We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
10 March 2026, 02:09
Analysis environment:
Windows 10 Pro, build 19044, x64
me.exe
MD5:
EFD792F08B152FCD59187EC311D785D2
SHA1:
A21C8B8CABC7670EA45BC175E185A0F9BFCF4733
SHA256:
4CDEB5DF217764A8B6A20D518B76CCB30CBE623365A13D9DCD40900950F1ED99
Analysis result
Threat level:
Malicious activity
Tags:
xmrig
golang
antivm
Full analysis:
Analysis me.exe (MD5: EFD792F08B152FCD59187EC311D785D2) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
XMRIG has been detected (YARA)
me.exe (PID: 8144)
HolaMonitorService.exe (PID: 7780)
SUSPICIOUS
There is functionality for VM detection antiVM strings (YARA)
me.exe (PID: 8144)
HolaMonitorService.exe (PID: 7780)
Executes as Windows Service
HolaMonitorService.exe (PID: 7780)
Executable content was dropped or overwritten
me.exe (PID: 1876)
INFO
Checks supported languages
me.exe (PID: 8144)
me.exe (PID: 1876)
HolaMonitorService.exe (PID: 7780)
Application based on Golang
me.exe (PID: 8144)
HolaMonitorService.exe (PID: 7780)
Reads the computer name
me.exe (PID: 8144)
me.exe (PID: 1876)
HolaMonitorService.exe (PID: 7780)
Detects GO elliptic curve encryption (YARA)
me.exe (PID: 8144)
HolaMonitorService.exe (PID: 7780)
Manual execution by a user
me.exe (PID: 1876)
Creates files in the program directory
me.exe (PID: 1876)
Checks proxy server information
slui.exe (PID: 5768)
Threats
No threats detected