CDRevive-Launcher_3.exePE analysis report - Suspicious
Run integrity
sample ranThe guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.
35.2sto launch
1297telemetry events
312observed
67agent notes
Suspicious
35/100
0 points past the suspicious line at 35, 35 short of malicious at 70.
Clean0-34
Suspicious35-69
Malicious70-100
Why this verdict
+14
Review confirms
- 3 of 3 local reviews independently read this as malicious, on top of 21 points the platform measured itself
+12
Runtime behavior
- Dropped an executable to disk
+9
Static analysis
- 1 high-risk capability(ies): sandbox evasion
- 4 supporting capabilities in one unsigned binary: file discovery, obfuscation, process discovery, system information
- Local ML score 100.0 is not charged on its own: it separates signed from unsigned software, so it corroborates measured evidence and never replaces it
+0
Model review
- findings review (advisory, not scored): malicious - family signature match, anti-vm checks, dropped executables, c2-like dns lookup
Model reading
Measured
SUSPICIOUS35 of 100
Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.
Model reads it asadvisory, no points
NOT ASSESSEDnot shown on this page
Reads this report's derived findings, never the sample itself.
A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.
Analysis layers
Static
ran
moved the score
Dynamic
ran
moved the score
Threat intel
local feeds only
no points
AI
not included
Detection signatures
12 detected · 7 withheld as common| Severity | Detection | Evidence | Layer |
|---|---|---|---|
| MED |
Anti-analysis strings present
MITRE T1497
|
string
isdebuggerpresent
matched string
|
static |
| MED |
Dropped an executable to disk
MITRE T1105
|
file
C:\Users\user\AppData\Local\Temp\_MEI23602\VCRUNTIME140_1.dll
dropped
file
C:\Users\user\AppData\Local\Temp\_MEI23602\VCRUNTIME140.dll
dropped
|
dynamic |
| MED |
Executes external code / commands
MITRE T1059
confirmed at runtime, seen in 30% of benign software statically
|
capability
createprocessw
capability: execution
|
static |
| MED |
High file entropy (encrypted/compressed payload)
MITRE T1027
|
entropy
8.00
threshold 7.20, maximum 8.00
|
static |
| MED |
Surveillance/keylogging strings
MITRE T1056
|
string
getdc
matched string
|
static |
| LOW |
Changes the desktop wallpaper (ransom note)
MITRE T1491
seen in 8% of benign software
|
import
user32.dll!SystemParametersInfoW
|
static |
| LOW |
Deletes files/backups (WriteFile + DeleteFile recursion)
MITRE T1485
seen in 14% of benign software
|
import
kernel32.dll!DeleteFileW
requires deletefile
import
kernel32.dll!FindNextFileW
requires findnextfile
|
static |
| LOW |
Drops + executes from temp (GetTempPath + CreateProcess)
MITRE T1204
seen in 7% of benign software
|
import
kernel32.dll!GetTempPathW
requires gettemppath
import
kernel32.dll!CreateProcessW
requires createprocess
|
static |
| LOW |
Hides its window (ShowWindow SW_HIDE pattern)
MITRE T1564.003
seen in 13% of benign software
|
import
user32.dll!ShowWindow
|
static |
| LOW |
Screen-capture capability
MITRE T1113
seen in 8% of benign software
|
capability
getdc
capability: screen_capture
|
static |
| LOW |
Spawns child processes
MITRE T1106
seen in 16% of benign software
|
import
kernel32.dll!CreateProcessW
|
static |
| INFO |
Stages in the temp directory (GetTempPath)
MITRE T1074
seen in 15% of benign software
|
import
kernel32.dll!GetTempPathW
|
static |
Withheld: 7 rules fired and were not reported above
These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.
Timing-based anti-analysis (QueryPerformanceCounter/rdtsc)
fires on 92% of benign software
Anti-debugging capability
fires on 65% of benign software
Dynamic API resolution (obfuscation)
fires on 65% of benign software
Anti-debug: checks for a debugger
fires on 60% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress)
fires on 49% of benign software
Reads its own startup info (parent/desktop check)
fires on 36% of benign software
Enumerates files recursively (staging/collection)
fires on 21% of benign software
What the tests returned
7 testsEach test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.
| Test | Result |
|---|---|
| Persistence mechanisms | none established at runtime |
| Cross-process injection | none observed |
| Network connections | the capture came up and attributed no outbound connection; this run had no route out, so none could have succeeded in any case |
| Behavioural rule matches (Sigma) | none observed |
| Known-malicious hash (reputation sources) | no source reported this file |
| Local anti-virus engine | reported no detection |
| Anti-analysis / evasion checks | none above the reporting threshold - the anti-analysis calls this run did make are listed with their counts |
Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.
Arguing against malice
- The local anti-virus engine reported no detection.
- No reputation source reported this file as malicious.
How much weight this carries
Observed. Observed at runtime and attributed to this sample by one layer. The one fact that decided it: payload written to disk.
Instrument coverage
3 of 4 measuredWhat this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.
| Layer | Ran | What that means |
|---|---|---|
| Runtime anti-analysis watch | measured | Measured. The in-process hook group for debugger, timing and hypervisor checks armed on this run, so an empty signal list means something looked and saw nothing. |
| API call sequence | measured | Measured for the hooked anti-analysis calls. It is not a full API trace: the sequence carries interpreter spawns plus the hooked anti-analysis calls, and nothing else. |
| Explicit module loads | measured | Measured, with two limits. Only a module the sample asks for by hand is recorded, so one brought in by its own import table never appears, and the hooks arrive a few seconds after a process starts. |
| Network capture | not on this plan | Not included on this scan's plan. |
| Live kernel introspection | not measured | Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop. |
This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.
Structure
What the file is made of: headers, imports, how it was built and whether it was signed.
Sections & resources
How the file is laid out in memory, and what is embedded in it: section roles, access rights, entropy and every resource entry.
Signatures & packing
What matched and what is hidden: signature rules, detected capabilities, family attribution, packer detection, unpacked payloads and recovered configuration.
Strings
The readable content: embedded secrets, flagged strings and everything extraction recovered.
Code
What the sample would execute: the emulated API call sequence, and the disassembled entry point.
Signature
PyInstaller[modified]
CompilerMicrosoft Visual C/C++(19.36.34123)[C]
LinkerMicrosoft Linker(14.36.34123)
Identity
File
typeexecutable
size28.6 MB
file arch64-bit (x64)
subsystemGUI
entropy7.9971
date2026-10-19 18:11:07 UTC
languageNEU
Antivirus engine
no signature matched signature set 28158 - 3.6M signaturesNothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.
| Signature set | Value |
|---|---|
| Set version | 28158 |
| Signatures in the set | 3,642,872 |
| Set published | 19 Oct 2026 06:26 +0000 |
| Age when this file was scanned | same day |
A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.
Local ML assessment
100.0 of 100 8 strongest of 2568 featuresA gradient-boosted model running entirely on this host scored this file 100.0 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.
Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.
| Structural feature | What it means | Pushes | Weight |
|---|---|---|---|
| image flag dll | Image flag: a library rather than a program | towards malicious | +1.1404 |
| optional.minor_linker_version | Version of the linker that produced the file (minor) (41) | towards malicious | +0.5423 |
| feature column 2478 | When a timestamp authority countersigned the signature | towards malicious | +0.4356 |
| parser warning: Suspicious flags set for section... | Header defect reported by the parse: Suspicious flags set for section... (0) | towards benign | -0.4195 |
| feature column 991 | Size of the data appended after the last section | towards malicious | +0.3546 |
| coff.timestamp | Build timestamp recorded in the header (1792433408) | towards malicious | +0.3214 |
| feature column 632 | Text in the file matching a base64 blob | towards malicious | +0.2828 |
| security directory size | Size of the security table (0) | towards malicious | +0.2747 |
A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.
Packing
Not packed
This file's code is readable on disk - nothing is compressed or encrypted around it.
12/100
packer confidence
Static analysis reads this file directly
Nothing is hiding the code from a static pass, so what the file contains is what the report shows.
Indicators weighed 2 signals
- High-entropy overlay (7.99, 29674386 bytes)
- High-entropy resource (possible packed payload)
Family configuration search
Not attemptedThe sample is 28.6 MB and the config parser pass is bounded at 16.0 MB, so no family parser was run against it - a family configuration may exist in this file and was not looked for. The absence of an extracted configuration is therefore not evidence about this sample.
| Sample size | 28.6 MB |
|---|---|
| Bound | 16.0 MB |
| Limit reached | Sample size, before any parser was loaded. |
Secrets & malicious strings
2 flagged stringsFlagged string categories
| Indicator | Found in | Evidence from the sample |
|---|---|---|
| isdebuggerpresent | import table | KERNEL32.dll!IsDebuggerPresent |
| Indicator | Found in | Evidence from the sample |
|---|---|---|
| getdc | import table | USER32.dll!GetDC |
Capabilities
7 behaviour buckets · 2 high-risk| Severity | Capability | MITRE | APIs |
|---|---|---|---|
| high | Privilege escalation Adjusts tokens / privileges |
T1134 | openprocesstoken |
| high | Anti-debugging Detects or obstructs a debugger |
T1622 | isdebuggerpresent |
| med | Evasion / stalling Sleeps, times, or otherwise stalls analysis |
T1497, T1497.003 | getsystemtimeasfiletime, queryperformancecounter, sleep |
| med | Ransomware behaviour Enumerates + encrypts files, deletes backups |
T1083 | findfirstfilew, findnextfilew |
| med | Dynamic API resolution Resolves APIs at runtime (obfuscation) |
T1129 | getprocaddress |
| med | Screen capture Grabs the screen / clipboard |
T1113 | getdc |
| med | Code execution Creates processes / runs commands or shellcode |
T1106 | createprocessw |
Security mitigations
strong posture
ON
ASLR (DynamicBase)
ON
High-entropy ASLR (64-bit)
ON
DEP / NX (NxCompat)
ON
Control Flow Guard
OFF
SafeSEH
ON
Stack cookies (GS)
OFF
Force Integrity
OFF
AppContainer isolation
OFF
Authenticode signed
Rich header (toolchain)
richhash 1ecd8dacf9824186| Tool | Build | Uses |
|---|---|---|
| Utc1900 (VS2017) | 30795 | 7 |
| Export 14.10 | 30795 | 180 |
| Cvtres 14.10 | 30795 | 10 |
| prodid_253 | 33808 | 3 |
| Utc1900 (VS2017) | 33808 | 9 |
| Cvtres 14.10 | 33808 | 17 |
| Export 14.10 | 33808 | 40 |
| Utc1900 (VS2017) | 30795 | 11 |
| Import (linker) | 0 | 155 |
| Cvtres 14.10 | 34123 | 25 |
| AliasObj 14.10 | 34123 | 1 |
Sections
6 sections · the file's memory layout| Section | Virtual addr | Raw size | Virtual size | Access | Entropy |
|---|---|---|---|---|---|
|
.textEP
Executable code
|
0x1000 |
168.0 KB
|
167.9 KB
|
EXECUTEREAD
|
6.4892
|
|
.rdata
Read-only data
|
0x2b000 |
75.0 KB
|
74.5 KB
|
READ
|
5.7508
|
|
.data
Initialised data
|
0x3e000 |
3.5 KB
|
21.0 KB
expands
|
READWRITE
|
1.8392
|
|
.pdata
Exception unwind data
|
0x44000 |
9.0 KB
|
8.6 KB
|
READ
|
5.2645
|
|
.rsrc
Resources
|
0x47000 |
61.5 KB
|
61.0 KB
|
READ
|
7.555
|
|
.reloc
Base relocations
|
0x57000 |
2.0 KB
|
1.8 KB
|
READ
|
5.281
|
code
data
imports/exports
resources
metadata
packer
non-standard
Entropy above 7.0 means compressed or encrypted content.
Imports
143 funcs / 5 DLLs · 7 suspicious▸USER32.dll28 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| CreateWindowExW | 0x0002b3b8 | - | - |
| ShutdownBlockReasonCreate | 0x0002b3c0 | - | - |
| MsgWaitForMultipleObjects | 0x0002b3c8 | - | - |
| ShowWindow | 0x0002b3d0 | - | - |
| DestroyWindow | 0x0002b3d8 | - | - |
| RegisterClassW | 0x0002b3e0 | - | - |
| DefWindowProcW | 0x0002b3e8 | - | - |
| PeekMessageW | 0x0002b3f0 | - | - |
| DispatchMessageW | 0x0002b3f8 | - | - |
| TranslateMessage | 0x0002b400 | - | - |
| PostMessageW | 0x0002b408 | - | - |
| GetMessageW | 0x0002b410 | - | - |
| MessageBoxW | 0x0002b418 | - | - |
| MessageBoxA | 0x0002b420 | - | - |
| SystemParametersInfoW | 0x0002b428 | - | - |
| DestroyIcon | 0x0002b430 | - | - |
| SetWindowLongPtrW | 0x0002b438 | - | - |
| GetWindowLongPtrW | 0x0002b440 | - | - |
| GetClientRect | 0x0002b448 | - | - |
| InvalidateRect | 0x0002b450 | - | - |
| ReleaseDC | 0x0002b458 | - | - |
| GetDC | 0x0002b460 | - | - |
| DrawTextW | 0x0002b468 | - | - |
| GetDialogBaseUnits | 0x0002b470 | - | - |
| EndDialog | 0x0002b478 | - | - |
| DialogBoxIndirectParamW | 0x0002b480 | - | - |
| MoveWindow | 0x0002b488 | - | - |
| SendMessageW | 0x0002b490 | - | - |
▸COMCTL32.dll1 func
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| ordinal_380 | 0x0002b028 | yes | - |
▸KERNEL32.dll107 funcs 6 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| GetACP | 0x0002b058 | - | - |
| IsValidCodePage | 0x0002b060 | - | - |
| GetStringTypeW | 0x0002b068 | - | - |
| GetFileAttributesExW | 0x0002b070 | - | - |
| SetEnvironmentVariableW | 0x0002b078 | - | - |
| FlushFileBuffers | 0x0002b080 | - | - |
| GetCurrentDirectoryW | 0x0002b088 | - | - |
| LCMapStringW | 0x0002b090 | - | - |
| CompareStringW | 0x0002b098 | - | - |
| FlsFree | 0x0002b0a0 | - | - |
| GetOEMCP | 0x0002b0a8 | - | - |
| GetCPInfo | 0x0002b0b0 | - | - |
| GetModuleHandleW | 0x0002b0b8 | - | - |
| MulDiv | 0x0002b0c0 | - | - |
| FormatMessageW | 0x0002b0c8 | - | - |
| GetLastError | 0x0002b0d0 | - | - |
| GetModuleFileNameW | 0x0002b0d8 | - | - |
| LoadLibraryExW | 0x0002b0e0 | - | - |
| SetDllDirectoryW | 0x0002b0e8 | - | - |
| CreateSymbolicLinkW | 0x0002b0f0 | - | - |
| GetProcAddress | 0x0002b0f8 | - | T1129 |
| GetEnvironmentStringsW | 0x0002b100 | - | - |
| GetCommandLineW | 0x0002b108 | - | - |
| GetEnvironmentVariableW | 0x0002b110 | - | - |
| ExpandEnvironmentStringsW | 0x0002b118 | - | - |
| DeleteFileW | 0x0002b120 | - | - |
| FindClose | 0x0002b128 | - | - |
| FindFirstFileW | 0x0002b130 | - | T1083 |
| FindNextFileW | 0x0002b138 | - | T1083 |
| GetDriveTypeW | 0x0002b140 | - | - |
| RemoveDirectoryW | 0x0002b148 | - | - |
| GetTempPathW | 0x0002b150 | - | - |
| CloseHandle | 0x0002b158 | - | - |
| QueryPerformanceCounter | 0x0002b160 | - | T1497 |
| QueryPerformanceFrequency | 0x0002b168 | - | - |
| WaitForSingleObject | 0x0002b170 | - | - |
| Sleep | 0x0002b178 | - | - |
| GetCurrentProcess | 0x0002b180 | - | - |
| TerminateProcess | 0x0002b188 | - | - |
| GetExitCodeProcess | 0x0002b190 | - | - |
| CreateProcessW | 0x0002b198 | - | T1106 |
| GetStartupInfoW | 0x0002b1a0 | - | - |
| FreeLibrary | 0x0002b1a8 | - | - |
| LocalFree | 0x0002b1b0 | - | - |
| SetConsoleCtrlHandler | 0x0002b1b8 | - | - |
| K32EnumProcessModules | 0x0002b1c0 | - | - |
| K32GetModuleFileNameExW | 0x0002b1c8 | - | - |
| CreateFileW | 0x0002b1d0 | - | - |
| FindFirstFileExW | 0x0002b1d8 | - | - |
| GetFinalPathNameByHandleW | 0x0002b1e0 | - | - |
| MultiByteToWideChar | 0x0002b1e8 | - | - |
| WideCharToMultiByte | 0x0002b1f0 | - | - |
| FlsSetValue | 0x0002b1f8 | - | - |
| FreeEnvironmentStringsW | 0x0002b200 | - | - |
| GetProcessHeap | 0x0002b208 | - | - |
| GetTimeZoneInformation | 0x0002b210 | - | - |
| HeapSize | 0x0002b218 | - | - |
| HeapReAlloc | 0x0002b220 | - | - |
| WriteConsoleW | 0x0002b228 | - | - |
| SetEndOfFile | 0x0002b230 | - | - |
| CreateDirectoryW | 0x0002b238 | - | - |
| RtlCaptureContext | 0x0002b240 | yes | - |
| RtlLookupFunctionEntry | 0x0002b248 | yes | - |
| RtlVirtualUnwind | 0x0002b250 | yes | - |
| UnhandledExceptionFilter | 0x0002b258 | - | - |
| SetUnhandledExceptionFilter | 0x0002b260 | - | - |
| IsProcessorFeaturePresent | 0x0002b268 | - | - |
| GetCurrentProcessId | 0x0002b270 | - | - |
| GetCurrentThreadId | 0x0002b278 | - | - |
| GetSystemTimeAsFileTime | 0x0002b280 | - | - |
| InitializeSListHead | 0x0002b288 | - | - |
| IsDebuggerPresent | 0x0002b290 | - | T1622 |
| RtlUnwindEx | 0x0002b298 | yes | - |
| SetLastError | 0x0002b2a0 | - | - |
| EnterCriticalSection | 0x0002b2a8 | - | - |
| LeaveCriticalSection | 0x0002b2b0 | - | - |
| DeleteCriticalSection | 0x0002b2b8 | - | - |
| InitializeCriticalSectionAndSpinCount | 0x0002b2c0 | - | - |
| TlsAlloc | 0x0002b2c8 | - | - |
| TlsGetValue | 0x0002b2d0 | - | - |
| TlsSetValue | 0x0002b2d8 | - | - |
| TlsFree | 0x0002b2e0 | - | - |
| EncodePointer | 0x0002b2e8 | - | - |
| RaiseException | 0x0002b2f0 | - | - |
| RtlPcToFileHeader | 0x0002b2f8 | yes | - |
| GetCommandLineA | 0x0002b300 | - | - |
| GetFileInformationByHandle | 0x0002b308 | - | - |
| GetFileType | 0x0002b310 | - | - |
| PeekNamedPipe | 0x0002b318 | - | - |
| SystemTimeToTzSpecificLocalTime | 0x0002b320 | - | - |
| FileTimeToSystemTime | 0x0002b328 | - | - |
| ReadFile | 0x0002b330 | - | - |
| GetFullPathNameW | 0x0002b338 | - | - |
| SetStdHandle | 0x0002b340 | - | - |
| GetStdHandle | 0x0002b348 | - | - |
| WriteFile | 0x0002b350 | - | - |
| ExitProcess | 0x0002b358 | - | - |
| GetModuleHandleExW | 0x0002b360 | - | - |
| HeapFree | 0x0002b368 | - | - |
| GetConsoleMode | 0x0002b370 | - | - |
| ReadConsoleW | 0x0002b378 | - | - |
| SetFilePointerEx | 0x0002b380 | - | - |
| GetConsoleOutputCP | 0x0002b388 | - | - |
| GetFileSizeEx | 0x0002b390 | - | - |
| HeapAlloc | 0x0002b398 | - | - |
| FlsAlloc | 0x0002b3a0 | - | - |
| FlsGetValue | 0x0002b3a8 | - | - |
▸ADVAPI32.dll4 funcs 1 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| OpenProcessToken | 0x0002b000 | - | T1134 |
| GetTokenInformation | 0x0002b008 | - | - |
| ConvertStringSecurityDescriptorToSecurityDescriptorW | 0x0002b010 | - | - |
| ConvertSidToStringSidW | 0x0002b018 | - | - |
▸GDI32.dll3 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| SelectObject | 0x0002b038 | - | - |
| DeleteObject | 0x0002b040 | - | - |
| CreateFontIndirectW | 0x0002b048 | - | - |
Binary metadata
what the headers declare about this build| Resource langs | NEU |
|---|---|
| Debug info | yes |
| TLS callbacks | no |
Code signing
UnsignedThis binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.
Resources
Everything the binary carries inside it: icons, bitmaps, cursors, dialogs, string tables, the manifest and the version block. Select an entry to preview it and take a copy.
Resources
Resource Hacker view
Group Icon1Icon7Manifest1
▸Group Icon1
1NEU
▸Icon7
1NEU
2NEU
3NEU
4NEU
5NEU
6NEU
7NEU
▸Manifest1
1NEU
Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.
Group Icon 1
Download
| Type | Group Icon |
|---|---|
| Name / ID | 1 |
| Language | NEU |
| Size | 104.0 B |
| RVA offset | 0x55ea4 |
| Content signature | Icon |
| MD5 | cd3a631eace19041876b4c4c6ec8461a |
| Entropy | 2.719 |
Icon 1
Download
| Type | Icon |
|---|---|
| Name / ID | 1 |
| Language | NEU |
| Size | 3.7 KB |
| RVA offset | 0x47208 |
| Content signature | Icon |
| MD5 | 15d6a8563184abef13a1ee75aea262ad |
| Entropy | 6.157 |
Icon 2
Download
| Type | Icon |
|---|---|
| Name / ID | 2 |
| Language | NEU |
| Size | 2.2 KB |
| RVA offset | 0x480b0 |
| Content signature | Icon |
| MD5 | 1c06420cfb94514d35c088699a04774d |
| Entropy | 6.449 |
Icon 3
Download
| Type | Icon |
|---|---|
| Name / ID | 3 |
| Language | NEU |
| Size | 1.4 KB |
| RVA offset | 0x48958 |
| Content signature | Icon |
| MD5 | db1208cf5d76055be1c3a34567af9f5a |
| Entropy | 5.777 |
Icon 4
Download
| Type | Icon |
|---|---|
| Name / ID | 4 |
| Language | NEU |
| Size | 37.3 KB |
| RVA offset | 0x48ec0 |
| Content signature | PNG |
| MD5 | f6fbada22d6a6c07ef8fdaa504f117d5 |
| Entropy | 7.951 |
Icon 5
Download
| Type | Icon |
|---|---|
| Name / ID | 5 |
| Language | NEU |
| Size | 9.4 KB |
| RVA offset | 0x523ec |
| Content signature | Icon |
| MD5 | 86ce219c337119fe35646823cb56d091 |
| Entropy | 6.052 |
Icon 6
Download
| Type | Icon |
|---|---|
| Name / ID | 6 |
| Language | NEU |
| Size | 4.2 KB |
| RVA offset | 0x54994 |
| Content signature | Icon |
| MD5 | 58b7700e8f20d0a3c77021eb7e7019dc |
| Entropy | 6.151 |
Icon 7
Download
| Type | Icon |
|---|---|
| Name / ID | 7 |
| Language | NEU |
| Size | 1.1 KB |
| RVA offset | 0x55a3c |
| Content signature | Icon |
| MD5 | 9de69c1c4b3a06597da9c275b38bffb6 |
| Entropy | 6.395 |
Manifest 1
Download
| Type | Manifest |
|---|---|
| Name / ID | 1 |
| Language | NEU |
| Size | 1.3 KB |
| RVA offset | 0x55f0c |
| Content signature | XML manifest |
| MD5 | 84da8dee6b319ea0b10b6de5489c6aae |
| Entropy | 5.258 |
Application manifest
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
<application xmlns="urn:schemas-microsoft-com:asm.v3">
<windowsSettings>
<longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware>
</windowsSettings>
</application>
<dependency>
<dependentAssembly>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"/>
</dependentAssembly>
</dependency>
</assembly>
Similar samples
1 related sampleRanked by fuzzy hash (TLSH distance - lower is closer) and ssdeep similarity, plus an identical import table. A near-identical neighbour is usually the same build; a variant is the same family rebuilt or repacked.
| Relation | Sample | Verdict | Why it matched |
|---|---|---|---|
| related | Nixware-v10.5.exe | Malicious | identical import table (imphash) |
Threat classification
Signature family candidates| Family | Agreeing rules | Matched rules | Disposition |
|---|---|---|---|
| Tiger RAT | 1 | TigerRAT_pe_yaraify | Not a classification: one rule cannot establish a family, so this named nothing and scored nothing. |
| PyInstaller | 1 | PyInstaller | Not a classification: one rule cannot establish a family, so this named nothing and scored nothing. |
Capability detection
33 capabilities| Capability | Namespace |
|---|---|
| link function at runtime on Windows | linking/runtime-linking |
| create process on Windows | host-interaction/process/create |
| create or open file | - |
| delay execution | - |
| create process suspended | host-interaction/process/create |
| encode data using XOR | data-manipulation/encoding/xor |
| PEB access | - |
| contain loop | - |
| read file on Windows | host-interaction/file-system/read |
| link many functions at runtime | linking/runtime-linking |
| create directory | host-interaction/file-system/create |
| terminate process | host-interaction/process/terminate |
| get disk information | host-interaction/hardware/storage |
| query environment variable | host-interaction/environment-variable |
| enumerate files on Windows | host-interaction/file-system/files/list |
| enumerate files recursively | host-interaction/file-system/files/list |
| delete file | host-interaction/file-system/delete |
| delete directory | host-interaction/file-system/delete |
| enumerate process modules | host-interaction/process/modules/list |
| get common file path | host-interaction/file-system |
| accept command line arguments | host-interaction/cli |
| check for time delay via QueryPerformanceCounter | anti-analysis/anti-debugging/debugger-detection |
| compute adler32 checksum | data-manipulation/checksum/adler32 |
| resolve function by parsing PE exports | load-code/pe |
| compress data via ZLIB inflate or deflate | data-manipulation/compression |
| parse PE header | load-code/pe |
| write file on Windows | host-interaction/file-system/write |
| get file size | host-interaction/file-system/meta |
| set environment variable | host-interaction/environment-variable |
| clear file content | host-interaction/file-system/write |
| linked against ZLIB | linking/static/zlib |
| reference analysis tools strings | anti-analysis |
| reference anti-VM strings targeting Xen | anti-analysis/anti-vm/vm-detection |
ATT&CK techniques
Defense Evasion::Obfuscated Files or Information [T1027]Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]Discovery::File and Directory Discovery [T1083]Discovery::Process Discovery [T1057]Discovery::System Information Discovery [T1082]Execution::Command and Scripting Interpreter [T1059]Execution::Shared Modules [T1129]
Malware Behavior Catalog
Anti-Behavioral Analysis::Debugger Detection::Process Environment BlockAnti-Behavioral Analysis::Debugger Detection::Timing/Delay Check QueryPerformanceCounterAnti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed ExecutionAnti-Behavioral Analysis::Virtual Machine DetectionData::Checksum::AdlerData::Compress DataData::Compression LibraryData::Encode Data::XORDefense Evasion::Obfuscated Files or Information::Encoding-Standard AlgorithmDiscovery::Analysis Tool Discovery::Process detectionDiscovery::File and Directory DiscoveryDiscovery::System Information DiscoveryExecution::Command and Scripting InterpreterFile System::Create DirectoryFile System::Create FileFile System::Delete DirectoryFile System::Delete FileFile System::Read FileFile System::Writes FileOperating System::Environment Variable::Set VariableProcess::Create ProcessProcess::Create Process::Create Suspended ProcessProcess::Terminate Process
Signature matches
2 findings · 7 file properties · 0 scored| Rule | What it matched | Corpus | Weight |
|---|---|---|---|
|
TigerRAT_pe_yaraify
rule dated 2026-08-21
|
YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits
1 of 1 string matched
$c0
\x0f\xb6\x08B\x0f\xb6\x14\x00+\xcau\x07H\xff\xc0\x85\xd2u\xed
at 0xe686
|
Tier 1 - curated family set
licence-gated and benign-tested; may name a malware family
|
SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
Names Tiger RAT, but one rule cannot establish a family: two independent rules must agree, so this named nothing.
|
|
MachO_File_pyinstaller
|
Detect Mach-O file produced by pyinstaller
1 of 2 strings matched
$a
pyi-runtime-tmpdir
at 0x2b5b8
|
Tier 3 - community corpus
casts no family vote; every measured false family match came from here
|
SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
|
File properties - not findings
PyInstallerIsPE64IsWindowsGUIIsPackedHasOverlayHasDebugDataHasRichSignature
These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.
None of the rules above moved the score. The score model reads four rule categories - anti-vm, anti-debug, dropper and packer - and a rule outside them can match, and be worth reading, without being evidence the verdict is built on.
Extracted strings
showing 200 of 841- !This program cannot be run in DOS mode.
- `Rich0\
- .text
- `.rdata
- @.data
- .pdata
- @.rsrc
- @.reloc
- @UWAT
- t$ AVH
- l$ VWATAVAW
- @SATAUAV
- ineIA
- ntelD
- Genu
- VWATAVAWH
- @USVWATAUAVAWH
- p AWH
- VWATH
- @USVWATAVAWH
- utfD9A
- x ATAVAWH
- ATAVAWH
- p AWL
- l$ VWATAVAWH
- VWATAVAW
- @USWH
- svDE3
- ATAUAVH
- iygE3
- Failed to extract %s: inflateInit() failed with return code %d!
- Failed to extract %s: failed to allocate temporary input buffer!
- malloc
- Failed to extract %s: failed to allocate temporary output buffer!
- Failed to extract %s: decompression resulted in return code %d!
- Failed to extract %s: failed to allocate temporary buffer!
- Failed to extract %s: failed to read data chunk!
- fread
- Failed to extract %s: failed to write data chunk!
- fwrite
- Failed to extract %s: failed to open archive file!
- Failed to extract %s: failed to seek to the entry's data!
- fseek
- Failed to extract %s: failed to allocate data buffer (%u bytes)!
- Failed to create symbolic link %s!
- Failed to extract %s: failed to open target file!
- fopen
- Failed to seek to cookie position!
- Failed to read cookie!
- Could not allocate memory for archive structure!
- calloc
- Could not allocate buffer for TOC!
- Could not read full TOC!
- Error on file.
- [PYI-%d:%s]
- [PYI-%d:ERROR]
- %s: %s
- WARNING
- Warning [ANSI Fallback]
- ERROR
- Error [ANSI Fallback]
- %s%c%s
- Extraction path length exceeds maximum path length!
- File already exists but should not: %s
- Failed to create parent directory structure.
- Failed to extract entry: %s.
- traceback
- format_exception
- Could not get __main__ module.
- Could not get __main__ module's dict.
- Failed to extract script from archive!
- %s%c%s.py
- Absolute path to script exceeds PYI_PATH_MAX
- Failed to unmarshal code object for %s
- _pyi_main_co
- Traceback is disabled via bootloader option.
- PYINSTALLER_RESET_ENVIRONMENT
- _PYI_ARCHIVE_FILE
- _PYI_APPLICATION_HOME_DIR
- _PYI_PARENT_PROCESS_LEVEL
- _PYI_SPLASH_IPC
- Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s
- PYINSTALLER_STRICT_UNPACK_MODE
- Failed to initialize security descriptor for temporary directory!
- Could not create temporary directory!
- _PYI_APPLICATION_HOME_DIR not set for onefile child process!
- Path exceeds PYI_PATH_MAX limit.
- Failed to convert DLL search path!
- pyi-python-flag
- Py_GIL_DISABLED
- pyi-runtime-tmpdir
- pyi-contents-directory
- pyi-disable-windowed-traceback
- PYINSTALLER_SUPPRESS_SPLASH_SCREEN
- Failed to load splash screen resources!
- Failed to unpack splash screen dependencies from PKG archive!
- Failed to load Tcl/Tk shared libraries for splash screen!
- Failed to start splash screen!
- Failed to remove temporary directory: %s
- Could not load PyInstaller's embedded PKG archive from the executable (%s)
- Could not side-load PyInstaller's PKG archive from external file (%s)
- Maximum archive pool size reached!
- Failed to open archive %s!
- %s%c%s%c%s%c%s
- %s%c%s%c%s
- Failed to copy file %s from %s!
- %s%c%s.pkg
- %s%c%s.exe
- Referenced dependency archive %s not found.
- Failed to open referenced dependency archive %s.
- Dependency %s not found in the referenced dependency archive.
- Failed to extract %s from referenced dependency archive %s.
- verbose
- unbuffered
- optimize
- hash_seed
- base_library.zip
- Py_DecRef
- Py_DecodeLocale
- Py_ExitStatusException
- Py_Finalize
- Py_InitializeFromConfig
- Py_IsInitialized
- Py_PreInitialize
- PyConfig_Clear
- PyConfig_InitIsolatedConfig
- PyConfig_Read
- PyConfig_SetBytesString
- PyConfig_SetString
- PyConfig_SetWideStringList
- PyErr_Clear
- PyErr_Fetch
- PyErr_NormalizeException
- PyErr_Occurred
- PyErr_Print
- PyErr_Restore
- PyEval_EvalCode
- PyImport_AddModule
- PyImport_ExecCodeModule
- PyImport_ImportModule
- PyMarshal_ReadObjectFromString
- PyMem_RawFree
- PyModule_GetDict
- PyObject_CallFunction
- PyObject_CallFunctionObjArgs
- PyObject_GetAttrString
- PyObject_SetAttrString
- PyObject_Str
- PyPreConfig_InitIsolatedConfig
- PyRun_SimpleStringFlags
- PyStatus_Exception
- PySys_GetObject
- PySys_SetObject
- PyUnicode_AsUTF8
- PyUnicode_Decode
- PyUnicode_DecodeFSDefault
- PyUnicode_FromFormat
- PyUnicode_FromString
- PyUnicode_Join
- PyUnicode_Replace
- Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)
- ucrtbase.dll
- Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)
- Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)
- Failed to parse run-time options!
- Failed to pre-initialize embedded python interpreter!
- Failed to allocate PyConfig structure! Unsupported python version?
- Failed to set program name!
- Failed to set python home path!
- Failed to set module search paths!
- Failed to set sys.argv!
- Failed to set run-time options!
- Failed to start embedded python interpreter!
- strict
- Failed to get _MEIPASS as PyObject.
- _MEIPASS
- Failed to unmarshal code object for module %s!
- Module object for %s is NULL!
- _pyinstaller_pyz
- PYZ archive entry not found in the TOC!
- %U?%llu
- Failed to format PYZ archive path and offset
- Failed to store path to PYZ archive into sys.%s!
- SPLASH: length of Tcl shared library path exceeds maximum path length!
- SPLASH: length of Tk shared library path exceeds maximum path length!
- Could not allocate memory for splash screen resources.
- SPLASH: Tcl is not threaded. Only threaded Tcl is supported.
- SPLASH: could not find requirement %s in archive.
- SPLASH: extraction path length exceeds maximum path length!
- SPLASH: file already exists but should not: %s
- SPLASH: failed to create parent directory structure.
- SPLASH: could not extract requirement %s.
- SPLASH: failed to load Tcl/Tk shared libraries!
- Could not allocate memory for SPLASH_CONTEXT.
- status_text
- tk.tcl
- tk_library
- _source
- tclInit
- tcl_findLibrary
No strings match this filter.
Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.
Disassembly
entry point · x64 · 60 insns (listing capped)AddressBytesMnemonicOperands
0x14000ce204883ec28subrsp, 0x28
0x14000ce24e857020000call0x14000d080
0x14000ce294883c428addrsp, 0x28
0x14000ce2de97afeffffjmp0x14000ccac
0x14000ce32ccint3
0x14000ce33ccint3
0x14000ce34ccint3
0x14000ce35ccint3
0x14000ce36ccint3
0x14000ce37ccint3
0x14000ce38ccint3
0x14000ce39ccint3
0x14000ce3accint3
0x14000ce3bccint3
0x14000ce3cccint3
0x14000ce3dccint3
0x14000ce3eccint3
0x14000ce3fccint3
0x14000ce404883ec28subrsp, 0x28
0x14000ce44e823060000call0x14000d46c
0x14000ce4985c0testeax, eax
0x14000ce4b7421je0x14000ce6e
0x14000ce4d65488b042530000000movrax, qword ptr gs:[0x30]
0x14000ce56488b4808movrcx, qword ptr [rax + 8]
0x14000ce5aeb05jmp0x14000ce61
0x14000ce5c483bc8cmprcx, rax
0x14000ce5f7414je0x14000ce75
0x14000ce6133c0xoreax, eax
0x14000ce63f0480fb10d0c570300lock cmpxchgqword ptr [rip + 0x3570c], rcx
0x14000ce6c75eejne0x14000ce5c
0x14000ce6e32c0xoral, al
0x14000ce704883c428addrsp, 0x28
0x14000ce74c3ret
0x14000ce75b001moval, 1
0x14000ce77ebf7jmp0x14000ce70
0x14000ce79ccint3
0x14000ce7accint3
0x14000ce7bccint3
0x14000ce7c4883ec28subrsp, 0x28
0x14000ce8085c9testecx, ecx
0x14000ce827507jne0x14000ce8b
0x14000ce84c605f556030001movbyte ptr [rip + 0x356f5], 1
0x14000ce8be850f7ffffcall0x14000c5e0
0x14000ce90e83b0a0000call0x14000d8d0
0x14000ce9584c0testal, al
0x14000ce977504jne0x14000ce9d
0x14000ce9932c0xoral, al
0x14000ce9beb14jmp0x14000ceb1
0x14000ce9de85ad50000call0x14001a3fc
0x14000cea284c0testal, al
0x14000cea47509jne0x14000ceaf
0x14000cea633c9xorecx, ecx
0x14000cea8e84b0a0000call0x14000d8f8
0x14000ceadebeajmp0x14000ce99
0x14000ceafb001moval, 1
0x14000ceb14883c428addrsp, 0x28
0x14000ceb5c3ret
0x14000ceb6ccint3
0x14000ceb7ccint3
0x14000ceb84053pushrbx
callbranchretstackarithregisterimmediatememory
Nothing in this view
This sample produced no results for this part of the static analysis.
Import fingerprint
1 related sample| Fingerprint | 48:tVYEK/0W/KA4JGn6gF/gub6EwoQ54rzSv6xviAYd9pUJOyIx0LwitN1MEc+pIuCP:D/sTfh18gJtIx0LZtN1MEc+pIuYQ9HS |
|---|---|
| Imports read | 143 functions from 5 libraries (143 distinct) |
| Comparable | yes |
| Compared against | 70 stored samples |
Samples built on the same import table (1)
An identical import table survives repacking, so a high score usually means the same code rebuilt. It is corroboration, not a verdict of its own.
| Score | Sample | Verdict |
|---|---|---|
| 75 | 142cbf78297c928e81174c1… | suspicious |
Screen recording
10 frames · screen recording · 164s1 / 10
Download this recording
Download video (.mp4)
Download GIF (.gif)
Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.
Behavior summary
ran 164s4 process(es) observed; malicious behavior: dropped_executable; 2 dropped executable(s)
LaunchedC:\Users\user\Desktop\CDRevive-Launcher_3.exe
Privilegestandard
dropped_executable
Telemetry sources:
Kernel ETW (434 of 1731 events) - truncated
agent poll: 254Process audit: 4In-process monitor: 5
Evasion / anti-analysis checks
10 checks
MED
Anti-debug API imports static-api
MITRE T1622 · isdebuggerpresent
MED
System Checks Capability analysis
MITRE T1497
MED
Check for time delay via QueryPerformanceCounter Capability rule
MITRE T1622 · Debugger detection
MED
Reference analysis tools strings Capability rule
MITRE T1497 · Anti-analysis
MED
Reference anti-VM strings targeting Xen Capability rule
MITRE T1497.001 · Virtual-machine detection
MED
Debugger Detection::Process Environment Block Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Debugger Detection::Timing/Delay Check QueryPerformanceCounter Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Dynamic Analysis Evasion::Delayed Execution Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Virtual Machine Detection Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Anti-analysis strings (VM/debugger/tool names) strings
MITRE T1497 · isdebuggerpresent
Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).
Anti-analysis API trace
3 APIs · 2 processes hookedCalls counted inside the running sample by in-process hooks. Scored means the call crossed the threshold that separates a deliberate check from what ordinary software does; a call that scored nothing is still listed, with the reason.
| API | Signal | Calls | Sleep | Scored |
|---|---|---|---|---|
| GetTickCount | timing | 1 | - | no corroborates, never convicts on its own - ordinary software calls this |
| GetTickCount64 | timing | 10 | - | no corroborates, never convicts on its own - ordinary software calls this |
| Sleep | sleep | 1 | 2000 ms total · 2000 ms max | no under the floor a stall has to cross (30s in total or 10s at once) |
Call order 6 events sampled
GetTickCountGetTickCountGetTickCount64SleepGetTickCount64spawn:cmd.exe
How to read the numbers: a repeated call is sampled at 1, 10, 100 and so on while the run is live and made exact when the process exits, so a count is a floor and not a total. The count kept for a name is the highest a single process reported, not a sum across the process tree. The hooks are placed a few seconds after a process starts, so a check made in the first moments of a launch is missed - and a sample that exits in those first seconds is never watched at all.
No module load worth listing. In-process hooks were placed in 2 processes and recorded no explicit module load, so this is an observation rather than a gap. Modules brought in by the sample's own import table are never seen here.
No WMI attributed to the sample. The WMI-Activity trace was running and recorded 680 operations on the machine during the run; none of them came from the sample's process tree.
Command lines, unwrapped
3 read3 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.
Network activity
The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.
This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.
Process tree
What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.
4processes
300file operations
2dropped files
CDRevive-Launcher_3.exe
4 processes
4 processes
Attributed activity
CDRevive-Launcher_3.exe
PID 2360
Image
C:\Users\user\Desktop\CDRevive-Launcher_3.exe
Command
C:\Users\user\Desktop\CDRevive-Launcher_3.exe
Parent
not captured - its parent is outside the sample's tree
Children
1
File operations300
createC:\Users\user\AppData\Local\Temp\_MEI23602
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Chita
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Calcutta
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Brunei
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Bishkek
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Beirut
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Barnaul
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Bangkok
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Baku
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Bahrain
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Baghdad
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Atyrau
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Ashkhabad
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Ashgabat
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Aqtobe
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Aqtau
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Anadyr
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Amman
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Almaty
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Aden
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Arctic\Longyearbyen
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Arctic
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Vostok
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Troll
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Syowa
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\South_Pole
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Rothera
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Palmer
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\McMurdo
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Mawson
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Macquarie
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\DumontDUrville
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Davis
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Casey
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Yellowknife
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Yakutat
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Winnipeg
createC:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Whitehorse
Showing the first 40 of 300. The full list is on the File & registry section.
Dropped files2
dropC:\Users\user\AppData\Local\Temp\_MEI23602\VCRUNTIME140_1.dll34048abaa070ecc1
dropC:\Users\user\AppData\Local\Temp\_MEI23602\VCRUNTIME140.dll9d2b40f0395cc5d1
CDRevive-Launcher_3.exe
PID 1512
Image
C:\Users\user\Desktop\CDRevive-Launcher_3.exe
Command
C:\Users\user\Desktop\CDRevive-Launcher_3.exe
Parent
PID 2360 · CDRevive-Launcher_3.exe
Children
1
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
cmd.exe
PID 5048
Image
C:\Windows\System32\cmd.exe
Command
C:\Windows\system32\cmd.exe /c "ver"
Parent
PID 1512 · CDRevive-Launcher_3.exe
Chain
cdrevive-launcher_3.exe -> cmd.exe
Children
1
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 3200
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 5048 · cmd.exe
Chain
cdrevive-launcher_3.exe -> cmd.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity
Persistence mechanisms
cleanNo persistence established
None of the 90 auto-start methods below were established during this run.
Detection coverage
0 / 90Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".
Logon & Startup
22 clean
- Active Setup Installed Component T1547.014 clean
- Explorer Delay-Load Object T1547.001 clean
- Explorer Run Key T1547.001 clean
- Explorer SharedTaskScheduler T1547.001 clean
- Group Policy Extension DLL T1547.004 clean
- Group Policy Run Key T1547.001 clean
- Logon Script T1037.001 clean
- RDP WDS Startup Program T1547.001 clean
- Registry Run Key T1547.001 clean
- Registry RunEx Key T1547.001 clean
- Registry RunOnce Key T1547.001 clean
- Registry RunOnceEx Key T1547.001 clean
- Registry RunServices Key T1547.001 clean
- Startup Folder Item T1547.001 clean
- Startup Folder Redirection T1547.001 clean
- Terminal Services Initial Program T1547.001 clean
- Winlogon GINA DLL T1547.004 clean
- Winlogon MPNotify Value T1547.004 clean
- Winlogon Notify Package T1547.004 clean
- Winlogon Shell Value T1547.004 clean
- Winlogon Taskman Value T1547.004 clean
- Winlogon Userinit Value T1547.004 clean
Services & Tasks
9 clean
- BITS Job T1197 clean
- Print Monitor DLL T1547.010 clean
- Print Processor DLL T1547.012 clean
- Scheduled Task T1053.005 clean
- Scheduled Task Registry Implant T1053.005 clean
- Service Control Manager Security Descriptor T1574.011 clean
- Service DLL Hijack T1543.003 clean
- Time Provider DLL T1547.003 clean
- Windows Service Creation T1543.003 clean
Execution Hijack
17 clean
- .NET Managed Debugger T1546.012 clean
- Accessibility Tool Hijack T1546.008 clean
- AeDebug Postmortem Debugger T1546.012 clean
- App Paths Hijack T1546.012 clean
- Application Shim Database T1546.011 clean
- Boot Verification Program T1547.002 clean
- Command Processor AutoRun T1546.011 clean
- Explorer Load Value T1547.001 clean
- Explorer MyComputer Tool Hijack T1546.001 clean
- Registry Image File Execution Options T1546.012 clean
- Screensaver Hijack T1546.002 clean
- Setup ErrorHandler Script T1546 clean
- Shell Open Command Hijack T1546.001 clean
- SilentProcessExit Monitor T1546.012 clean
- Telemetry Controller Command T1546.015 clean
- WER ReflectDebugger T1546.012 clean
- Windows Error Reporting Debugger T1546.012 clean
DLL Load Order
12 clean
- .NET CLR Profiler DLL T1574.012 clean
- .NET Startup Hook DLL T1574 clean
- AppCert DLLs T1546.009 clean
- AppInit DLLs T1546.010 clean
- AutodialDLL Winsock Injection T1546.006 clean
- DLL Search-Order Hijack T1574.001 T1574.002 clean
- DNS Server Plugin DLL T1574.001 clean
- HTML Help Helper DLL T1546 clean
- KnownDLLs Manipulation T1574.001 clean
- Natural Language Platform DLL Override T1546 clean
- Netsh Helper DLL T1546.007 clean
- Winsock Layered Service Provider T1546.006 clean
COM & Browser
6 clean
- Browser Extension T1176 clean
- Browser Helper Object T1176 clean
- COM Server Hijack T1546.015 clean
- HTML Help COM Object Hijack T1546.015 clean
- Shell Context Menu Handler T1546.001 clean
- Shell Extension Handler T1546.001 clean
Security Providers & Accounts
11 clean
- Account RID Hijack T1098 clean
- AMSI Provider T1562.001 clean
- Credential Provider T1547.014 clean
- DSRM Admin Logon Backdoor T1556 clean
- Hidden Local Account T1136.001 clean
- LSA Authentication Package T1547.002 clean
- LSA Extension DLL T1547.005 clean
- LSA Notification Package T1547.005 clean
- LSA Security Package T1547.005 clean
- Network Provider DLL T1556.008 clean
- Security Support Provider T1547.005 clean
Scripting & Applications
9 clean
- Netsh Port Proxy T1090.001 clean
- Office Add-in T1137.006 clean
- Office Executable Sideload T1574.002 clean
- Office Startup Template T1137.001 clean
- Office Test Key T1137.002 clean
- Power Automate Flow T1546 clean
- PowerShell Profile T1546.013 clean
- Windows Terminal Startup Action T1546 clean
- WMI Event Subscription T1546.003 clean
Boot & Firmware
4 clean
- BootExecute Native Image T1547.002 clean
- PlatformExecute Native Image T1547.002 clean
- SetupExecute Native Image T1547.002 clean
- UEFI / Bootkit Artifact T1542.003 T1542.001 clean
File activity summary
create 300
write 0
modify 0
delete 0
rename 0
Dropped files
2 payloads| Path | SHA-256 | Size | Process | Time | Download |
|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\_MEI23602\VCRUNTIME140_1.dll | 34048abaa070ecc13b318cea… also in 1 other scan | 36.4 KB | CDRevive-Launcher_3.exe pid 2360 | 2026-10-19T21:29:53.586Z | ZIP |
| C:\Users\user\AppData\Local\Temp\_MEI23602\VCRUNTIME140.dll | 9d2b40f0395cc5d1b4d5ea17… also in 1 other scan | 95.9 KB | CDRevive-Launcher_3.exe pid 2360 | 2026-10-19T21:29:53.570Z | ZIP |
Dropped payload analysis
2 payloads examinedEach payload the sample wrote and this run kept was scanned by the antivirus engine and identified locally. 2 of them were examined and none was flagged. That is a result about these bytes only: a payload the caps turned away, or one the capture never kept, is reported separately.
Whether any of these payloads is already known to an outside source was not established for this scan: reputation enrichment is a paid-plan layer. The antivirus result and the identification below ran locally and are complete.
| Payload | Where it landed | What it is | Antivirus | Download |
|---|---|---|---|---|
| VCRUNTIME140_1.dll | C:\Users\user\AppData\Local\Temp\_MEI23602\VCRUNTIME140_1.dll | Windows executablesigned1 signature match |
no detection | ZIP |
| VCRUNTIME140.dll | C:\Users\user\AppData\Local\Temp\_MEI23602\VCRUNTIME140.dll | Windows executablesigned1 signature match |
no detection | ZIP |
File & registry ops
300 file · 0 registry · sample scope
File operation times: 56 timed244 not observed
| Operation | Target | Process | |
|---|---|---|---|
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Chita
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Calcutta
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Brunei
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Bishkek
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Beirut
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Barnaul
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Bangkok
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Baku
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Bahrain
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.795 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Baghdad
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.795 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Atyrau
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.795 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Ashkhabad
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.795 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Ashgabat
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.795 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Aqtobe
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Aqtau
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Anadyr
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Amman
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Almaty
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia\Aden
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Asia
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Arctic\Longyearbyen
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Arctic
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Vostok
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Troll
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Syowa
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\South_Pole
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Rothera
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Palmer
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\McMurdo
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Mawson
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Macquarie
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\DumontDUrville
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Davis
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica\Casey
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Antarctica
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Yellowknife
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Yakutat
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Winnipeg
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Whitehorse
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Virgin
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Vancouver
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Tortola
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Toronto
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Tijuana
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Thunder_Bay
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Thule
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Tegucigalpa
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Swift_Current
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\St_Vincent
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\St_Thomas
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.780 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\St_Lucia
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.767 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\St_Kitts
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.767 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\St_Johns
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.767 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\St_Barthelemy
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Sitka
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Shiprock
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Scoresbysund
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Sao_Paulo
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Santo_Domingo
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Santiago
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Santarem
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Santa_Isabel
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Rosario
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Rio_Branco
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Resolute
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Regina
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Recife
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Rankin_Inlet
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Rainy_River
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Punta_Arenas
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.749 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Puerto_Rico
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.749 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Porto_Velho
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Porto_Acre
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Port_of_Spain
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Port-au-Prince
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Phoenix
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Paramaribo
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Pangnirtung
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Panama
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Ojinaga
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Nuuk
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\North_Dakota\New_Salem
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\North_Dakota\Center
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\North_Dakota\Beulah
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\North_Dakota
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Noronha
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Nome
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Nipigon
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\New_York
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Nassau
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Montserrat
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Montreal
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Montevideo
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Monterrey
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Moncton
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Miquelon
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.733 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Mexico_City
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Metlakatla
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Merida
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Menominee
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.717 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Mendoza
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Mazatlan
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Matamoros
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Martinique
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Marigot
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Manaus
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Managua
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Maceio
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Lower_Princes
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Louisville
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Los_Angeles
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Lima
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\La_Paz
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Kralendijk
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Knox_IN
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Kentucky\Monticello
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Kentucky\Louisville
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Kentucky
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Juneau
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Jujuy
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Jamaica
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Iqaluit
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Inuvik
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Indianapolis
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.702 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Indiana\Winamac
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Indiana\Vincennes
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Indiana\Vevay
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Indiana\Tell_City
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Indiana\Petersburg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Indiana\Marengo
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Indiana\Knox
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Indiana\Indianapolis
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Indiana
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Hermosillo
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Havana
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Halifax
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Guyana
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Guayaquil
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Guatemala
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Guadeloupe
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Grenada
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Grand_Turk
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Goose_Bay
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Godthab
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Glace_Bay
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Fortaleza
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.686 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Fort_Wayne
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.686 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Fort_Nelson
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.686 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Ensenada
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.686 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\El_Salvador
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:04.686 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Eirunepe
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Edmonton
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Dominica
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Detroit
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Denver
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Dawson_Creek
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Dawson
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Danmarkshavn
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Curacao
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Cuiaba
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Creston
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Costa_Rica
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Cordoba
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Coral_Harbour
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Chihuahua
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Chicago
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Cayman
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Cayenne
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Catamarca
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Caracas
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Cancun
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Campo_Grande
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Cambridge_Bay
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Buenos_Aires
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Boise
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Bogota
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Boa_Vista
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Blanc-Sablon
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Belize
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Belem
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Barbados
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Bahia_Banderas
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Bahia
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Atka
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Atikokan
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Asuncion
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Aruba
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\Ushuaia
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\Tucuman
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\San_Luis
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\San_Juan
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\Salta
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\Rio_Gallegos
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\Mendoza
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\La_Rioja
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\Jujuy
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\Cordoba
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\ComodRivadavia
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\Catamarca
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina\Buenos_Aires
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Argentina
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Araguaina
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Antigua
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Anguilla
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Anchorage
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America\Adak
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\America
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Windhoek
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Tunis
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Tripoli
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Timbuktu
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Sao_Tome
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Porto-Novo
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Ouagadougou
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Nouakchott
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Niamey
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Ndjamena
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Nairobi
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Monrovia
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Mogadishu
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Mbabane
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Maseru
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Maputo
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Malabo
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Lusaka
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Lubumbashi
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Luanda
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Lome
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Libreville
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Lagos
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Kinshasa
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Kigali
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Khartoum
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Kampala
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Juba
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Johannesburg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Harare
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Gaborone
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Freetown
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\El_Aaiun
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Douala
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Djibouti
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Dar_es_Salaam
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Dakar
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Conakry
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Ceuta
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Casablanca
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:02.844 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Cairo
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:02.844 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Bujumbura
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:02.844 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Brazzaville
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:02.844 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Blantyre
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:02.766 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Bissau
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:02.766 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Banjul
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:02.766 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Bangui
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:02.766 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Bamako
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:02.703 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Asmera
|
CDRevive-Launcher_3.exe pid 2360 | 2026-10-20 00:30:02.703 |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Asmara
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Algiers
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Addis_Ababa
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Accra
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa\Abidjan
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata\Africa
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tzdata
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tm.tcl
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\tclIndex
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\safe.tcl
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\parray.tcl
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\package.tcl
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\opt0.4\pkgIndex.tcl
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\opt0.4\optparse.tcl
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\opt0.4
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\zh_tw.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\zh_sg.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\zh_hk.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\zh_cn.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\zh.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\vi.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\uk.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\tr.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\th.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\te_in.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\te.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\ta_in.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\ta.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\sw.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\sv.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\sr.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\sq.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\sl.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\sk.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\sh.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\ru_ua.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\ru.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\ro.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\pt_br.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\pt.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\pl.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\nn.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\_MEI23602\_tcl_data\msgs\nl_be.msg
|
CDRevive-Launcher_3.exe pid 2360 | not observed |
No operations match your filter.
External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.
Earlier analysis of these bytes
1 earlier runEarlier analyses of the identical file, matched by SHA-256. Same bytes, same questions - what this platform found the last time it looked is evidence about the file in front of you now.
| Run | Analysed | Module | Verdict | Score |
|---|---|---|---|---|
| #2864 | 2026-10-20 00:29 | File Analysis | Suspicious35 | 35/100 |
1Sources with a hit
18Sources queriedof 23 available
470.3kFeed records
1Could not answer
File reputation
4 clear · 3 not checked| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| MalwareBazaar hash feed | File hash | clean | not in feed | 2,745 records 45 minutes ago |
| MalwareBazaar ransomware feed | File hash | clean | not in feed | 3,348 records 3 minutes ago |
| ThreatFox hash IOCs | File hash | clean | not in feed | 1,158 records 46 minutes ago |
| URLhaus payload hashes | File hash | clean | not in feed | 1,642 records 45 minutes ago |
| filescan.io | File hash | not checked | no hash lookup ran for this scan | live lookup |
| MalwareBazaar | File hash | not checked | no hash lookup ran for this scan | live lookup |
| VirusTotal | File hash | not checked | no hash lookup ran for this scan | live lookup |
Hash lookups only - the sample itself is never uploaded to any third party.
Network indicators
7 clear · 1 could not answer| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| URLhaus | IP / domain / URL | feed unavailable | 3 observed indicators, none listed | no records ingested |
| blocklist.de | IP / domain / URL | clean | 3 observed indicators, none listed | 27.6k records 45 minutes ago |
| CINS Army | IP / domain / URL | clean | 3 observed indicators, none listed | 15k records 45 minutes ago |
| Emerging Threats | IP / domain / URL | clean | 3 observed indicators, none listed | 482 records 45 minutes ago |
| Feodo Tracker | IP / domain / URL | clean | 3 observed indicators, none listed | 5 records 46 minutes ago |
| IPsum | IP / domain / URL | clean | 3 observed indicators, none listed | 19.7k records 45 minutes ago |
| Phishing.Database | IP / domain / URL | clean | 3 observed indicators, none listed | 391.5k records 5 minutes ago |
| ThreatFox | IP / domain / URL | clean | 3 observed indicators, none listed | 1,158 records 46 minutes ago |
TLS fingerprints
nothing of this kind to check| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| JA3 / JA4 fingerprint blocklists | JA3 / JA4 | not checked | no TLS client fingerprint observed | 97 records 12 hours ago |
| SSL blocklist | Server certificate | not checked | no server certificate fingerprint is extracted to check | live lookup |
Detection rules
1 of 2 listed| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| Signature rules | Sample content | 2 matches | TigerRAT_pe_yaraify, MachO_File_pyinstaller | 110 records 46 minutes ago |
| Sigma rules | Behavior log | clean | - | 2,275 records 7 hours ago |
Tooling catalogs
4 clear| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| LOLBAS | Process image paths | clean | 4 process image paths, none masqueraded | 245 records 46 minutes ago |
| LOLBootloaders | File hash | clean | not a known vulnerable bootloader | 520 records 45 minutes ago |
| LOLDrivers | File hash | clean | not a known vulnerable driver | 2,333 records 46 minutes ago |
| LOLRMM | Names and domains | clean | 6 name/domain indicators checked, no remote-management tooling | 360 records 45 minutes ago |
AI analysis
The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.
Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.
0 malicious
4 suspicious
3 info
File indicators
7| Severity | Type | Indicator | Description |
|---|---|---|---|
| info | sample_sha256 | 11af38e58fdc0844be4dae2fc6f072d9b7ca0bb85deee6365f1364c627d63d70 | Submitted sample (SHA256) |
| info | sample_md5 | e9ff9e9169b31c8f8b3cfb7ed792150f | Submitted sample (MD5) |
| info | imphash | 72c4e339b7af8ab1ed2eb3821c98713a | Import table hash (imphash) |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI23602\VCRUNTIME140_1.dll | Executable written to disk during execution |
| suspicious | dropped_sha256 | 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32 | SHA256 of a file written during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\_MEI23602\VCRUNTIME140.dll | Executable written to disk during execution |
| suspicious | dropped_sha256 | 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1 | SHA256 of a file written during execution |
Sigma detections
0 matches of 2275 rulesThe Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.
Generated rules
YARA: auto_file_2865_yara
Auto-generatedrule auto_file_2865_yara
{
meta:
description = "Auto-generated from scan 2865"
author = "sandbox auto-generator"
imphash = "72c4e339b7af8ab1ed2eb3821c98713a"
anchors = "5 independent regions"
strings:
$s0 = "SPLASH: failed to load Tcl/Tk shared libraries!" ascii fullword
$s1 = "Failed to load Tcl/Tk shared libraries for splash screen!" ascii fullword
$s2 = "ucrtbase.dll" ascii fullword
$s3 = "inflate 1.3.1 Copyright 1995-2024 Mark Adler" ascii fullword
$s4 = "Failed to obtain/convert traceback!" wide fullword
condition:
uint16(0) == 0x5a4d and filesize < 120008264 and all of them
}Extracted files
What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.
Export & download
/s/2865Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.
AI analysis report
An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).
Generating AI report
Building your report...Compiling the AI narrative and derived evidence. This can take a moment.
Report readyYour report has been generated.
Download
Could not generate the reportPlease try again.
Not available for this scanIt was submitted under ultra privacy, so no derived data from it is sent to the model - and this document is written from that data. Every other section of this report is unaffected.
Headers
Body
Headers
Body
Download live malware sample
You are about to download the raw, live sample. It is real, potentially destructive malware and can harm your machine if opened or run. Only handle it inside an isolated analysis environment.
Delivered as a ZIP encrypted with the password infected so the bytes are never handled unprotected.
Report this analysis
Analysis reports are produced automatically from files, addresses and text submitted by visitors. If this one publishes your material, identifies you, or should not be public for any other reason, tell us why and an administrator will review it.
Public analyses of this file
2 runsThis file has been analysed more than once. The report below is the run that found the most, which is not always the most recent one.
| Submitted | Environment | Verdict | Score |
|---|---|---|---|
| 2026-10-20 00:24 Shown below | Windows 10 22H2 | Suspicious | 35/100 |
| 2026-10-20 00:24 | Windows 10 22H2 | Suspicious | 35/100 |