The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.
{
"sha256": "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c",
"verdict": "suspicious",
"confidence": 95,
"signals": [
"executable-drop",
"child-processes",
"packed"
],
"attack": [
"T1105",
"T1059",
"T1027.002"
],
"dropped": [
"C:\\ProgramData\\09378f14-4f77-4e5a-baac-0eb9e134a52d\\eServiceHost.exe",
"C:\\ProgramData\\09378f14-4f77-4e5a-baac-0eb9e134a52d\\msvcp140.dll",
"C:\\ProgramData\\09378f14-4f77-4e5a-baac-0eb9e134a52d\\ProtobufLite.dll",
"C:\\ProgramData\\09378f14-4f77-4e5a-baac-0eb9e134a52d\\sciter-x.dll",
"C:\\ProgramData\\09378f14-4f77-4e5a-baac-0eb9e134a52d\\vcruntime140.dll"
],
"children": [
"C:\\Users\\RESEAR~1\\AppData\\Local\\Temp\\is-8HLK4.tmp\\191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.tmp",
"C:\\Users\\RESEAR~1\\AppData\\Local\\Temp\\is-8USV7.tmp\\191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.tmp",
"C:\\argus-vr-agent\\quarantine\\191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c_extracted\\191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.exe"
]
}