542b07411fb5753d5c3fdef8ad07f37b9391c4b0952c5408e1f52aa09fa89cd0

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
Size 516KB
Sample260910-p52qcaxvbx
SHA256 542b07411fb5753d5c3fdef8ad07f37b9391c4b0952c5408e1f52aa09fa89cd0
MD5 9d98583fe0063593a8ccd04fc1b5a8bf
SHA1 0cda6cee076db30ce8c76c978620a89e2036ec8a
SHA512 d6f026c7519436a8e44e67702149d0d67cded85cbdc7980f83a4bc34b764d4dd91f41801ff32f208c114ea86082a93a6af2440991ad904934748419c858ee60f
SSDEEP 6144:UsLqdufVUNDafAWz4f1Q8XX/WXsR6+DyPUT6aW7KZWpYFXDsBRHJeqD:PFUNDafCQ8XXT6+WPUT6aWzCFzwHJeO
TLSH
T146B48E13FB9540FAE527C5B448568516FA227C2607A0AACB33A5BF453E336D27E7D302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Executes dropped EXE 6 IoCs

pid	Process
2024	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1760	icsys.icn.exe
2480	explorer.exe
5276	spoolsv.exe
240	svchost.exe
3964	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2480	explorer.exe
240	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5124	firefox.exe
Token: SeDebugPrivilege	5124	firefox.exe
Token: SeDebugPrivilege	5124	firefox.exe
Token: SeDebugPrivilege	5124	firefox.exe
Token: SeDebugPrivilege	5124	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5124	firefox.exe
5124	firefox.exe
5124	firefox.exe
5124	firefox.exe
5124	firefox.exe
5124	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
1760	icsys.icn.exe
1760	icsys.icn.exe
2480	explorer.exe
2480	explorer.exe
5276	spoolsv.exe
5276	spoolsv.exe
240	svchost.exe
240	svchost.exe
5124	firefox.exe
3964	spoolsv.exe
3964	spoolsv.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2024	1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe	89
PID 1728 wrote to memory of 1760	1728	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe	90
PID 2024 wrote to memory of 4812	2024	2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe	91
PID 4812 wrote to memory of 5124	4812	firefox.exe	92
PID 4812 wrote to memory of 5124	4812	firefox.exe	92
PID 1760 wrote to memory of 2480	1760	icsys.icn.exe	93
PID 2480 wrote to memory of 5276	2480	explorer.exe	94
PID 5124 wrote to memory of 6004	5124	firefox.exe	95
PID 5124 wrote to memory of 6004	5124	firefox.exe	95
PID 5124 wrote to memory of 6004	5124	firefox.exe	95
PID 5276 wrote to memory of 240	5276	spoolsv.exe	96
PID 240 wrote to memory of 3964	240	svchost.exe	97
PID 5124 wrote to memory of 4980	5124	firefox.exe	98
PID 5124 wrote to memory of 4980	5124	firefox.exe	98
PID 5124 wrote to memory of 4980	5124	firefox.exe	98
PID 5124 wrote to memory of 4980	5124	firefox.exe	98
PID 5124 wrote to memory of 3036	5124	firefox.exe	99
PID 5124 wrote to memory of 3036	5124	firefox.exe	99
PID 5124 wrote to memory of 3036	5124	firefox.exe	99
PID 5124 wrote to memory of 3036	5124	firefox.exe	99
PID 5124 wrote to memory of 1804	5124	firefox.exe	100
PID 5124 wrote to memory of 1804	5124	firefox.exe	100
PID 5124 wrote to memory of 1804	5124	firefox.exe	100
PID 5124 wrote to memory of 5364	5124	firefox.exe	103
PID 5124 wrote to memory of 5364	5124	firefox.exe	103
PID 5124 wrote to memory of 5364	5124	firefox.exe	103
PID 5124 wrote to memory of 5364	5124	firefox.exe	103
PID 5124 wrote to memory of 1220	5124	firefox.exe	104
PID 5124 wrote to memory of 1220	5124	firefox.exe	104
PID 5124 wrote to memory of 1220	5124	firefox.exe	104
PID 5124 wrote to memory of 1220	5124	firefox.exe	104
PID 5124 wrote to memory of 2608	5124	firefox.exe	105
PID 5124 wrote to memory of 2608	5124	firefox.exe	105
PID 5124 wrote to memory of 2608	5124	firefox.exe	105
PID 5124 wrote to memory of 2608	5124	firefox.exe	105
PID 5124 wrote to memory of 4160	5124	firefox.exe	106
PID 5124 wrote to memory of 4160	5124	firefox.exe	106
PID 5124 wrote to memory of 4160	5124	firefox.exe	106
PID 5124 wrote to memory of 4160	5124	firefox.exe	106
PID 5124 wrote to memory of 4140	5124	firefox.exe	107
PID 5124 wrote to memory of 4140	5124	firefox.exe	107
PID 5124 wrote to memory of 4140	5124	firefox.exe	107
PID 5124 wrote to memory of 4140	5124	firefox.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- \??\c:\users\admin\appdata\local\temp\2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
  c:\users\admin\appdata\local\temp\2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5124
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {4896e9b7-bfd6-4967-a0e1-81767b7561cb} -parentPid 5124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5124" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:6004
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 27133 -prefMapHandle 2404 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {4ccb066c-9028-43c6-9a34-58691e59a2ee} -parentPid 5124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4980
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 27274 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {0bf3ff3d-fbbf-4cd8-b5b9-a247da71f69f} -parentPid 5124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        5⤵
        Checks processor information in registry
        
        PID:3036
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27274 -prefMapHandle 4016 -prefMapSize 270279 -ipcHandle 4032 -initialChannelId {98b3b531-eb00-4146-a3f9-358eb07eb841} -parentPid 5124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5124" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        5⤵
        
        PID:1804
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4472 -prefsLen 34773 -prefMapHandle 4476 -prefMapSize 270279 -jsInitHandle 4480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4488 -initialChannelId {7310edf3-8da1-4c07-96f6-10e3bd4a754a} -parentPid 5124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:5364
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4944 -prefsLen 35010 -prefMapHandle 5048 -prefMapSize 270279 -ipcHandle 5020 -initialChannelId {c3b4c521-ae0f-4cbe-a5f0-1d3bb275aa75} -parentPid 5124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        5⤵
        Checks processor information in registry
        
        PID:1220
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32952 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4448 -initialChannelId {b575cf0d-2352-40fe-95fb-2da7f06dc6d7} -parentPid 5124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:2608
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 32952 -prefMapHandle 5636 -prefMapSize 270279 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5700 -initialChannelId {55c3e576-63f7-4675-b828-b0fe59d4f39e} -parentPid 5124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:4160
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5880 -prefsLen 32952 -prefMapHandle 5884 -prefMapSize 270279 -jsInitHandle 5888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5892 -initialChannelId {d83b4821-8a86-48ac-aba2-1acf763395b6} -parentPid 5124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:4140
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1760
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5276
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:240
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 0940e17ca7b6a0853174ad37f97a34dab49cdeba5e2f3641b96c76955b851cc1
MD5 a54519e1c5bb868587b6fc0ab811e04b
SHA1 71d90cf69dad55e962a3b7d333e99dd323b90c20
SHA512 2f9b5b26b5c99b66878eef00d99346ce040152cb0d43bce0022e29482d9b9ca0ed1b6c4c450a0134f5636f23f455cc37195e615e6dac385941049317c4ade6d2
SSDEEP 384:HkCjiO024YiDL84KKDL849B7SOEAd9KVRaAcP+AWRMAhDF:EzZYiDL8lKDL8CB7S/AmVAf+hRMy
TLSH
T1E6729E395F003CBC1597C0E8C5F9929A8D18B7A7DFE680AD21583D0DCAD8A69B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
Size 381KB
SHA256 c20fd8ba674d57576c1f11c39d24b4cd034d242e63a8d7d6567df514f9b58e33
MD5 92e6e6cc37fa3e4ce31e04f2f72cebd8
SHA1 b6637913a4e301d77ea352a73c8e6562fbdabb7a
SHA512 1b3b9d0b2a4a2f70a6f9f7f6cdc9d17d3e168eba63d0f4a3a12c781e1396c0609fa77e4778a1d81046e2d68cd9b315dc131e73112fb8e479a732236d7b6b314e
SSDEEP 6144:mz4f1Q8XX/WXsR6+DyPUT6aW7KZWpYFXDsBRHJeqD:ZQ8XXT6+WPUT6aWzCFzwHJeY
TLSH
T10E84AE52F7D914FAE16BC23889424516FA72BC164760A2CF33A46E963F237E05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e32bed02daf8af34f1afd9c9eeb1937748f2ccd507a39d4e5433979345866284
MD5 18b608a743128bee38c2931a30a0fcb8
SHA1 7fc53f4711a780b8fe9caa444f8f82ba3877c72b
SHA512 e7f076592ad72eb25d32906296c9461465bd40f73e7969b3b421fc8bb34fa547fbe912e368f425fdd3478d60da3c2a95a43207c34e3a4a9f449796e4e44f27bc
SSDEEP 192:3Hv1d66JoztdzgCl6mc0dUOv5zbo7bZJnyjLc:td66Joz/zgC1jlbovZJnyj
TLSH
T1E9E11F64E639863FC40402BBCCA61B454F39398BD84E3F1935DD650C2D562DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 220cbc607a0d83ad722e88b3ae3a9c5b76c5a749b4c9f5566e312c95a02b0e35
MD5 25eab515f6526d47c97aaf426e1e2744
SHA1 a4fd214718eb42ad87dc630fd98e62e3753c4e44
SHA512 8dbf3a426b2e3cc35c7d8b3e5afe539f576cd9e67488d4a9108946174ee8e3121f3a81269b8bcdd417de0f89d4793457249fc1f588fed65769808357f27616ae
TLSH
T17F217C4C39B94E2A6DC7E6997481028F9B118E5708871D434D42EFCDCE81ADD727F439
MD5 SHA1 SHA512 TLSH

Submit Download

4b1fbe3e-ccb0-4c2d-8634-98ab1c80d23d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\4b1fbe3e-ccb0-4c2d-8634-98ab1c80d23d
Size 886B
SHA256 27aca16cf26b9d5c9f7a5c14858b557cb0ad314c489b3a9bc28604b5217b31ce
MD5 f921e41750c1240e0fbb019e8803edae
SHA1 1f8961334190b3526955d70367f308acd003323a
SHA512 73282026f7d820fc7f1ec6eabc062c60b8dbee66926601d559bb4434fb276eceeb1e532c236d0199b18847bd4f745d6c6cfec28cc111ca6cd149f80ca656f310
TLSH
T1C8110040CB31B9B2CC28938BC8E6B7468AA4751380C64A047E955F0C4DBA65FA767207
MD5 SHA1 SHA512 TLSH

Submit Download

56703a1d-615b-4ffd-926b-dd0ccb5a44f4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\56703a1d-615b-4ffd-926b-dd0ccb5a44f4
Size 235B
SHA256 2eac71f0157ca86e2aa5f856b2de7a475ebb70bfe96133075e78231ea1545e33
MD5 709d35aa76221dec5e247ed75ae4ccb0
SHA1 2d39ccd47555a0c3296a258dfb77bff634d5bfa2
SHA512 581bbaec8f389ee59ba09bd7ed3ed3a6b6898a2ce29cb7b60ad391a210a0eb51b116c4894cf508304b39dbcec7b3e6d8d584d0ce5a89adfe434b277fb215e95b
TLSH
T120D097821498B31D48104F02B4A078C6704C8C3320B46820AAE1403D9AB9EC88122D2B
MD5 SHA1 SHA512 TLSH

Submit Download

9acdbce1-ce04-4568-abb2-90622640a46f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\9acdbce1-ce04-4568-abb2-90622640a46f
Size 16KB
SHA256 0ce5a2ddbed8268d1ff46f0d3e3e50a282b8984f8f6256ebeaa7be39e599c8d0
MD5 32d17fa6fe33968a390a6c315d245b92
SHA1 486930eec9c886c78b7957fed0cfdb1b6d3df91a
SHA512 f05e6929ae3a6b0e894308b5eb16d90a5c8a4320988d417254a257c21336c62276ca044fed94f8fb3b5fc5fdaf2004cfd603f2024457333cc429b3772007acac
SSDEEP 192:UxS4eBKCe1pbkZ+CJmWpki2j1aURzVnKkOzUKqdi7VUc8A3RyxS8OnyTxm6m5Cp:iewCwuR2j1hRzVKzwKqdi7VFjIp
TLSH
T1FF72EB5668605ABE8151E3A9D8FC7FC3E2F538CF4C019FCA9BE4BD0859DA05E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6ebdb0e-fbe7-4769-9e55-c04a37c8ea88

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\a6ebdb0e-fbe7-4769-9e55-c04a37c8ea88
Size 883B
SHA256 37aa47436359669e0864269537cfa3242181e5df231c56efe40b4c4d6b05e9c7
MD5 b005ba5c8b073933a729a1f277f05542
SHA1 82e32ac49d95699aa8ea9404ef4b06bd7098dfa3
SHA512 d62e2b7dc2f39b9ec94f9bcd97f2b43936cd618ca05bbef266c9a7ff33f7992668e878fa30d3d3a9b49e8cf368891b48369a00f019194bf2b8f31e628212c914
TLSH
T17B114080D630B9B2CC28934F89A537418BB47A1380C645007DA54B080E7A61FA3A6247
MD5 SHA1 SHA512 TLSH

Submit Download

c3f15d40-f07b-4081-aad5-c53c17c7b673

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\c3f15d40-f07b-4081-aad5-c53c17c7b673
Size 235B
SHA256 67ae23e0920b97c844713b9057ee6da7ac5357adbf5d091862bccc6a90fbd0d5
MD5 88173fb7229b0a972bf0c9f9417e98d5
SHA1 cf1793d469722add06f12c1fdd1d8a111ce2bd94
SHA512 be87a91aa14f240e18bf5fcf80c70a2f7f34c477b3db90d605a5e07891eab3a8f0c27a440fff1c980d84dbf7acf4ec92ceee7e018866adf629e411f3066c21f9
TLSH
T189D097E028C8AB6C08041F03F0F0A9C7318CCC33106098109AB188B49AF8ED84211826
MD5 SHA1 SHA512 TLSH

Submit Download

e3ffe937-3234-409b-8642-6de26a348363

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\e3ffe937-3234-409b-8642-6de26a348363
Size 2KB
SHA256 b8bff83b7d011f7a97d3066bd0c04ad24f01095a3e4851e0f7c9b06a72c82e31
MD5 ed3afd753e4ff7c2f46ec02e3c02c438
SHA1 875e6ea6299fc41dc568b8769f4cbb9976041021
SHA512 f4cd120cbcd0da48c01803583b4b735ed8445bacf249fef07d82cc6e8f6adfb899efe2b49f39e468f2150d251332c59c03c61e647958a7087084738455bc0db3
TLSH
T1B241205C35785C369C8AF39DA49233CDA7609A07408318832E55DF0CCE967AE376B52B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 054660454c07d1746d490822be04cfdbf5e43fac41b77adb5541068027a26c24
MD5 018609a03b6dd9dbb33b118c9cdc29bb
SHA1 66e957c1050cd08a7779013f26d07b52e59655c3
SHA512 7031b9e1f78a9320e4431c89dc6b3959e97448068dfdb22255eb6d8accb792a0839c7d57d6d684a06cb08c33dc81f7de1ef424796e2d3878fab48509ca240bb6
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4HDg4hz:NI4fRfsXH446+4V4Y4N4Q4E4d
TLSH
T1F972531545048EB8294EA78BAA367E01C37D533B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 7KB
SHA256 2a9d0415e0db10d701ed1f16543cd78754fa2b1bf9e7f9cd90df1b61ffcddf6c
MD5 53ddedb6b0b0068ba8dcdb00709921ec
SHA1 22d2897f2ac6456b873bcc6bfbe552307d4dc56a
SHA512 d3995d45afe57fa91d8f5fba02bcf67efd898f1386916af73ceb57cd88a48e8f7e127dd78feadd28b9a7fe1d8f17f2d76c1271ffbdfb12a58e1f5264740756b0
SSDEEP 96:xHp5TUWqGqPf7QTObzS7MSSlvdv9jHn+cWRHN/CauMNBw88s848L4cnAV7wb:vMRPf7QTBMSSmRl7uMBw88MU
TLSH
T1BEF1FE3890088F6F64B6767CAC6449716EA2023BBBBF68C750B954C5014CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 6aa69e17962f22fb4e3510eb7870975a981b4b4517c90df01359a286eb3e7ddb
MD5 770c599f02f0348fdb30a3177d6a56a5
SHA1 1594f91306629461590892b3f038f7f14d8ab6f0
SHA512 93ebbe7521f32c1fd47909e510de03d5ac20246accbe0758ae2da9ddf4189dfcfdb53d3494c3f364c39c5580542b3f90ad5b0cad1b478d062c8ad0f9f0654528
SSDEEP 96:xHpUTUWqGqPf2BWB1zS7hSSlvdv9jin+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BWB2hSSej7/Bw88qU
TLSH
T1D1E1327890088F7F64B5777CAC688831AAB2413B7BBF28C350B95484014CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 a32b1fa7fd2eeb848bfa75bd5384e30ba6861d1ccecc68bb390f0a22b340ca5e
MD5 80aba28381155c55a4e9a4d614fcfb32
SHA1 ed5b4e9f3c988b0e50de559583c669d332f8f907
SHA512 e9ea23b239fd3dbadc88665f4bc9f4086bb9d15787e46fad0e210641a2cd810211795024c958a1f8a2797f2f9d9a5b0dc67c836d2263f3bce68237057ea4b6df
SSDEEP 96:xHpUTUWqGqPf2BQT1zS7MSSlvdv9jin+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BQTaMSSej7/Bw88qU
TLSH
T1C8E1217890488F7F64B6777CAC6888316AB2413B7BBF68C750B95484015CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 16422a5d61381e9f485f5066ed09ac6f450ca1898f94126162928c5376e8a4c7
MD5 0393e39dff8965ea4e1ccc635adedf9a
SHA1 b9cdec1c46fd7e6a4e6cdbd964dad438f84659db
SHA512 8f36e4d8baf634761b3c32e91a7e6e2b58a8585f67db2149b17d50c58a7ce99912f7455109d78b61e7e3911bb85a003af2d2fa53ec010a1b7b593f9ad1873815
SSDEEP 49152:KQZLL7RjjSRvYcU3B9nSrfj05p/JNp+C+:TLxR9nSrfj6p/J+C+
TLSH
T1C3362AF820D1A257F3814033664593EF21EFD00C6037DA085BA966E9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 fd6c3db297cedc5093ebf247481a995afbba037849baf63d9ea48fc1b3329c2e
MD5 15d0aa2e9fefe78aa53a9abc4426ee60
SHA1 944d7f6e5f332b3fccc00a5c378f1a96b99b59a6
SHA512 84a0163feadc34adb928e4c4a2ed4257db80ba7c99e27b0e03a8afda6e4cabdf78aad0666cc803311203f182f416c8363360db56cb1ec62dd0718a49f500b0d4
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVbqWKzjz:UVqoCl/YgjxEufVU0TbTyDDalNozjz
TLSH
T12BD30B137E10442FE8A189F128E9DB6DB6262E764BE16D0BB3A67B04367561371F031F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 52709e3a334ad508c57928f788096c7796c7176e75d2897d4e23a4c3c8683637
MD5 c9bfaf9efe67825fe5531214255053e4
SHA1 f2e15f710b5a083b4661437d5d1ca177b2dffb28
SHA512 ab5c8bddf00f7c68f06363e35590e6dea0c85104ca9d635a742bd7a46fac39e5ee8fdfcedbcbf6b94e90eeb732d595893e6497e4f399d1adde1295dd2e777d59
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVbqWKzjj:UVqoCl/YgjxEufVU0TbTyDDalNozjj
TLSH
T1D5D31A137F51903BE81289F22C9ADA6ABB261D361BE4AD073367FB40257221775F520F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 ed914ada09f631fd7f7a39034967acfdb9d6825bd1a8c216b8dac40b8e1203df
MD5 18b1d61c924a443342671bdb16457106
SHA1 658f26da471419d9f6ad531246dc6061860ee6b5
SHA512 5c82a6003439b06ec5ca766a99bdd450e419314d880548716bc47c9e1c20ef9be7ca72ac5213e800cd5d83db69d29753089b8cda9717976ecf89a06b1735d19a
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVbqWKzjn:UVqoCl/YgjxEufVU0TbTyDDalNozjn
TLSH
T1FAD3F9237E01903AD422C5F13CA6DF7AFA125E3A1BA16D077696BB0136B260775F121F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 7f62801a3d42d50cf699c80b635d57a138bcccb54c57e40e8cd265cbbe230c7e
MD5 d82a81e92313807d3772560003cff0a2
SHA1 a8d57936aa4c7324a6203027e61d2cfde03bfa32
SHA512 961599aac13112c641118d2cd54e88d0612ad3b6704ad8ae657eeb00d7945c0b8e9d497772d906e983df64e27641bfb83667dc1aad0c0aaa012743f81e6f39cb
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVbqWKzjY:UVqoCl/YgjxEufVU0TbTyDDalNozjY
TLSH
T182D309137E15906FD41184F12CA5DB2AB9665E361BE1BC0BA29BFF043672607BDF120B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-686-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1728-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1728-58-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1760-57-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2480-685-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3964-53-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5276-54-0x0000000000400000-0x000000000041F000-memory.dmp

Download