542b07411fb5753d5c3fdef8ad07f37b9391c4b0952c5408e1f52aa09fa89cd0

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
Size 516KB
Sample260910-p52qcaxvbx
SHA256 542b07411fb5753d5c3fdef8ad07f37b9391c4b0952c5408e1f52aa09fa89cd0
MD5 9d98583fe0063593a8ccd04fc1b5a8bf
SHA1 0cda6cee076db30ce8c76c978620a89e2036ec8a
SHA512 d6f026c7519436a8e44e67702149d0d67cded85cbdc7980f83a4bc34b764d4dd91f41801ff32f208c114ea86082a93a6af2440991ad904934748419c858ee60f
SSDEEP 6144:UsLqdufVUNDafAWz4f1Q8XX/WXsR6+DyPUT6aW7KZWpYFXDsBRHJeqD:PFUNDafCQ8XXT6+WPUT6aWzCFzwHJeO
TLSH
T146B48E13FB9540FAE527C5B448568516FA227C2607A0AACB33A5BF453E336D27E7D302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe

Executes dropped EXE 6 IoCs

pid	Process
2400	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
3428	icsys.icn.exe
1660	explorer.exe
3368	spoolsv.exe
2924	svchost.exe
3212	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1660	explorer.exe
2924	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	firefox.exe
Token: SeDebugPrivilege	4604	firefox.exe
Token: SeDebugPrivilege	4604	firefox.exe
Token: SeDebugPrivilege	4604	firefox.exe
Token: SeDebugPrivilege	4604	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4604	firefox.exe
4604	firefox.exe
4604	firefox.exe
4604	firefox.exe
4604	firefox.exe
4604	firefox.exe
4604	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
3428	icsys.icn.exe
3428	icsys.icn.exe
1660	explorer.exe
1660	explorer.exe
3368	spoolsv.exe
3368	spoolsv.exe
2924	svchost.exe
2924	svchost.exe
3212	spoolsv.exe
3212	spoolsv.exe
4604	firefox.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 2400	4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe	85
PID 4996 wrote to memory of 3428	4996	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe	86
PID 2400 wrote to memory of 4708	2400	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe	87
PID 3428 wrote to memory of 1660	3428	icsys.icn.exe	89
PID 4708 wrote to memory of 4604	4708	firefox.exe	90
PID 4708 wrote to memory of 4604	4708	firefox.exe	90
PID 1660 wrote to memory of 3368	1660	explorer.exe	91
PID 3368 wrote to memory of 2924	3368	spoolsv.exe	92
PID 2924 wrote to memory of 3212	2924	svchost.exe	93
PID 4604 wrote to memory of 5076	4604	firefox.exe	94
PID 4604 wrote to memory of 5076	4604	firefox.exe	94
PID 4604 wrote to memory of 5076	4604	firefox.exe	94
PID 4604 wrote to memory of 1716	4604	firefox.exe	97
PID 4604 wrote to memory of 1716	4604	firefox.exe	97
PID 4604 wrote to memory of 1716	4604	firefox.exe	97
PID 4604 wrote to memory of 1716	4604	firefox.exe	97
PID 4604 wrote to memory of 212	4604	firefox.exe	98
PID 4604 wrote to memory of 212	4604	firefox.exe	98
PID 4604 wrote to memory of 212	4604	firefox.exe	98
PID 4604 wrote to memory of 212	4604	firefox.exe	98
PID 4604 wrote to memory of 2484	4604	firefox.exe	99
PID 4604 wrote to memory of 2484	4604	firefox.exe	99
PID 4604 wrote to memory of 2484	4604	firefox.exe	99
PID 4604 wrote to memory of 4780	4604	firefox.exe	100
PID 4604 wrote to memory of 4780	4604	firefox.exe	100
PID 4604 wrote to memory of 4780	4604	firefox.exe	100
PID 4604 wrote to memory of 4780	4604	firefox.exe	100
PID 4604 wrote to memory of 972	4604	firefox.exe	101
PID 4604 wrote to memory of 972	4604	firefox.exe	101
PID 4604 wrote to memory of 972	4604	firefox.exe	101
PID 4604 wrote to memory of 972	4604	firefox.exe	101
PID 4604 wrote to memory of 4928	4604	firefox.exe	102
PID 4604 wrote to memory of 4928	4604	firefox.exe	102
PID 4604 wrote to memory of 4928	4604	firefox.exe	102
PID 4604 wrote to memory of 4928	4604	firefox.exe	102
PID 4604 wrote to memory of 3120	4604	firefox.exe	103
PID 4604 wrote to memory of 3120	4604	firefox.exe	103
PID 4604 wrote to memory of 3120	4604	firefox.exe	103
PID 4604 wrote to memory of 3120	4604	firefox.exe	103
PID 4604 wrote to memory of 3716	4604	firefox.exe	104
PID 4604 wrote to memory of 3716	4604	firefox.exe	104
PID 4604 wrote to memory of 3716	4604	firefox.exe	104
PID 4604 wrote to memory of 3716	4604	firefox.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996
- \??\c:\users\admin\appdata\local\temp\2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
  c:\users\admin\appdata\local\temp\2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4604
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2032 -prefsLen 27099 -prefMapHandle 2036 -prefMapSize 270279 -ipcHandle 2128 -initialChannelId {7232c577-ce19-447e-b0e0-25187c699dee} -parentPid 4604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5076
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27135 -prefMapHandle 2492 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {c0fdfed9-6ad6-4164-b5ad-3320e4bb0dd5} -parentPid 4604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:1716
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3680 -prefsLen 27276 -prefMapHandle 3684 -prefMapSize 270279 -jsInitHandle 3688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3696 -initialChannelId {13fc7f70-8d12-4fa5-a58a-ebe114183f49} -parentPid 4604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        5⤵
        Checks processor information in registry
        
        PID:212
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3844 -prefsLen 27276 -prefMapHandle 3848 -prefMapSize 270279 -ipcHandle 3864 -initialChannelId {a83d46c6-a982-4a6f-bf00-5d20464d5e7b} -parentPid 4604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        5⤵
        
        PID:2484
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1584 -prefsLen 34775 -prefMapHandle 4288 -prefMapSize 270279 -jsInitHandle 4292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3204 -initialChannelId {4a8b8722-ee13-4163-9f75-7eeb0a7ff511} -parentPid 4604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:4780
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4844 -prefsLen 35012 -prefMapHandle 2840 -prefMapSize 270279 -ipcHandle 4916 -initialChannelId {68b76014-a785-4f28-9fc5-4bebf4f5e58b} -parentPid 4604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        5⤵
        Checks processor information in registry
        
        PID:972
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 32900 -prefMapHandle 5116 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5136 -initialChannelId {2d1a60b5-e020-4f42-9cec-c00059913816} -parentPid 4604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:4928
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 32900 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {400cfd9a-0071-4e42-9631-d51bd6970f33} -parentPid 4604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:3120
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5524 -prefsLen 32952 -prefMapHandle 5528 -prefMapSize 270279 -jsInitHandle 5532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {da2dead0-f1b1-4440-8b53-86156308cece} -parentPid 4604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:3716
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3428
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3368
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2924
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 06ff994360d6c3fdad02f38da25adf55ab1594a6951a6b59e354efd37eef49ce
MD5 ebc4686fd4f7d06e079c11125397cfcb
SHA1 fe46c9409f2c6d44f6bd635fffc471c6e7eae3b0
SHA512 f0e4ee190fedadfccc8d55094a7817607609309c2ea28682fecc4cbae47a452693cec73d7afb768abe671ad1714ab9fe806b93ceec81b7ba6c2812c60b7e770a
SSDEEP 384:HkCjiO024YVDL84KKDL849B7SOEAd9KVRaAcP+AWRMAhqy:EzZYVDL8lKDL8CB7S/AmVAf+hRMe
TLSH
T1C3729E395F003CBC1597C0E8C5F9929A8D18B7A7DFE680AD21583D0DCAD8A69B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
Size 381KB
SHA256 c20fd8ba674d57576c1f11c39d24b4cd034d242e63a8d7d6567df514f9b58e33
MD5 92e6e6cc37fa3e4ce31e04f2f72cebd8
SHA1 b6637913a4e301d77ea352a73c8e6562fbdabb7a
SHA512 1b3b9d0b2a4a2f70a6f9f7f6cdc9d17d3e168eba63d0f4a3a12c781e1396c0609fa77e4778a1d81046e2d68cd9b315dc131e73112fb8e479a732236d7b6b314e
SSDEEP 6144:mz4f1Q8XX/WXsR6+DyPUT6aW7KZWpYFXDsBRHJeqD:ZQ8XXT6+WPUT6aWzCFzwHJeY
TLSH
T10E84AE52F7D914FAE16BC23889424516FA72BC164760A2CF33A46E963F237E05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6f15009cbed5bc6bdbee502234572b33e0db673d60e0c6697e3222f6f1648687
MD5 e35a6fee0fafa5464d53c432681a114a
SHA1 f95b285e91fa48f6c6b396740ef77cf3fa243e63
SHA512 f40cf32f69cba43cb2196080a94cea4bc44ebf06f5c2b1425b49d9831bb67ceb69d3e00c0e44917dc34cf3923bedcbaaa3d8dcd9ca51ca5f81f5e025b1b541c2
SSDEEP 192:F1d66JozGzgCl6mc0dVOv5zboPKbVtyjiO:Dd66JozGzgC1j8boybVtyj
TLSH
T113E10D68E728863BC044427BCCA21F400F39399B984E7F19369D640C2D576DE769E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 61c8dcd711a753c5186f14674416fab3899e8f26b206f7af53b484966d067af2
MD5 d48fc1653fb943bbaff80b19d97e7fbe
SHA1 1547cdef5279ada2ed793492a5692a8d625662db
SHA512 adc0ada185099d96f062d9124eba564c0f846f7f39150171865173b4445c134ef318404345da11cad8e6bae422707d713aa556dea7b17ce95f04f75ca17b8b50
SSDEEP 96:sFKQFX1FQFMnFE/dd66JozGzgClKtmc0d/UGSdF95/7bkW60rcPyUR6rWZ:S61d66JozGzgCl6mc0dzOv5zbowCyjC
TLSH
T1BFB1B928F629463FD448423ACCA21B500E36398BA85E7F1936EC745D2D672CD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e2b193e8c824a3e9be4bbe7bb5f937fb6a73917b0ab4d3671848d0f0b1bd9cbe
MD5 6a8b4e281ca523463c6920e0972f51d0
SHA1 095c37be7352943aab33cba439a952a83184d738
SHA512 930d84b8f6e262972e08f649d786e8a1ea1d2c540985cbe581b978a75778c8b0869f49b1fbc73a60c0454dea80b09b6a5c852c12e8423c7e69717ecc1ed2bc58
SSDEEP 192:F1d66JozGzgCl6mc0dDOv5zboPKZVtyjiO+:Dd66JozGzgC1jWboyZVtyjI
TLSH
T160E1FD68E728863BC044027BCCA21F440F39389B9C4E7F19369C640C2D576DE7A9E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b8dd0fd-9114-48e2-b8e1-ac4975d947e5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\2b8dd0fd-9114-48e2-b8e1-ac4975d947e5
Size 2KB
SHA256 806ea5ebe86f3b28b00d12019f24ab7571788ace8c324b38d5d564e3408d3380
MD5 1e2b2aeec1d1b401a664c57571365e2a
SHA1 d0a541ffa3bddb447b0ccad84f1ca90e04c05a8f
SHA512 edd06d268bf228bffcd6e8f73e7e5a7b0b896274d30e2f7de165cb1a5888bdb6b8dbc0b1121b603e473a2d2f01957ef058167aabeafa23fe79c18b49a58f0ab1
TLSH
T1A541755C36789C778CEEE59DD882334D57A08A1300C62C536EA2DE0C8CD666D376E53B
MD5 SHA1 SHA512 TLSH

Submit Download

31a67145-6e9b-40a6-87e1-bb3ca5bc0785

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\31a67145-6e9b-40a6-87e1-bb3ca5bc0785
Size 15KB
SHA256 72d42d9afa1e0ccbfeb855430837e73b0546541c6d7333d3a34beadca4d0d123
MD5 7e42440ea55235b37d91cb92a4458dec
SHA1 b1124916007d306fe7e843f62faf1c79250ed6c1
SHA512 a90e1ee95f011a1623345dddd695f3b16799db3c7034959f7b69b72b182a2091d9478720e972cadb27a36a91ee948ff3a50419323a373b13c02678a3371bd47c
SSDEEP 192:ZCVIS4yzO1lBQ2E8ru/rzzU1EgQK3v8Nk6P1Zv0KvyKat0Xz+7m86dTzdd4Fuzaj:cr4bLi/rvU1EgQU8N/P1Z9vyKm0XzPj0
TLSH
T1F972C9166860567A8251E3A898F87FC3E6F638CF4C019FCD9BE4BD085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad2f3302-1372-4b5c-afa4-d8e952e85c9a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\ad2f3302-1372-4b5c-afa4-d8e952e85c9a
Size 883B
SHA256 b7c561bff653a7c2c72d2fd85d1122583b5696c17efba11bc5cb69a323bdfbe8
MD5 258c22fee6d32ee67f330367a38f8800
SHA1 8cd66688ffc37f84feff1e5f7b8b3f0b43ae48df
SHA512 b0b561ddf2a24afd23f9c646ce81e7ab90e75b8bae14f4b2d51ce6a373f99bb19fc648f341ae8c3ffd705bb81c05f5e0a862948a250c5ae66b97c9309b0d94e5
TLSH
T1B61123459734BAB2CCB8D24FCD617B015FE4BA1380C994143FA91D080D7A92E93AB20B
MD5 SHA1 SHA512 TLSH

Submit Download

b30a37e9-76c2-4234-adb4-7a439734dd4e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\b30a37e9-76c2-4234-adb4-7a439734dd4e
Size 235B
SHA256 b4c4a87d644dbf626adb06dccbfc91f6802f2d96e5285c0e3f7be464a93c1365
MD5 b6dacf7a5a59ea1d5300e9959b9c298b
SHA1 fbf28f2cfea8a84a6d37ed953f8a24121bbb7959
SHA512 9344d9b2f81ac263511fac137cb851ba79d24092a9d21aa62e17705f2f3070165f41b01599bc6d4d85083e013715b6c1f87a0afe5d5cfe1d75f84c5bbbe65b42
TLSH
T183D097801888B39C08280F22F0E068C630888C3314B46C20F992023CC9FEBCC8221D1B
MD5 SHA1 SHA512 TLSH

Submit Download

b9fd7626-770b-48af-8f28-fc47907621c1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\b9fd7626-770b-48af-8f28-fc47907621c1
Size 886B
SHA256 e4c14f27a645e2d9fbdafc86d0d6fd7f74bfe4b873ba5ac7df21c6668be9ab50
MD5 4ce2763281b73f0cb9f3de787e486099
SHA1 e524992458842940cf5c7ac6839ab82cf188bdb3
SHA512 b85a7ea9ab7346b66f2240459c212624ce2bae7cb314dc8273726227dc810b53ca86290ab511270e23f489c3b95de0375fd905425d469bc12eecea66bd0bed00
TLSH
T1BE1100954778B9B28C68929B89D077428FE4B52380C699187F582A1C0DBA91EA36B207
MD5 SHA1 SHA512 TLSH

Submit Download

d4e8fbb3-d981-418b-9f59-0e5ad5ce4f92

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\d4e8fbb3-d981-418b-9f59-0e5ad5ce4f92
Size 235B
SHA256 2ccd5fe96ea804d8148fc8aaa2dc34d6272651560255407f3c87c8f48235df54
MD5 ed27f0f6e0a99f42821268bc808284f3
SHA1 6655d8686ef1adef23e6220ddee6a843539d65b2
SHA512 89da25de25fd6745e2321d3e08d776b39d893ceed88adab36b7b2b8a9d2e9aab8b3e77d681c034ecd17377d6df9bc9d3a4cb2b97739d8644d5cd45e088b8aba3
TLSH
T176D097C494D87B6E0C200F0AF5F82CC2308A8C331874A860E9A105B9D9F9DCD021282B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json
Size 16KB
SHA256 2e5fe1e797f0343e3690b80464485b910c288f590951053f1c93136b4f3c2758
MD5 f33401e36145cd7da78bd7e7708a4df4
SHA1 256e27aa0bf05296468703eed875a47fc407faae
SHA512 85c817b1c99490e3036c08e1dff8b35d65dac7c9cbdadbd1ffa5740389cd6d7096a091e2067221c0c5f2b3708cd59f543c3fe2b503cb86185d03e01eccd31a4f
SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4H2m4hl:mI4dRfFXQ4d614d4D4J4+4543
TLSH
T18F72521545049EB8298F978AAA367E02C37D433B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 8KB
SHA256 7f7e9f426120dd16daf03f189f9dc5cfe2e14e8a2b6569173193bcd23b882385
MD5 114d5b499f2e6b4dea76b6702f0f9136
SHA1 eb95bc1b955d460c77edf89e8375eda6b6136437
SHA512 5da7ba95bee9d5b95334577e8fdd748bc04d83f40a7b5ece3ab98ec61b42ef58bfa6e40663fdd4fccaea85363e1ec4328b4ed51e87cc89dabf08740269e104d3
SSDEEP 96:xH4flTUOPqGqsWf1yJObzS9SSladv9jZnIWR4NKU42Bw887kZ8L4cnTDEx:mfURsWf1yJLSS2R7F2Bw887Y
TLSH
T1EB020F389504CB6F74B6366DAC2448315AA2063BBBBF68D710B954C5051CF3482FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 1e739ca34c2c6298f6f38e94af259b2f6ec38e619827f80f3c0d922fddcd1854
MD5 06923679a8e6947e33c51b15e733bbfa
SHA1 2313b1a83723174ba0207378ecb0816ffc6bb497
SHA512 8b26a98b2a44c3e76c364223463dea12d5658c9fac81d958afa5ddeb354e86917ae4e33440955dc5673bc0b1a869a48070bee97e59ecf6c9cd145b34f5229c65
SSDEEP 96:xH4fUTUOPqGqsWf24P1zSh6uSSladv9junIHeABw88n8L4cnTDEx:mf5RsWf24P4PSSIeABw88qY
TLSH
T139E12F7895188F6F74B677ACAC6888716AB2413B7BBF68D710B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 d513433f7535901ab8fdbea88dcbc94f2b321e08cb0dd210e0c19f546bd62d93
MD5 20bfc015f1115b20f76c01fbd4739a18
SHA1 c1b95d775a6f73cd0a0affb452ef663af05d64fc
SHA512 6139f57d24dad1035d3a6a9f91ac5a5e7972ee2649c9d2e1a27ee63f1aa3e2e0d99c2e3e8c67495d51da0d73d0c5772fe4bf633a20aae253718eb81eff803548
SSDEEP 96:xH4fUTUOPqGqsWf2yJObzS9SSladv9jZnIHeABw88n8L4cnTDEx:mf5RsWf2yJLSSneABw88qY
TLSH
T1B7E1317895188F6F74B6776CAC6888316AB2413B7BBF68D710B954C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 e29206cc4bc1c5516d5be3deb16aa0c9250964976dbcae3e3cae181057b27c12
MD5 4809e59bfd2040849be84b4f10cef9d6
SHA1 d58db58e65d6a2882d7dfa59a994f347358f30eb
SHA512 46134383752d52349e9864c084cab881189b85a20c9dcbb112f6cac9f3ed4f98c03dfa8e69c5f521c37d49b2322466dfe400d4d418c98877ead4c1d3f8d1bca5
SSDEEP 96:xH4fUTUOPqGqsWf2yJ1zS9SSladv9junIHeABw88n8L4cnTDEx:mf5RsWf2yJsSSIeABw88qY
TLSH
T17EE13F7895188F6F74B677ACAC6888716AB2413B7BBF68D710B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 7d46c653504d91f02ce33542c7980457ead89d92f27c42f00facacdfe7904d53
MD5 a1c01ac73d2fdb0ac5658f9317370bb6
SHA1 e724b731fc5f8c33623c91d094bea6498c9a8b01
SHA512 494e51de9a2b9265aa4cccf7fe63c0eafd6593e31a6b5114e394e7a14b4c75b7ec68e4080a718b3b6c780f168fe9d777eefa4d9adfe54b9b5a5816bd52220fc4
TLSH
T135210A8399771EFDBE625021D4884FE7C65C3431CC25B4F0519D9E0612E920E778A008
MD5 SHA1 SHA512 TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 00553ac34f907c7b09ccc2d91878773230eb5fb3175a2e4cd57b9fbe592401f9
MD5 14f36cf0b2d4f032b95185e4a4e30169
SHA1 41f294b39ac4c0fdc45b57da6b281e469d1686d5
SHA512 3c978ae0d3c0687c20050197d120a5a4978e1b3f5c8d4ae99ad2623989b808d920a27660cf6af4a71fb78a7aa90fcb2b766d57c13c516db81b8bb52a9df6288e
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVbqWKzjm:UVqoCl/YgjxEufVU0TbTyDDalNozjm
TLSH
T144D31A237E00542BD812CBF278ABD66EBA125E3A1BA5BD073396BB01357164375F121F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 52709e3a334ad508c57928f788096c7796c7176e75d2897d4e23a4c3c8683637
MD5 c9bfaf9efe67825fe5531214255053e4
SHA1 f2e15f710b5a083b4661437d5d1ca177b2dffb28
SHA512 ab5c8bddf00f7c68f06363e35590e6dea0c85104ca9d635a742bd7a46fac39e5ee8fdfcedbcbf6b94e90eeb732d595893e6497e4f399d1adde1295dd2e777d59
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVbqWKzjj:UVqoCl/YgjxEufVU0TbTyDDalNozjj
TLSH
T1D5D31A137F51903BE81289F22C9ADA6ABB261D361BE4AD073367FB40257221775F520F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 cf044043285c2ba31d1d805efda1a281f61ab35068742f8fc62c5a3d089b266c
MD5 5707e6f76453631513e59e66a28c0774
SHA1 df9be2702ee4f8e1e4d8213abccb1bdc0e0903ea
SHA512 129c624bcf352b36a7ec65c1ab53f960ebc28db78c1b718032c2a6858537082ddc972ed2b2e58522cd032fdabcfad03d86b0484a9392597110d4addb5bec3650
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVbqWKzjc11111116:UVqoCl/YgjxEufVU0TbTyDDalNozjB
TLSH
T1CDD33C23BF05902ED9118AF02CA6D76FB7225F750B91EC4776A6BF1821B1A4375F120B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path \??\c:\windows\resources\spoolsv.exe
Size 135KB
SHA256 32d95555af13ca7917679be7efd9cbd463301bc2f652313c8b0ef2c87593ae7f
MD5 682411f7c5e088e48697b576fc34fc19
SHA1 3d03d75c91afe5e2339dbbc9b02dbbbd7be74b43
SHA512 9fb01650d6e886401cd19bfc0a69ad21b58ba6e968251c6365c2ce7f7a88b7a82a5b3b7d355814add86ebf1a30be5e8baa994e6b7df0be77374020a984aadcaa
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVbqWKzj6:UVqoCl/YgjxEufVU0TbTyDDalNozj6
TLSH
T18CD31B17BF10603FC56589F12CA4DA2EBD565E2917E1BE873396BB0125B22037AF025F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1660-705-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2924-706-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3212-46-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3368-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3368-33-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3428-12-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3428-49-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4996-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4996-50-0x0000000000400000-0x000000000041F000-memory.dmp

Download