733076b40828b2aecc0bf734f7cb829156475fd11c5988c79c36c8dbfb63f212

Analysis

max time kernel
413s
max time network
426s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectARM64.dll
Size 113KB
Sample261102-hljbbstv2r
SHA256 733076b40828b2aecc0bf734f7cb829156475fd11c5988c79c36c8dbfb63f212
MD5 fa22e2b2c57548ceb1b38249c4a6eb53
SHA1 d1348e4bb42e328ffbc7cf2a40ecba2063c30922
SHA512 74c34d81e8df8d3834abe604e0757a1ca3ba78a53b84f4abb5ae26b5cbe27066bf57a6bcf6d2c52ad16fad2e53d6456172547d15e945eb88cfd3b0a15bba5345
SSDEEP 1536:VU+1J51mU+VWmfsLm0wTYJ6k+i+jpCJmQ/TvTsWH0dh4pISW:VU+1J/2WYKm0RJnFrTVeWu
TLSH
T13AB34C53A79D2807E1E2DB38E4574F50633FB93484248E4AB202425CDD97BC9DFB6DA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3340	sihost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VMProtect Professional v3.10.1 Build 2465\Lib\Windows\VMProtectARM64.dll",#1
1⤵
PID:3572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3416

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:3340
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:1552

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2300

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2300-56-0x0000015684140000-0x0000015684160000-memory.dmp

Download

memory/2300-28-0x0000015682E50000-0x0000015682F50000-memory.dmp

Download

memory/2300-32-0x0000015682E10000-0x0000015682E30000-memory.dmp

Download

memory/2300-27-0x0000015682A40000-0x0000015682A60000-memory.dmp

Download

memory/2300-23-0x00000156801E0000-0x00000156802E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads