Overview

overview

10

Static

static

10

2026-10-12...ic.exe

windows10-2004-x64

9

2026-10-12...ic.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/10/2026, 22:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-12_b9f528bac1e5873914160d30139d3e87_blankgrabber_cobalt-strike_coinminer_emotet_glassworm_ic.exe
  • Size 57.6MB
  • Sample261013-11mamsb16w
  • SHA256 8a5d41af77aeded75cd1045229461c52c815f862dedd615aca576605845cbd07
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionexploitpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Possible privilege escalation attempt 4 IoCs
    exploit
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 32 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 16 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-12_b9f528bac1e5873914160d30139d3e87_blankgrabber_cobalt-strike_coinminer_emotet_glassworm_ic.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-12_b9f528bac1e5873914160d30139d3e87_blankgrabber_cobalt-strike_coinminer_emotet_glassworm_ic.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Users\Admin\AppData\Local\Temp\2026-10-12_b9f528bac1e5873914160d30139d3e87_blankgrabber_cobalt-strike_coinminer_emotet_glassworm_ic.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-12_b9f528bac1e5873914160d30139d3e87_blankgrabber_cobalt-strike_coinminer_emotet_glassworm_ic.exe
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5128
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls||clear
        3⤵
        • Executes a command shell one-liner
        PID:3608
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4332
        • C:\Windows\system32\netsh.exe
          netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:3144
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Windows\system32\netsh.exe
          netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:4652
      • C:\Windows\SYSTEM32\takeown.exe
        takeown /F C:\Windows\localhost.crt
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:3484
      • C:\Windows\SYSTEM32\icacls.exe
        icacls C:\Windows\localhost.crt /grant Administrators:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3612
      • C:\Windows\SYSTEM32\takeown.exe
        takeown /F C:\Windows\localhost.key
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:860
      • C:\Windows\SYSTEM32\icacls.exe
        icacls C:\Windows\localhost.key /grant Administrators:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2988
      • C:\Windows\SYSTEM32\certutil.exe
        certutil -addstore Root C:\Windows\localhost.crt
        3⤵
          PID:2476
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ipconfig /flushdns"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5920
          • C:\Windows\system32\ipconfig.exe
            ipconfig /flushdns
            4⤵
            • Gathers network information
            PID:5916
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6044
          • C:\Windows\system32\netsh.exe
            netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:2076
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5456
          • C:\Windows\system32\netsh.exe
            netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:4900
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface ipv4 add address "name=Loopback Pseudo-Interface 1" address=162.159.133.234 mask=255.255.255.255"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:476
          • C:\Windows\system32\netsh.exe
            netsh interface ipv4 add address "name=Loopback Pseudo-Interface 1" address=162.159.133.234 mask=255.255.255.255
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:5008
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface portproxy add v4tov4 listenaddress=162.159.133.234 listenport=443 connectaddress=127.0.0.1 connectport=443"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3216
          • C:\Windows\system32\netsh.exe
            netsh interface portproxy add v4tov4 listenaddress=162.159.133.234 listenport=443 connectaddress=127.0.0.1 connectport=443
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:5996
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface portproxy show all"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3312
          • C:\Windows\system32\netsh.exe
            netsh interface portproxy show all
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:2008
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc stop WinDivert"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3140
          • C:\Windows\system32\sc.exe
            sc stop WinDivert
            4⤵
            • Launches sc.exe
            PID:4464
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc delete WinDivert"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2540
          • C:\Windows\system32\sc.exe
            sc delete WinDivert
            4⤵
            • Launches sc.exe
            PID:3340
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc create WinDivert type= kernel start= demand binPath= "C:\Windows\WinDivert64.sys" DisplayName= "WinDivert Network Driver""
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1108
          • C:\Windows\system32\sc.exe
            sc create WinDivert type= kernel start= demand binPath= "C:\Windows\WinDivert64.sys" DisplayName= "WinDivert Network Driver"
            4⤵
            • Launches sc.exe
            PID:5564
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "sc start WinDivert"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1596
          • C:\Windows\system32\sc.exe
            sc start WinDivert
            4⤵
            • Launches sc.exe
            PID:4932
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4596
          • C:\Windows\system32\netsh.exe
            netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:4728
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5136
          • C:\Windows\system32\netsh.exe
            netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:5984
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c start "" "C:\Users\ijfdfhVgbR.exe"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3500
          • C:\Users\ijfdfhVgbR.exe
            "C:\Users\ijfdfhVgbR.exe"
            4⤵
            • Executes dropped EXE
            PID:3008
    • C:\Windows\WinDivert64.sys
      C:\Windows\WinDivert64.sys
      1⤵
      • Executes dropped EXE
      PID:4320
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:6012

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            Windows Command Shell

            1
            T1059.003

            System Services

            2
            T1569

            Service Execution

            2
            T1569.002

            Persistence

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            File and Directory Permissions Modification

            1
            T1222

            Impair Defenses

            1
            T1562

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            System Information Discovery

            1
            T1082

            System Network Configuration Discovery

            2
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Service Stop

            1
            T1489

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Loader.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\Loader.dll
            • Size 22.2MB
            • SHA256 f91eb13a1c40e14345a57cbb3c87035ff1bfcf9709b553984e6d8efe1cd8a83e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _imaging.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\PIL\_imaging.pyd
            • Size 2.5MB
            • SHA256 16a7c881fd3624c8428078ce24460861e91fc5cc43de1b3614dc2531fe327e2e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _imagingft.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\PIL\_imagingft.pyd
            • Size 2.1MB
            • SHA256 2c5951d8d3d6f2640545afcdd059f21f65e8571e24789f76790c18d501bf505c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _imagingmath.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\PIL\_imagingmath.pyd
            • Size 21KB
            • SHA256 91dbb83922daaa0a601b8a8282be60ebf7633a5b743565c3b579fcafda9b9094
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\VCRUNTIME140.dll
            • Size 94KB
            • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\VCRUNTIME140_1.dll
            • Size 36KB
            • SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\_bz2.pyd
            • Size 78KB
            • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _cffi_backend.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\_cffi_backend.pyd
            • Size 175KB
            • SHA256 e029cabce12aea3d77f2c8709a0f4be695f3fedd1144c14607b4fcc3b9e9bc3a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\_ctypes.pyd
            • Size 117KB
            • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _decimal.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\_decimal.pyd
            • Size 241KB
            • SHA256 384993b2b8cfcbf155e63f0ee2383a9f9483de92ab73736ff84590a0c4ca2690
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\_hashlib.pyd
            • Size 57KB
            • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\_lzma.pyd
            • Size 149KB
            • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\_queue.pyd
            • Size 26KB
            • SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\_socket.pyd
            • Size 72KB
            • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\_ssl.pyd
            • Size 152KB
            • SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\charset_normalizer\cd.pyd
            • Size 111KB
            • SHA256 1bde9df22733f4bad955abaa50afd3f4522d32f8c3f3609b5354c3612329773f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            md.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\charset_normalizer\md.pyd
            • Size 194KB
            • SHA256 3d56c85d19c471e270005ff4069733e6957d885c49bd58b23ecbd3c711d024e9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-7.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\libffi-7.dll
            • Size 32KB
            • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\libssl-1_1.dll
            • Size 678KB
            • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _sodium.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\nacl\_sodium.pyd
            • Size 396KB
            • SHA256 57822e7aed944269943bcb855fc14560a5b6ae38869de4e3d00c380a5119ecc7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _psutil_windows.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\psutil\_psutil_windows.pyd
            • Size 69KB
            • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            injector.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\pyinjector\injector.pyd
            • Size 20KB
            • SHA256 10575c0fe3fa9dabeddb0f65beb38e3d99081245de46c6770994ed28dbba397e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\python3.dll
            • Size 60KB
            • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python310.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\python310.dll
            • Size 4.2MB
            • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pywintypes310.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\pywintypes310.dll
            • Size 132KB
            • SHA256 d14a89c503599be257b733cafdd66ff8d0e77bc657360dee921d40374820c415
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\select.pyd
            • Size 25KB
            • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\unicodedata.pyd
            • Size 1.1MB
            • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            win32security.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4480_135092_Cak8A1rsfoI\win32security.pyd
            • Size 129KB
            • SHA256 35686c5ec1fda6b12691151fc4f98670183e4edca72575b7aac0f53034104120
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ijfdfhVgbR.exe
            • Path C:\Users\ijfdfhVgbR.exe
            • Size 4.1MB
            • SHA256 a7e955c4ba073c49c5baf1a66442e94fefcca63ffa08973b03cb2f3ffedde285
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WinDivert64.dll
            • Path C:\Windows\WinDivert64.dll
            • Size 22KB
            • SHA256 d0d8e5806952ce8f321d106551c680afe5a074cb9366a54282ff83397c64c27f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WinDivert64.sys
            • Path C:\Windows\WinDivert64.sys
            • Size 46KB
            • SHA256 9026147943bd44a1eb5e2f0c89cc8f441c7d1f13c1571aba54e262d2e7354798
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            localhost.crt
            • Path C:\Windows\localhost.crt
            • Size 1KB
            • SHA256 cdccb8ca37c41e47d0e11a6c78b7456f9dd329db2662ccab7f9bdeab69d30a46
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/4320-117-0x0000000000010000-0x000000000001E000-memory.dmp
            Download