431ca4bfea537c778b45442b03f3bbfcb7303d5908c48eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        locale.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\locale.ini
        • Size 22B
        • SHA256 d20e9ac1e8f4f5ec827cb2332d39fd0d286d7e1987bc0ffa5567f709347c23f4
        • MD5 SHA1 SHA512
        Submit Download

        maintenanceservice.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\maintenanceservice.exe
        • Size 269KB
        • SHA256 a45b4b6e3ea4055a8e2302e4a268d527ed7e9acea5ac1e982ef09fd0dae38f66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice_installer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\maintenanceservice_installer.exe
        • Size 183KB
        • SHA256 22e0581491bacaa48b5e20f0459fde0ecde3c7e383756c87fa4831ae0117e35e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        minidump-analyzer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\minidump-analyzer.exe
        • Size 752KB
        • SHA256 529c2900639682b41a27a9a2fd24cccb5ef22dcf4cec798652842aaaaac144cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mozavcodec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\mozavcodec.dll
        • Size 3.0MB
        • SHA256 64e4ab387da542eeb5f7c3e94d78325613407eea2b20c423e189a7d5b7a861f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mozavutil.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\mozavutil.dll
        • Size 560KB
        • SHA256 0a3fb828cc9e1c67f31e6d8a2c40431182c89cc312b1f6e9e8a019f4c75f2f8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mozglue.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\mozglue.dll
        • Size 1001KB
        • SHA256 30a42964ffc0ef3d86b96231ee59b1d0b706e0e72449aaa62a4ace21ae93cc4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mozwer.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\mozwer.dll
        • Size 322KB
        • SHA256 d8a6117d8d8c76b33c24c206b43b6a36424b31a488965edfb8cca3dfd2b486c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\msvcp140.dll
        • Size 559KB
        • SHA256 1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nmhproxy.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\nmhproxy.exe
        • Size 626KB
        • SHA256 6165c719e77098f65682b90df4372e4399cb65cae3997790a6aace9b7d6580d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notificationserver.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\notificationserver.dll
        • Size 59KB
        • SHA256 dcafb39a979e3e3ae860fdac4e73f0a467b8f8e21e8f717c9525d9fca3ec1eb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nss3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\nss3.dll
        • Size 2.6MB
        • SHA256 8b408fdcab20e6dbd02f2caed4ecab78deef8fe9014aba2211e3b54ab587a4af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nssckbi.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\nssckbi.dll
        • Size 365KB
        • SHA256 75301e616641cc4934ebd52d47bd72f513d0a0f59e398f88131476040f1f4459
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        omni.ja
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\omni.ja
        • Size 33.8MB
        • SHA256 5c65dc5ca42aface2ebec6c353023bdf9ec33ea47bb30144233360a24c354e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osclientcerts.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\osclientcerts.dll
        • Size 355KB
        • SHA256 067057ab966050247628e91b8d2d702315bc6f14946d18cb86672b120fbc9858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pingsender.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\pingsender.exe
        • Size 77KB
        • SHA256 9a686e1f26212e1f48b1225412dde7f5e9dad7389802db4eb9ce20ecc509aeaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        platform.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\platform.ini
        • Size 165B
        • SHA256 a592ed5e8c8a2f50f7969374d3c34ec145064782d10d57eb39cc080d9c886dce
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        plugin-container.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\plugin-container.exe
        • Size 282KB
        • SHA256 f9c85db13e3117df748f3e7871d9763f5bbe80a217562fbdc5fb2f09bcf51bde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        plugin-container.exe.sig
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\plugin-container.exe.sig
        • Size 1KB
        • SHA256 48f64ec0295fe25beaddc70099f5a4b698ef6a1ba4d0301019468fc81481be96
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        precomplete
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\precomplete
        • Size 2KB
        • SHA256 1c95f61bb51a50f12769db3179c9b9cac731e24150923043c23901ba8c1e308e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        private_browsing.VisualElementsManifest.xml
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\private_browsing.VisualElementsManifest.xml
        • Size 559B
        • SHA256 9ea86a18d41112e25b17454044ac29b458f508d9814700a6f4c0f9370678f3ae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        private_browsing.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\private_browsing.exe
        • Size 63KB
        • SHA256 f7fc3afeab32161896bd31c82f7348310334ab4df22637e49dc8c3eb722630b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        removed-files
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\removed-files
        • Size 16B
        • SHA256 52523da24287c4d459131c2e4818a713a732765e06e9bbba1cf353888ba34f9f
        • MD5 SHA1 SHA512
        Submit Download

        softokn3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\softokn3.dll
        • Size 314KB
        • SHA256 f9e9fe54b275bfc0a4c752f9f53b495129bad91eeac357b7b9d510f7bcc339c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        update-settings.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\update-settings.ini
        • Size 132B
        • SHA256 c18489344fdc21ae366b4d957a0b9f11be772483ca46f9ffab6ed0356f946513
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        updater.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\updater.exe
        • Size 452KB
        • SHA256 2753f0953f6ae91768e1f150bd491a083197fa3c94e2f0b62ea0c09965bf9bff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        updater.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\updater.ini
        • Size 1KB
        • SHA256 c59fa638b81f3e89080eb16e712c517a9ef04b482bae8774aa78f0bf2ef622de
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\vcruntime140.dll
        • Size 116KB
        • SHA256 a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\core\vcruntime140_1.dll
        • Size 48KB
        • SHA256 6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS8D4A93BA\setup.exe
        • Size 937KB
        • SHA256 ce6fe600f35b0e8ee1794ad763b912bccffffbf1fa80e4867e557ee60e8df7de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AccessControl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\AccessControl.dll
        • Size 21KB
        • SHA256 ef4b548b27a6edab3bcb25cff0598918c645795850d62f232909dee851e04c6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ApplicationID.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\ApplicationID.dll
        • Size 55KB
        • SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CityHash.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\CityHash.dll
        • Size 53KB
        • SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ServicesHelper.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\ServicesHelper.dll
        • Size 14KB
        • SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ShellLink.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\ShellLink.dll
        • Size 14KB
        • SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\System.dll
        • Size 22KB
        • SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UAC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\UAC.dll
        • Size 28KB
        • SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        components.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\components.ini
        • Size 598B
        • SHA256 9e2b26bc248400139973fbf9a9453ca9dcbde36fe015e07e69c801f409b097b5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        extensions.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\extensions.ini
        • Size 402B
        • SHA256 4e3f2413784c7e3666c667eb2c35084154536edf9335d96f24d18a1d17590066
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        liteFirewallW.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\liteFirewallW.dll
        • Size 19KB
        • SHA256 708fb54cffb6aea3547fc5ac745d1435ecc814df563bef59ba7a94f57d082bbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\nsExec.dll
        • Size 17KB
        • SHA256 7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsJSON.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\nsJSON.dll
        • Size 33KB
        • SHA256 705f4947fb94254c4e5084e6a962045f6a4e790dfc1ecf59cd0fc3feb38bcbbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        options.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\options.ini
        • Size 1KB
        • SHA256 d1c32705d08f2701507b560eafe4f3f4b4dd1045621b6cc541e1dd14937d97af
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        shortcuts.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nshC3C0.tmp\shortcuts.ini
        • Size 732B
        • SHA256 5feb2286393d7c3ffe62d7ce778065787684fc67ca33b2ec33b45870ee7dee70
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CertCheck.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\CertCheck.dll
        • Size 5KB
        • SHA256 bcb6572fcb846d5b4459459a2ef9bde97628782b983eb23fadacbaec76528e6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CityHash.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\CityHash.dll
        • Size 43KB
        • SHA256 d3d7b3d7a7941d66c7f75257be90b12ac76f787af42cd58f019ce0280972598a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InetBgDL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\InetBgDL.dll
        • Size 7KB
        • SHA256 6b553f94ac133d8e70fac0fcaa01217fae24f85d134d3964c1beea278191cf83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\System.dll
        • Size 11KB
        • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UAC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\UAC.dll
        • Size 18KB
        • SHA256 0d21041a1b5cd9f9968fc1d457c78a802c9c5a23f375327e833501b65bcd095d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UserInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\UserInfo.dll
        • Size 4KB
        • SHA256 2862c7bc7f11715cebdea003564a0d70bf42b73451e2b672110e1392ec392922
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        WebBrowser.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\WebBrowser.dll
        • Size 93KB
        • SHA256 8ec65a3d8ae8a290a6066773e49387fd368f5697392dfb58eac1b63640e30444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bgstub.jpg
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\bgstub.jpg
        • Size 66KB
        • SHA256 4b7e441d51b790ee1c0baff19e4e968392a937877dfa8b84e74464f5ba7a4cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\config.ini
        • Size 187B
        • SHA256 812217f840657b7d310c406d7224eb1c339079ad48541d922e3f15f1b2e3d913
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installing.html
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\installing.html
        • Size 1KB
        • SHA256 6259f3a41a703f13466503e6fbd37ca40e94f565a2f4b4087fbcd87a13bf3ee1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installing.js
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\installing.js
        • Size 2KB
        • SHA256 2c286b6eefd38f032a385f3ac6a1f794deab3bac0fbff71bd0ba21453f477878
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installing_page.css
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\installing_page.css
        • Size 1KB
        • SHA256 43c38801c1746880625f97eee3fe37fe94d1300adf812bfe26e47b094b87523b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        stub_common.css
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\stub_common.css
        • Size 684B
        • SHA256 4d9495b6f0e18331659993b79440e414a6e607fcdaeacbc7477e0683cc0fa98b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        stub_common.js
        • Path C:\Users\Admin\AppData\Local\Temp\nsv7612.tmp\stub_common.js
        • Size 817B
        • SHA256 0e28aa770b0afade30be85c6dc1e50344db8f8cdd3fa01989d81a9e20a4990bd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox.lnk
        • Path C:\Users\Public\Desktop\Firefox.lnk
        • Size 902B
        • SHA256 b4caf3f160be63ab8070508e2b13534a2d35dc6b79f7edcbd8e83d94659474ce
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox.lnk
        • Path C:\Users\Public\Desktop\Firefox.lnk
        • Size 1000B
        • SHA256 156dd103f5309d68576afef5140064c90bf9a7e8e2483dec0c90f64eb53f293a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1080-91-0x0000000000400000-0x0000000000446000-memory.dmp
        Download

        memory/1080-0-0x0000000000400000-0x0000000000446000-memory.dmp
        Download

        memory/3672-35-0x0000000002220000-0x000000000222F000-memory.dmp
        Download

        memory/5336-490-0x0000000000400000-0x0000000000446000-memory.dmp
        Download

        memory/5336-146-0x0000000000400000-0x0000000000446000-memory.dmp
        Download