Overview

overview

10

Static

static

3

programe.exe

windows11-ltsc_2024-x64

10

programe.exe

windows10-2004-x64

10

programe.exe

windows10-ltsc_2021-x64

10

programe.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    898s
  • max time network
    900s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/11/2026, 23:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    programe.exe
  • Size 13.5MB
  • Sample261107-3mjcyags21
  • SHA256 1e451dcf16c98ae279f11b756a2e675fb2c0c7984e4d714939b38296a8f93853
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutionxmrigminerpersistenceransomwarespyware

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 2 IoCs
    miner
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes a file named after a Windows system binary 1 TTPs 2 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 32 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 64 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 38 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\programe.exe
    "C:\Users\Admin\AppData\Local\Temp\programe.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Users\Admin\AppData\Local\Temp\programe.exe
      "C:\Users\Admin\AppData\Local\Temp\programe.exe"
      2⤵
      • Executes a file named after a Windows system binary
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:1572
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1904
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5212
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5076
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3456
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\MicrosoftCache' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3280
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\DisplayAdapter' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2276
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsApps' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5784
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5696
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'runtimebroker.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:6048
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'displaysvc.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4632
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'programe.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3608
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1504
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2580
      • C:\Users\Admin\AppData\Roaming\MicrosoftCache\runtimebroker.exe
        C:\Users\Admin\AppData\Roaming\MicrosoftCache\runtimebroker.exe -c C:\Users\Admin\AppData\Roaming\MicrosoftCache\config.json
        3⤵
        • Executes a file named after a Windows system binary
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of FindShellTrayWindow
        PID:2500
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:1784
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2304
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:5260
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4228
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5996
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:2988

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 607B
            • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\VCRUNTIME140.dll
            • Size 94KB
            • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _asyncio.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_asyncio.pyd
            • Size 59KB
            • SHA256 3ea0d07f4a434c172655e6e8012339486368d355c542606bc1bcbe0cabd7f874
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _brotli.cp310-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_brotli.cp310-win_amd64.pyd
            • Size 836KB
            • SHA256 15265d9fe191f377e10dfb282a787c8c072b159bc237f9d13d9e31ee609206a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_bz2.pyd
            • Size 78KB
            • SHA256 4b1d29f19adaf856727fa4a1f50eee0a86c893038dfba2e52f26c11ab5b3672f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_ctypes.pyd
            • Size 116KB
            • SHA256 e3b69285f27a8ad97555bebea29628a93333de203ee2fae95b73b6b6d6c162b1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\_lzma.pyd
            • Size 149KB
            • SHA256 2e3fd65c4e02c99a61344ce59e09ec7fde74c671db5f82a891732e1140910f20
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-console-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-console-l1-1-0.dll
            • Size 22KB
            • SHA256 56a3c8ec50eedef1f5024696ef928cb2a0f5d8b40c8a122cba412944dae81c46
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-datetime-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-datetime-l1-1-0.dll
            • Size 22KB
            • SHA256 e91b155e01b98aa4466b94da39e04c379f2fd392c154e7b6d80c05e0476f0552
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-debug-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-debug-l1-1-0.dll
            • Size 22KB
            • SHA256 2117e4953f5ec36adff21a416db5ff5f9ff27ea5f70b71b2e7d87897979b34e1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-errorhandling-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-errorhandling-l1-1-0.dll
            • Size 22KB
            • SHA256 ce83855b81333be8ca07a70700bff553dfb94869637dfe529bc8ef64094032be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-fibers-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-fibers-l1-1-0.dll
            • Size 22KB
            • SHA256 5fae6d3fa0df3ac9a0171654062b6518b56bc586ab03d8a05e9cd4a112628934
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-file-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-file-l1-1-0.dll
            • Size 26KB
            • SHA256 be54476a0d4394d8ca6a5943b6425569403a1a7e939cf9b4948319b450022b45
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-file-l1-2-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-file-l1-2-0.dll
            • Size 22KB
            • SHA256 87cd5dac0ad2c7f6d64a51c58bc6fb9f2b207fe4966dcf47dd83728b0e439a75
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-file-l2-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-file-l2-1-0.dll
            • Size 20KB
            • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-handle-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-handle-l1-1-0.dll
            • Size 22KB
            • SHA256 5ae3a6e15f6a47f78b59f8a24334ffc88e8de05664c4c04d6243921ecba16325
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-heap-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-heap-l1-1-0.dll
            • Size 22KB
            • SHA256 5f8dca9ec0204453ad8e31b8f36226fef8342c36d3a07b15bcece301bc7f24cd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-interlocked-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-interlocked-l1-1-0.dll
            • Size 22KB
            • SHA256 bdad0c627f722de797917a9ebbb02acc0669c44326f64ba5fc1f8d6c2d978128
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-libraryloader-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-libraryloader-l1-1-0.dll
            • Size 22KB
            • SHA256 b17a00e4640a1d5a91c1b1ddf0465ba04ffc2ac5404e37d02b56ba7d2fabbced
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-localization-l1-2-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-localization-l1-2-0.dll
            • Size 22KB
            • SHA256 4b5c4d32550d6ec0715c6cf651e9c1bbccb01bffa72e082a0ae04251800d43a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-memory-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-memory-l1-1-0.dll
            • Size 22KB
            • SHA256 47817a21044295a18907f13cd9f2705f9a21579f80fa6d3f7bf22e00607189fe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-namedpipe-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-namedpipe-l1-1-0.dll
            • Size 22KB
            • SHA256 64896c2ca9b8da6c6c327602000f1f6d95e49e6f8df06929176a319cc2aa985e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-processenvironment-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-processenvironment-l1-1-0.dll
            • Size 22KB
            • SHA256 8df2ab621406d2905a330df3955db715965c2c097061345ad94dafab1b04ef00
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-processthreads-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-processthreads-l1-1-0.dll
            • Size 22KB
            • SHA256 a0299f1564ea8aeeff67226b6d2f9b9802aab877c9b89c82d50377ca2a12dba9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-processthreads-l1-1-1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-processthreads-l1-1-1.dll
            • Size 22KB
            • SHA256 fe33f48a34243481782742168b24f344485527327534f7e05c60ba5420715387
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-profile-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-profile-l1-1-0.dll
            • Size 22KB
            • SHA256 2f506ccb47a0513d16b3dece9ed1a0459b796fdb96e40d8967dc84e7d4e36954
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-rtlsupport-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-rtlsupport-l1-1-0.dll
            • Size 22KB
            • SHA256 4335d1e4051cc16aee5745b1ae9027e1e710f41972faefc57c065f2166209853
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-string-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-string-l1-1-0.dll
            • Size 22KB
            • SHA256 4c8b4993badf3d843f57638b5f82e98769d3c7e0bd524d999ec2c720013a2fdf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-synch-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-synch-l1-1-0.dll
            • Size 22KB
            • SHA256 a7e2c7177f10d6d35ed2cc79ce71eb979ba69a348f19237121ddac7d61103ebe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-synch-l1-2-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-synch-l1-2-0.dll
            • Size 22KB
            • SHA256 6ff6a5b89c6ccc33a8f99fef4abb83b760c3d6e5be20d4805d95720f67b86876
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-sysinfo-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-sysinfo-l1-1-0.dll
            • Size 22KB
            • SHA256 881b7e57388edbf8a167bc7e7714286e9fed54b981479fa540c218aab049a81e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-timezone-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-timezone-l1-1-0.dll
            • Size 22KB
            • SHA256 c886fd30abe580e0bdb29b9e3cb50872159d1c62bcf03355b28850176f1258aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-util-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-core-util-l1-1-0.dll
            • Size 22KB
            • SHA256 26a32ca4e6a5f853a371f1fff7c4b7cd90288f4364921fbd4b11cbff697767a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-conio-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-conio-l1-1-0.dll
            • Size 22KB
            • SHA256 988e14fa33743956ca182c1ef033c09427d60f2b0132803b8548e28ca0378b7c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-convert-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-convert-l1-1-0.dll
            • Size 26KB
            • SHA256 fa445d728c70db47340907cf12dff8893fd249b738594a1825248211b8ec0dca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-environment-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-environment-l1-1-0.dll
            • Size 22KB
            • SHA256 e2e562ec0ab4be342962e7e885cba380c3143bcbf83fcaff9269f26b2b448e24
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-filesystem-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-filesystem-l1-1-0.dll
            • Size 22KB
            • SHA256 f4a1f0ad4fde3752cf7dc6f3058e4c502546aad9029c8bd78ae1ee4cbe37922a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-heap-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-heap-l1-1-0.dll
            • Size 22KB
            • SHA256 998294783016c09345cb2dd0f18163fb9bf469edb4954b1408e99f673c60d9f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-locale-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-locale-l1-1-0.dll
            • Size 22KB
            • SHA256 2376c1ef50f84a2b0e49e66c0e4c2b24e0c48a4d85450fc74ce77ff02f58fea5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-math-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-math-l1-1-0.dll
            • Size 30KB
            • SHA256 9e1441afa2e6b3cb88c234fd43755fb2716d7266944239e93a8b3722f44ba792
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-process-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-process-l1-1-0.dll
            • Size 22KB
            • SHA256 df4a913f1708ccc03b9f41f69cf563a9c57bebaba18262fbc377584a2c2bbb9c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-runtime-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-runtime-l1-1-0.dll
            • Size 26KB
            • SHA256 3e95f9a63c2c742c43138b731966d4cfa6c922bdcff3e2958fe24e4bdf6e5461
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-stdio-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-stdio-l1-1-0.dll
            • Size 26KB
            • SHA256 21a5efa2bdf4a89e06b7dad84aa990412e054bac9befd198c05dd6add93b8430
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-string-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-string-l1-1-0.dll
            • Size 26KB
            • SHA256 05a910f254a8eae65c0f032ec7740afacb8439f87a64d53f9b8ebd66304b3b68
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-time-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-time-l1-1-0.dll
            • Size 22KB
            • SHA256 4a90e5b2f3fb45b6a92581a39d3b62948a588a360d449554d8cae1a40b009114
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-utility-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\api-ms-win-crt-utility-l1-1-0.dll
            • Size 22KB
            • SHA256 88ce66919d551efa7a0430f1188b558c41532c363258c1f07a05e2b67d603208
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\base_library.zip
            • Size 858KB
            • SHA256 87e2e5fd3e6856fd96b3f2abb9cfd00d687ae955819e534dbb83afa0bb53f0ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-7.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\libffi-7.dll
            • Size 32KB
            • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\libssl-1_1.dll
            • Size 678KB
            • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pyexpat.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\pyexpat.pyd
            • Size 187KB
            • SHA256 66b14ebdd917f046315b666f841ea54a32760ecd624863071da8d3f1fd24459b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.DLL
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\python3.DLL
            • Size 60KB
            • SHA256 ec655cc34819d6a9677c0541fd7e7b2b8a92804e8bf73aee692a9c44d1a24b5d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python310.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\python310.dll
            • Size 4.3MB
            • SHA256 34f0e44a0d089587e1ea48c1cc4c3164a1819c6db27a7c1b746af46d6388c26e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\select.pyd
            • Size 24KB
            • SHA256 b9ef1709ed4cd0fd72e4c4ba9b7702cb79d1619c11554ea06277f3dac21bd010
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\ucrtbase.dll
            • Size 1.1MB
            • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI41482\unicodedata.pyd
            • Size 1.1MB
            • SHA256 89c93a672b649cd1e296499333df5b3d9ba2fd28f9280233b56441c69c126631
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_qsruwxxn.tb4.psm1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qsruwxxn.tb4.psm1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            runtimebroker.exe
            • Path C:\Users\Admin\AppData\Roaming\MicrosoftCache\runtimebroker.exe
            • Size 6.1MB
            • SHA256 d2fcf28897ddc2137141d838b734664ff7592e03fcd467a433a51cb4976b4fb1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1904-170-0x000002C57F9D0000-0x000002C57F9EE000-memory.dmp
            Download

            memory/1904-177-0x00007FFBE05C0000-0x00007FFBE0F64000-memory.dmp
            Download

            memory/1904-167-0x00007FFBE05C0000-0x00007FFBE0F64000-memory.dmp
            Download

            memory/1904-165-0x00007FFBE05C0000-0x00007FFBE0F64000-memory.dmp
            Download

            memory/1904-171-0x000002C57FCB0000-0x000002C57FD62000-memory.dmp
            Download

            memory/1904-164-0x000002C57F920000-0x000002C57F942000-memory.dmp
            Download

            memory/1904-172-0x000002C57F9F0000-0x000002C57F9FA000-memory.dmp
            Download

            memory/1904-173-0x00007FFBE05C0000-0x00007FFBE0F64000-memory.dmp
            Download

            memory/1904-174-0x00007FFBE05C0000-0x00007FFBE0F64000-memory.dmp
            Download

            memory/1904-175-0x00007FFBE05C0000-0x00007FFBE0F64000-memory.dmp
            Download

            memory/1904-176-0x00007FFBE05C0000-0x00007FFBE0F64000-memory.dmp
            Download

            memory/1904-166-0x00007FFBE05C0000-0x00007FFBE0F64000-memory.dmp
            Download

            memory/1904-179-0x00007FFBE05C0000-0x00007FFBE0F64000-memory.dmp
            Download

            memory/1904-161-0x00007FFBE05C0000-0x00007FFBE0F64000-memory.dmp
            Download

            memory/1904-159-0x00007FFBE074F000-0x00007FFBE0750000-memory.dmp
            Download

            memory/1904-160-0x00007FFBE05C0000-0x00007FFBE0F64000-memory.dmp
            Download

            memory/2500-258-0x00000223C59C0000-0x00000223C59E0000-memory.dmp
            Download

            memory/4228-282-0x000002A300100000-0x000002A300200000-memory.dmp
            Download

            memory/4228-327-0x000002A314250000-0x000002A314270000-memory.dmp
            Download

            memory/4228-289-0x000002A301BD0000-0x000002A301BF0000-memory.dmp
            Download

            memory/4228-290-0x000002A301DE0000-0x000002A301EE0000-memory.dmp
            Download

            memory/4228-313-0x000002A301C40000-0x000002A301C60000-memory.dmp
            Download