Overview

overview

7

Static

static

3

Windows De...ty.exe

windows10-2004-x64

7

Windows De...ty.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 17:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Windows Defender smart host security.exe
  • Size 69.5MB
  • Sample261020-warefsvs2j
  • SHA256 35da31b12e2c66f2954b9edb93189d9aefb500deb22d879a0623fc6b0729d0cd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows Defender smart host security.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows Defender smart host security.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Users\Admin\AppData\Local\Temp\Windows Defender smart host security.exe
      "C:\Users\Admin\AppData\Local\Temp\Windows Defender smart host security.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1228
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E4
    1⤵
      PID:3928

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\VCRUNTIME140.dll
          • Size 116KB
          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_asyncio.pyd
          • Size 69KB
          • SHA256 2dfcaec25de17be21f91456256219578eae9a7aec5d21385dec53d0840cf0b8d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_bz2.pyd
          • Size 83KB
          • SHA256 f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_ctypes.pyd
          • Size 122KB
          • SHA256 be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_decimal.pyd
          • Size 245KB
          • SHA256 e4104e47399d3f635a14d649f61250e9fd37f7e65c81ffe11f099923f8532577
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_hashlib.pyd
          • Size 64KB
          • SHA256 79c4cde23397b9a35b54a3c2298b3c7a844454f4387cb0693f15e4facd227dd2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_lzma.pyd
          • Size 156KB
          • SHA256 a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_overlapped.pyd
          • Size 54KB
          • SHA256 67e6ca6f1645c6928ade6718db28aff1c49a192e8811732b5e99364991102615
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_queue.pyd
          • Size 31KB
          • SHA256 3f57f29abd86d4dc8f4ca6c3f190ebb57d429143d98f0636ff5117e08ed81f9b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_socket.pyd
          • Size 81KB
          • SHA256 7daff6aa3851a913ed97995702a5dfb8a27cb7cf00fb496597be777228d7564a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_ssl.pyd
          • Size 174KB
          • SHA256 d568b3c99bf0fc35a1f3c5f66b4a9d3b67e23a1d3cf0a4d30499d924d805f5aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_uuid.pyd
          • Size 24KB
          • SHA256 d132f754471bd8a6f6d7816453c2e542f250a4d8089b657392fe61a500ae7899
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_wmi.pyd
          • Size 35KB
          • SHA256 1a105311a5ed88a31472b141b4b6daa388a1cd359fe705d9a7a4aba793c5749f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _zoneinfo.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\_zoneinfo.pyd
          • Size 46KB
          • SHA256 edb5fec1b18c7b657db1a20666896b51fc2d779ae315427ed920ba493038d327
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _http_parser.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\aiohttp\_http_parser.cp312-win_amd64.pyd
          • Size 296KB
          • SHA256 9e57d4cad3b16e6d18444cde0a6d03d12ab3cf1db4b113ec1d941676555c4a86
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _http_writer.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\aiohttp\_http_writer.cp312-win_amd64.pyd
          • Size 43KB
          • SHA256 b10cc875ff572eba927ec4dae177b479906983856ca978ce327ad93f5401a9db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mask.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\aiohttp\_websocket\mask.cp312-win_amd64.pyd
          • Size 34KB
          • SHA256 7d9e6a8259d16dfee829d40b491646d19774d1fc3c6d72e308ef152b375691c6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          reader_c.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\aiohttp\_websocket\reader_c.cp312-win_amd64.pyd
          • Size 146KB
          • SHA256 f5d3ec5d3939716f1830073007e90b6fee83d4ed3659d590204bbde333feccbc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\base_library.zip
          • Size 1.3MB
          • SHA256 a4181b87b1292a3e011b3b87de80052f9cdd5ad26d75d3ef737f730c452a2e1a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\libssl-3.dll
          • Size 768KB
          • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multidict.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\multidict\_multidict.cp312-win_amd64.pyd
          • Size 125KB
          • SHA256 680487ff65992a89ec117e9a1a1a9d3ff0beb2df02f8ae20d9c84a1ca8bbccfa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          entry_points.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\numpy-2.5.2.dist-info\entry_points.txt
          • Size 220B
          • SHA256 ec26fade0c8bdac211a6c1dd003a65eb16885b925395423e93fcaa115af4052c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _helpers_c.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\propcache\_helpers_c.cp312-win_amd64.pyd
          • Size 64KB
          • SHA256 56076d1e6a317c70a5d1dc9971d48e2b5fe56b86d40d09eccdee23117ce34c3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _pydantic_core.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\pydantic_core\_pydantic_core.cp312-win_amd64.pyd
          • Size 4.9MB
          • SHA256 28fd1266fb9946fe61775505a13c0bf803f6932b51b306a0032687393d9a558b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\python3.DLL
          • Size 66KB
          • SHA256 d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python312.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\python312.dll
          • Size 6.6MB
          • SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\select.pyd
          • Size 29KB
          • SHA256 680df34fb908c49410ac5f68a8c05d92858acd111e62d1194d15bdce520bd6c3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lorem ipsum.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
          • Size 1KB
          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Banjul
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Africa\Banjul
          • Size 130B
          • SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Dar_es_Salaam
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Africa\Dar_es_Salaam
          • Size 191B
          • SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Harare
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Africa\Harare
          • Size 131B
          • SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Kinshasa
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Africa\Kinshasa
          • Size 180B
          • SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Blanc-Sablon
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\America\Blanc-Sablon
          • Size 177B
          • SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Panama
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\America\Panama
          • Size 149B
          • SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Thunder_Bay
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\America\Thunder_Bay
          • Size 1KB
          • SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Riyadh
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Asia\Riyadh
          • Size 133B
          • SHA256 46853e94276af2eea8e86c2f152a871c092df195dc51273b8fc7091faa4b461c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Shanghai
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Asia\Shanghai
          • Size 393B
          • SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Sydney
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Australia\Sydney
          • Size 904B
          • SHA256 820d45a868a88f81c731d5b2c758b4ed000039b6260a80433f8e0f094a604b59
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          GMT0
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Etc\GMT0
          • Size 111B
          • SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
          • MD5 SHA1 SHA512
          Submit Download

          Zulu
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Etc\Zulu
          • Size 111B
          • SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
          • MD5 SHA1 SHA512
          Submit Download

          Copenhagen
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Europe\Copenhagen
          • Size 705B
          • SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Jersey
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Europe\Jersey
          • Size 1KB
          • SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Luxembourg
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Europe\Luxembourg
          • Size 1KB
          • SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Sarajevo
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Europe\Sarajevo
          • Size 478B
          • SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Zaporozhye
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Europe\Zaporozhye
          • Size 558B
          • SHA256 0589e80ddecebf9d3077898c12975d2be7393df2856ee9926c534763e1e26bf2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Christmas
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Indian\Christmas
          • Size 152B
          • SHA256 cdc8e2c282d8bc9a5e9c3caf2fc45ff4e9e5cd18f5dec8cb873340ad7c584d64
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Reunion
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Indian\Reunion
          • Size 133B
          • SHA256 0d9ea5053e83188032a6fb4d301d5db688f43011e5b6b1f917a11b71a0da7b16
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BajaNorte
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Mexico\BajaNorte
          • Size 1KB
          • SHA256 af9aea4aee505143fa5e847643c0ffe164190c38411010ac7f0b170f4098a6c8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Navajo
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Navajo
          • Size 1KB
          • SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Auckland
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Pacific\Auckland
          • Size 1KB
          • SHA256 0e06e7e55aedbc92ef5b3d106e7c392ab1628cfd8a428b20e92e99028a0bfbb9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Truk
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Pacific\Truk
          • Size 154B
          • SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Wake
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\Pacific\Wake
          • Size 134B
          • SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Arizona
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\US\Arizona
          • Size 240B
          • SHA256 ae11453c21d08984de75f2efec04dc93178a7b4e23c5e52f2098b8bd45ccb547
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          East-Indiana
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\US\East-Indiana
          • Size 531B
          • SHA256 e678f42a13efbd7be0f26a9ce53e04b1c28a582eab05611cb01c16836432f07b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Hawaii
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\US\Hawaii
          • Size 221B
          • SHA256 1daa5729aa1e0f32cd44be112d01ad4cc567a9fe76d87dcbb9182be8d2c88ff0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Samoa
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\tzdata\zoneinfo\US\Samoa
          • Size 146B
          • SHA256 650d918751366590553063cd681592fdca8a09957e0ce2c18d6697ec385ef796
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\unicodedata.pyd
          • Size 1.1MB
          • SHA256 10ffd5207eeff5a836b330b237d766365d746c30e01abf0fd01f78548d1f1b04
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _quoting_c.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49642\yarl\_quoting_c.cp312-win_amd64.pyd
          • Size 80KB
          • SHA256 4d5b5978bdb7a001fe9e79f5f62e1b496c11ac331204104b23307c51903cb69a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download