Overview

overview

10

Static

static

10

2026-07-31...oa.exe

windows10-2004-x64

7

2026-07-31...oa.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    31/07/2026, 04:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_50e7dcc0200b1ac90394f9d83a65a3b5_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
  • Size 85.0MB
  • Sample260731-e1c63sce99
  • SHA256 14ab36417dad855d3fb70a90948ce5084e1002aa0ec1407cbbcce78b16d3c852
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Loads dropped DLL 48 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates processes with tasklist 1 TTPs 12 IoCs
    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 19 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_50e7dcc0200b1ac90394f9d83a65a3b5_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_50e7dcc0200b1ac90394f9d83a65a3b5_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_50e7dcc0200b1ac90394f9d83a65a3b5_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-31_50e7dcc0200b1ac90394f9d83a65a3b5_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4040
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-CimInstance Win32_BIOS).SerialNumber""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1084
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:716
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4644
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:260
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "getmac /fo csv /nh"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5036
        • C:\Windows\system32\getmac.exe
          getmac /fo csv /nh
          4⤵
            PID:1824
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1388
          • C:\Windows\system32\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1028
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PH.exe" /v Debugger"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1044
          • C:\Windows\system32\reg.exe
            reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PH.exe" /v Debugger
            4⤵
              PID:2976
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LastActivityView.exe" /v Debugger"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4416
            • C:\Windows\system32\reg.exe
              reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LastActivityView.exe" /v Debugger
              4⤵
                PID:4656
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jmap.exe" /v Debugger"
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2860
              • C:\Windows\system32\reg.exe
                reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jmap.exe" /v Debugger
                4⤵
                  PID:4120
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaningdetector.exe" /v Debugger"
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:976
                • C:\Windows\system32\reg.exe
                  reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaningdetector.exe" /v Debugger
                  4⤵
                    PID:3568
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5004
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3988
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3456
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:452
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4704
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2464
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5060
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5044
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2956
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3540
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3768
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3940
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1916
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3756
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4120
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5044
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4000
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4296
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3300
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1728
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2112
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2224

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  .wcleaner_mw.dat
                  • Path C:\Users\Admin\.wcleaner_mw.dat
                  • Size 37B
                  • SHA256 ab99c629f7c6ac58f9c2056878ba232cd83877ba516946bf44788bbc9130fc5f
                  • MD5 SHA1 SHA512
                  Submit Download

                  codicon-0.0.36.ttf
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\codicon-0.0.36.ttf
                  • Size 78KB
                  • SHA256 360527575395ad70f940eff1e43eb7c2ec64f4e69f89dc5861b73420d2a578f0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  codicon-charmap-0.0.36.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\codicon-charmap-0.0.36.json
                  • Size 16KB
                  • SHA256 84a8d9e2c5cb0587df5876714fd5012c8b21973b81203865418effeec05123d0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elusiveicons-webfont-2.0.ttf
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\elusiveicons-webfont-2.0.ttf
                  • Size 77KB
                  • SHA256 29b93f3fe666bf73dcc857869aee47532f710c0a16959c6275dc5bc2e3be4c9e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elusiveicons-webfont-charmap-2.0.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\elusiveicons-webfont-charmap-2.0.json
                  • Size 7KB
                  • SHA256 be05507fc31c47f89910983b030fec906ee86861a79b8e03b1f24029699679e8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fontawesome5-brands-webfont-5.15.4.ttf
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome5-brands-webfont-5.15.4.ttf
                  • Size 130KB
                  • SHA256 cda59d6efffa685830fd95b55f64ae9cb51279cd34b2410b69f84c7ec30157d9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fontawesome5-brands-webfont-charmap-5.15.4.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome5-brands-webfont-charmap-5.15.4.json
                  • Size 11KB
                  • SHA256 d00ae829ec115926c670397b7bc470656fae8dc2bdd5b48a81c753dc854ca1fa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fontawesome5-regular-webfont-5.15.4.ttf
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome5-regular-webfont-5.15.4.ttf
                  • Size 32KB
                  • SHA256 fb5143dfe010d47b0fdedd36e4bac1ac8ff2e39b9f20b64891a88a7a219422f5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fontawesome5-regular-webfont-charmap-5.15.4.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome5-regular-webfont-charmap-5.15.4.json
                  • Size 3KB
                  • SHA256 a6d7282a3908283443feedafd07083e33bb7e2c56e813542d4ef79f8dadd2309
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  fontawesome5-solid-webfont-5.15.4.ttf
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome5-solid-webfont-5.15.4.ttf
                  • Size 197KB
                  • SHA256 4c5431bc1b2abf8aed5c614f2f32120d666bdda640cb1a7678d70e08cdd4323f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fontawesome5-solid-webfont-charmap-5.15.4.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome5-solid-webfont-charmap-5.15.4.json
                  • Size 25KB
                  • SHA256 1b0cac3ed4d3b144965a45aba9ad31e8654e4735d94b4ed9bced1b5eea9804d3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fontawesome6-brands-webfont-6.7.2.ttf
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome6-brands-webfont-6.7.2.ttf
                  • Size 205KB
                  • SHA256 808443ae6c8204395add8543da8a90a60b9376fb0f87ed8e8ea37d109596d805
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fontawesome6-brands-webfont-charmap-6.7.2.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome6-brands-webfont-charmap-6.7.2.json
                  • Size 12KB
                  • SHA256 8f7ba0f01ed36b3f7a0c456556ed1f80d18f306006a9cf79929b2366e4d06649
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fontawesome6-regular-webfont-6.7.2.ttf
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome6-regular-webfont-6.7.2.ttf
                  • Size 66KB
                  • SHA256 cffc8c04d8257c600e0533bdf7cfbf0775b801b50bc39a6f8122ee0c48a1373d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fontawesome6-regular-webfont-charmap-6.7.2.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome6-regular-webfont-charmap-6.7.2.json
                  • Size 4KB
                  • SHA256 769c282ba20a9cf5b672e90bbe6ed6d52ebb1c0fbbf5614a42ac01f2f12f9365
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fontawesome6-solid-webfont-6.7.2.ttf
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome6-solid-webfont-6.7.2.ttf
                  • Size 416KB
                  • SHA256 220d6d592b543eb991b8c11137ef0082c27d6ff6fdaa25e4335945f57a487c6c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fontawesome6-solid-webfont-charmap-6.7.2.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome6-solid-webfont-charmap-6.7.2.json
                  • Size 37KB
                  • SHA256 48607f738a71763a3557abe077133ff36b48b1bfa27d2f0d25b5a5c1f8a89127
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  materialdesignicons5-webfont-5.9.55.ttf
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\materialdesignicons5-webfont-5.9.55.ttf
                  • Size 1002KB
                  • SHA256 f89ca374a7545105f70a6345919083f9011badade1ff17f5e99f97853e7c33da
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  materialdesignicons5-webfont-charmap-5.9.55.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\materialdesignicons5-webfont-charmap-5.9.55.json
                  • Size 195KB
                  • SHA256 0eb43894facba7a61299088a385fcc6f293976501339682d1a2e0bdea248f68a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  materialdesignicons6-webfont-6.9.96.ttf
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\materialdesignicons6-webfont-6.9.96.ttf
                  • Size 1.2MB
                  • SHA256 be825c1294d3c4f046c8e496b18f8f0c7d2864e339c81bdab9297f17ffac1938
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  materialdesignicons6-webfont-charmap-6.9.96.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\materialdesignicons6-webfont-charmap-6.9.96.json
                  • Size 245KB
                  • SHA256 6317242191c4c889dec2c174f98dda0f309745d28c23c50a19bbbaf02df930a9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  phosphor-1.3.0.ttf
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\phosphor-1.3.0.ttf
                  • Size 1.3MB
                  • SHA256 351874de64758f3b7fb405cd078ac0ed5ffb9717fb5b9b10013ac03d4c13680b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  phosphor-charmap-1.3.0.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\phosphor-charmap-1.3.0.json
                  • Size 148KB
                  • SHA256 cfb725868f72d741422002f1ed4f870bdddebc32344a6407b8becb6c841b92ca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  remixicon-2.5.0.ttf
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\remixicon-2.5.0.ttf
                  • Size 393KB
                  • SHA256 0ac8bc3ccea26ed47e96844ef26675969c669714d723c081101e51799d501520
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  remixicon-charmap-2.5.0.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\remixicon-charmap-2.5.0.json
                  • Size 70KB
                  • SHA256 b90a112e76fc5f7f64d20bb5ec422fc9c7511d1f32be61c0f7d3b7a3933d4c0a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_cy4fmvhz.uvn.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cy4fmvhz.uvn.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  QtCore.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\PyQt5\QtCore.pyd
                  • Size 2.4MB
                  • SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  QtGui.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\PyQt5\QtGui.pyd
                  • Size 2.4MB
                  • SHA256 a9408e3b15ff3030f0e9acb3429000d253d3bb7206f750091a7130325f6d0d72
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  QtWidgets.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\PyQt5\QtWidgets.pyd
                  • Size 4.9MB
                  • SHA256 a1e97a2ab434c6ae5e56491c60172e59cdcce42960734e8bdf5d851b79361071
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sip.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\PyQt5\sip.pyd
                  • Size 117KB
                  • SHA256 3bf0eb6e243d978574ff6bfcfa28c884b7364cdd6799b205977aa0505718f591
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\VCRUNTIME140.dll
                  • Size 117KB
                  • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\VCRUNTIME140_1.dll
                  • Size 48KB
                  • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _bz2.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\_bz2.pyd
                  • Size 84KB
                  • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ctypes.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\_ctypes.pyd
                  • Size 124KB
                  • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _hashlib.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\_hashlib.pyd
                  • Size 67KB
                  • SHA256 03d233dbace599168eaffec823de6ed7beec8c2a4ebfe9b8a3d8e042a59af3ba
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _lzma.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\_lzma.pyd
                  • Size 157KB
                  • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _queue.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\_queue.pyd
                  • Size 32KB
                  • SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _socket.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\_socket.pyd
                  • Size 83KB
                  • SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ssl.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\_ssl.pyd
                  • Size 175KB
                  • SHA256 0bc527d2dbc50009f43b2ed5d5982c4f63f4b647647ffa9eda612dcda80f6040
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _wmi.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\_wmi.pyd
                  • Size 39KB
                  • SHA256 a980f1e7a29842bd946863fc2693fbeb555a9dc0f9e1630dfed9a2fcdef3ece2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  md.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\charset_normalizer\md.pyd
                  • Size 10KB
                  • SHA256 76a535e0953b48a2348b877236a5799cf1d01cb21422c7f17942f35367cb5c8f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  md__mypyc.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\charset_normalizer\md__mypyc.pyd
                  • Size 124KB
                  • SHA256 0830c3ff6e6f8394a7df170f95fc10de65ab9f22b30f9d2383f0cc299b8df101
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcrypto-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\libcrypto-3.dll
                  • Size 5.0MB
                  • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libffi-8.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\libffi-8.dll
                  • Size 38KB
                  • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libssl-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\libssl-3.dll
                  • Size 776KB
                  • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msvcp140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\msvcp140.dll
                  • Size 576KB
                  • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msvcp140_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\msvcp140_1.dll
                  • Size 30KB
                  • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\python3.dll
                  • Size 68KB
                  • SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python312.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\python312.dll
                  • Size 6.6MB
                  • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qt5core.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\qt5core.dll
                  • Size 5.7MB
                  • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qt5gui.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\qt5gui.dll
                  • Size 6.7MB
                  • SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qt5widgets.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\qt5widgets.dll
                  • Size 5.2MB
                  • SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  select.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\select.pyd
                  • Size 32KB
                  • SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  unicodedata.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\unicodedata.pyd
                  • Size 1.1MB
                  • SHA256 208ee1cd3cbad0828433ca7246b05be2b1ff5569983d27d296c0b38888585488
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  wCleaner.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\onefile_1680_403206_4_4oWpPytpk\wCleaner.dll
                  • Size 12.3MB
                  • SHA256 b18d9374e2684a84d58cff6f281121f882d428a66bf3a0376c26fb91c3dd9c01
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/716-177-0x0000022456FB0000-0x0000022456FD4000-memory.dmp
                  Download

                  memory/716-176-0x0000022456FB0000-0x0000022456FDA000-memory.dmp
                  Download

                  memory/716-175-0x000002243D270000-0x000002243D292000-memory.dmp
                  Download

                  memory/4040-151-0x00007FFD89C20000-0x00007FFD89E85000-memory.dmp
                  Download

                  memory/4040-143-0x00007FFD8AD90000-0x00007FFD8B2D1000-memory.dmp
                  Download

                  memory/4040-142-0x00007FFD8B2E0000-0x00007FFD8B7CC000-memory.dmp
                  Download

                  memory/4040-148-0x00007FFD89E90000-0x00007FFD8A0F3000-memory.dmp
                  Download