Overview

overview

7

Static

static

3

2026-05-28...ar.exe

windows10-2004-x64

7

2026-05-28...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/05/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  • Size 3.7MB
  • Sample260528-e7vdyaft7q
  • SHA256 2485b6e2a52b79f19da77ce942f94b17d5cfe17d43388a6f686c0778a8fac911
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4944.4344.12020301784049055505
      2⤵
      • Drops file in Program Files directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x16c,0x170,0x174,0x148,0x124,0x7ffbda3bb078,0x7ffbda3bb084,0x7ffbda3bb090
        3⤵
          PID:3008
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,17851989204918528207,1798307767233813398,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
          3⤵
            PID:5192
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2028,i,17851989204918528207,1798307767233813398,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:3
            3⤵
              PID:5216
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2332,i,17851989204918528207,1798307767233813398,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
              3⤵
                PID:5316
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3644,i,17851989204918528207,1798307767233813398,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
                3⤵
                  PID:5828
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=2256,i,17851989204918528207,1798307767233813398,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
                  3⤵
                    PID:4760
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3872,i,17851989204918528207,1798307767233813398,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:1
                    3⤵
                      PID:5496
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4012,i,17851989204918528207,1798307767233813398,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
                      3⤵
                        PID:4860
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4120,i,17851989204918528207,1798307767233813398,262144 --variations-seed-version --mojo-platform-channel-handle=1000 /prefetch:8
                        3⤵
                          PID:3084
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2400,i,17851989204918528207,1798307767233813398,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
                          3⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5952
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3820,i,17851989204918528207,1798307767233813398,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
                          3⤵
                            PID:4600
                      • C:\Windows\System32\alg.exe
                        C:\Windows\System32\alg.exe
                        1⤵
                        • Executes dropped EXE
                        PID:4956
                      • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                        C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2132
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                        1⤵
                          PID:4824
                        • C:\Windows\system32\fxssvc.exe
                          C:\Windows\system32\fxssvc.exe
                          1⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2960
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                          1⤵
                          • Executes dropped EXE
                          PID:3808
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                          1⤵
                          • Executes dropped EXE
                          PID:736
                        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                          "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                          1⤵
                          • Executes dropped EXE
                          PID:4332
                        • C:\Windows\System32\msdtc.exe
                          C:\Windows\System32\msdtc.exe
                          1⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          PID:3564
                        • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                          "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                          1⤵
                          • Executes dropped EXE
                          PID:996
                        • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                          C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                          1⤵
                          • Executes dropped EXE
                          PID:3444
                        • C:\Windows\SysWow64\perfhost.exe
                          C:\Windows\SysWow64\perfhost.exe
                          1⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2464
                        • C:\Windows\system32\locator.exe
                          C:\Windows\system32\locator.exe
                          1⤵
                          • Executes dropped EXE
                          PID:2488
                        • C:\Windows\System32\SensorDataService.exe
                          C:\Windows\System32\SensorDataService.exe
                          1⤵
                          • Executes dropped EXE
                          • Checks SCSI registry key(s)
                          PID:3240
                        • C:\Windows\System32\snmptrap.exe
                          C:\Windows\System32\snmptrap.exe
                          1⤵
                          • Executes dropped EXE
                          PID:3092
                        • C:\Windows\system32\spectrum.exe
                          C:\Windows\system32\spectrum.exe
                          1⤵
                          • Executes dropped EXE
                          • Checks SCSI registry key(s)
                          PID:1560
                        • C:\Windows\System32\OpenSSH\ssh-agent.exe
                          C:\Windows\System32\OpenSSH\ssh-agent.exe
                          1⤵
                          • Executes dropped EXE
                          PID:3256
                        • C:\Windows\system32\TieringEngineService.exe
                          C:\Windows\system32\TieringEngineService.exe
                          1⤵
                          • Executes dropped EXE
                          • Checks processor information in registry
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4404
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                          1⤵
                            PID:1360
                          • C:\Windows\system32\AgentService.exe
                            C:\Windows\system32\AgentService.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1692
                          • C:\Windows\System32\vds.exe
                            C:\Windows\System32\vds.exe
                            1⤵
                            • Executes dropped EXE
                            PID:1392
                          • C:\Windows\system32\vssvc.exe
                            C:\Windows\system32\vssvc.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5072
                          • C:\Windows\system32\wbengine.exe
                            "C:\Windows\system32\wbengine.exe"
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4004
                          • C:\Windows\system32\wbem\WmiApSrv.exe
                            C:\Windows\system32\wbem\WmiApSrv.exe
                            1⤵
                            • Executes dropped EXE
                            PID:4652
                          • C:\Windows\system32\SearchIndexer.exe
                            C:\Windows\system32\SearchIndexer.exe /Embedding
                            1⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4508
                            • C:\Windows\system32\SearchProtocolHost.exe
                              "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                              2⤵
                              • Modifies data under HKEY_USERS
                              PID:3632
                            • C:\Windows\system32\SearchFilterHost.exe
                              "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
                              2⤵
                              • Modifies data under HKEY_USERS
                              PID:2116

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                elevation_service.exe
                                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                • Size 2.7MB
                                • SHA256 f12ede6372f65a3f33b4764e968a8ca904b6808bce7dbbc8f84b903492cd6f5f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                maintenanceservice.exe
                                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                • Size 1.5MB
                                • SHA256 eae5beb082d0a10aa8df128652ead2c2b16eb599e1c0ad49e963b56118f2494f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                7z.exe
                                • Path C:\Program Files\7-Zip\7z.exe
                                • Size 1.8MB
                                • SHA256 ac69d3531df1d0411ad0aa759060681e342f10cc989c914d895bf9a56fdd77ec
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                7zFM.exe
                                • Path C:\Program Files\7-Zip\7zFM.exe
                                • Size 1.5MB
                                • SHA256 c80e2bee326e22927d61b3205549c3be53e9d07f5322fc1004f637c609faa3a6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                7zG.exe
                                • Path C:\Program Files\7-Zip\7zG.exe
                                • Size 1.2MB
                                • SHA256 148e6b5396277535d64b1fd9e5b20b9f8a8d16c5a13d3781b4642c4789609a5d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Uninstall.exe
                                • Path C:\Program Files\7-Zip\Uninstall.exe
                                • Size 1.2MB
                                • SHA256 b548a9181ec3ea40602e331aa2bfa3380e1ff2b14cbe2b42c399fa78ffce9724
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                AppVShNotify.exe
                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                • Size 1.5MB
                                • SHA256 b5cdf08721b87034d85547b2296020301668d00127c804f9424c901e9a0656df
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                IntegratedOffice.exe
                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                • Size 4.6MB
                                • SHA256 a4f2faea5dc1a4a4cd90546cf57ff4a5630ee3b75bbb7eeb3591e8dc64a422d9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MavInject32.exe
                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                • Size 1.6MB
                                • SHA256 f064d01274cd6025442fc5cd9b71bdaba77d59826ef6e6d0ddc57898acde4e6a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                OfficeC2RClient.exe
                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                • Size 24.0MB
                                • SHA256 b5b269c41ac241de72202592172e36b0d7e74ae4c506fdb7bcf8b976fc29a3fa
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                appvcleaner.exe
                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                • Size 2.7MB
                                • SHA256 6b99bad7d81028194013403cd48d2086323943dad58deb6be36031efea2bc6c1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                LICLUA.EXE
                                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                • Size 1.1MB
                                • SHA256 07ecfcc90c79bb81a4875ac5419cb917db0afadc31c95a298c25a8af620325e3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                OSE.EXE
                                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                • Size 1.5MB
                                • SHA256 b76ac5620e407de0be42fc98c172f233aaca4794ef1d77261ebe8376f89e0f6d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                VSTOInstaller.exe
                                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                • Size 1.3MB
                                • SHA256 cf28191b1f287317b8d0684489f93a2d6087cb1672f39c3fc1e4c105252bd623
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                chrmstp.exe
                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                                • Size 6.6MB
                                • SHA256 34c64f8ac212091908bd8a8e53658202d3e7914bdf6397008293281dd517c9cc
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                setup.exe
                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                                • Size 6.6MB
                                • SHA256 a2957aedcaa8e38258fda0057c086aa82d4ffdabf3e84fd7759817e6ec617bbf
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                chrome_pwa_launcher.exe
                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                                • Size 2.3MB
                                • SHA256 6bab2f98c6f6a824d804b57e4b49a4b1252e55c831a069719c34ff0ecf53899d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                elevated_tracing_service.exe
                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                                • Size 4.0MB
                                • SHA256 31de7a4d7cad3b3b6690173ec06f350f66608abc2d2a141f0f19e43879c311ef
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                elevation_service.exe
                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                • Size 2.8MB
                                • SHA256 5035fd3d3f7c04a2ddb1d79a0a5f68e697653c5e258ccf636c9682c9cdd5eba8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                notification_helper.exe
                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                                • Size 2.2MB
                                • SHA256 12ae34acea6a435ff146a94ba23b0cd3414299492d028a506089ac16fdfa0270
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                os_update_handler.exe
                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                                • Size 2.4MB
                                • SHA256 8464a789c04530a125ba7894c053257d6b1f7b6534d532cad6e1f63632483699
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                chrome_proxy.exe
                                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                                • Size 2.0MB
                                • SHA256 3f0e2e566db21775c025f2e191a0b87f73e181ed6dbd3aa4b0fff6616e011fbc
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                appletviewer.exe
                                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                                • Size 1.2MB
                                • SHA256 b146d3ade709e895040263cffe34ceddf8c26877092f62abebf8ec1ed22c5532
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                extcheck.exe
                                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                                • Size 1.2MB
                                • SHA256 6d65df52be1360adb6e88db60883ac7d2b013ddaef36eb52f7f0d57a97a2dbef
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                idlj.exe
                                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                                • Size 1.2MB
                                • SHA256 425bfbc2770c4d5ad2d63b94d090d3b04e4e774be573b0993581ab94117698a1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                jabswitch.exe
                                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                                • Size 1.3MB
                                • SHA256 24ddf92e085442bac6da84e25a11074c0a01dc538c12f4b202e2b4d73db2f387
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                jar.exe
                                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                                • Size 1.2MB
                                • SHA256 dc8fd3b8d56ce1c944da369e52cd3bc166da7a026e839a0e21ddaba6ac0cbd65
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                wmpnetwk.exe
                                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                • Size 1.5MB
                                • SHA256 2d21d23a80f8bc7e562da7980c1a182e28e745fd84828af2313e54f70820296f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                manifest.fingerprint
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2684_1559572454\manifest.fingerprint
                                • Size 66B
                                • SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                manifest.json
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2684_1559572454\manifest.json
                                • Size 135B
                                • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                dotnet.exe
                                • Path C:\Program Files\dotnet\dotnet.exe
                                • Size 1.4MB
                                • SHA256 a5fb0efaba33fc4f196815728d28f56cb379184818340b6e3d1c68cb4f38d22d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                WinRAR.lnk
                                • Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
                                • Size 1KB
                                • SHA256 e22a94be16e7d92f9fa67e38ccdde8b12a3faeacae557e18dd8e8fae31a2f030
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                protocols.json
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                • Size 3KB
                                • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                                • Size 280B
                                • SHA256 4b4b886a050b45852a68dddc4ad14ceb1acf1e872297b2e703080648cd168a4c
                                • MD5 SHA1 SHA512
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                                • Size 280B
                                • SHA256 3cb31e42f6cfcbc04d08af8f810cd659c2d23cd2458d202f2bcebeb00ae19f53
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                throttle_store.dat
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
                                • Size 20B
                                • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                • MD5 SHA1 SHA512
                                Submit Download

                                data_0
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
                                • Size 8KB
                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_1
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
                                • Size 264KB
                                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_2
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
                                • Size 8KB
                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_3
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
                                • Size 8KB
                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                MANIFEST-000001
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
                                • Size 41B
                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                • MD5 SHA1 SHA512
                                Submit Download

                                Network Persistent State
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State
                                • Size 111B
                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Network Persistent State~RFe59b963.TMP
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe59b963.TMP
                                • Size 59B
                                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                SCT Auditing Pending Reports
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                • Size 2B
                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                • MD5 SHA1 SHA512
                                Submit Download

                                TransportSecurity
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                • Size 188B
                                • SHA256 2e725d33167d47d84407cd56eca7ff4cc943896645bc036a7fa29dda268e0a7f
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                TransportSecurity~RFe59361a.TMP
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\TransportSecurity~RFe59361a.TMP
                                • Size 188B
                                • SHA256 d6919e87b51adc1d76c81132f57e545fe973691ff243f8f89a6f999e93cb8b6b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
                                • Size 6KB
                                • SHA256 a4a4d904755d5ebdc721d563fe789cb4548937bc3a0db67b1660588871b2cbc5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Preferences~RFe592fd0.TMP
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences~RFe592fd0.TMP
                                • Size 5KB
                                • SHA256 74655df7ea0360e6db7331ade8de7c8f3d7a642712548c4e6df0f0d52a8eb36a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CURRENT
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
                                • Size 16B
                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                • MD5 SHA1 SHA512
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                • Size 1KB
                                • SHA256 2278f828370a2ab2cd0affadba4397776cebfc0637bd0b13ea4f8e660adf71a3
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                • Size 2KB
                                • SHA256 5ce79debb03ce969dc1112914ee26e1c342bb638345eaf40e09ba0be9a361761
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                • Size 3KB
                                • SHA256 c34c07266e35680c8fc8806e52da9fbca43ca5963eda33fd15da175bad0759e5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                • Size 4KB
                                • SHA256 9333219eec2083399e0842e7f142444593a5c1bac33f1c642dce5f7c85e4b684
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                • Size 16KB
                                • SHA256 7039bfb41a776d3f54f632a0a75619309810ac94360e0ffde0707167658acace
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State~RFe5890b2.TMP
                                • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State~RFe5890b2.TMP
                                • Size 1KB
                                • SHA256 6c5fd3a9379d31ecda7aa80e67bdd323aa8f593109eae6ef9b36c182d74e3d80
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                perfhost.exe
                                • Path C:\Windows\SysWOW64\perfhost.exe
                                • Size 1.2MB
                                • SHA256 d74c812c805050da1bf8934662cf1911b7a86823eed9c62be579a1c3081ae919
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                AgentService.exe
                                • Path C:\Windows\System32\AgentService.exe
                                • Size 1.7MB
                                • SHA256 23f6bd490f6799f66552b0301a22f3b7049234c80e31e8ee9546a09f8286deb2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                DiagnosticsHub.StandardCollector.Service.exe
                                • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                • Size 1.3MB
                                • SHA256 e04e12e2e46fda6e75a2a88418a165dfa0d821d3670425c1e2665ef931ced653
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                FXSSVC.exe
                                • Path C:\Windows\System32\FXSSVC.exe
                                • Size 1.2MB
                                • SHA256 63bd9f94158c29e286c5b15cfa975ba35212f2c88b4d57fcf36da0109263e59d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Locator.exe
                                • Path C:\Windows\System32\Locator.exe
                                • Size 1.2MB
                                • SHA256 51490c408d8673d1a9a89e44277b655b73c7987938baf5dc2a1c48967db8c34b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ssh-agent.exe
                                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                • Size 1.6MB
                                • SHA256 6538c282695198c899c49fe795e151ede2ea086365f4b87a6b9f6b68c68d21a9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                PerceptionSimulationService.exe
                                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                • Size 1.3MB
                                • SHA256 d31c7ed38ab2e0cfaf04ca37c10dbfaba1904e87c8b776bd251f3dacdb6a6333
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                SearchIndexer.exe
                                • Path C:\Windows\System32\SearchIndexer.exe
                                • Size 1.4MB
                                • SHA256 c85a8de96c712fbedd28dc11f809eda287fef5b5821d6a365c958949501ae5de
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                SensorDataService.exe
                                • Path C:\Windows\System32\SensorDataService.exe
                                • Size 1.8MB
                                • SHA256 f6ee1b3a6dcf91c05a4cbb74131470bec129bb54a9edd3421a55014b49817fb5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Spectrum.exe
                                • Path C:\Windows\System32\Spectrum.exe
                                • Size 1.4MB
                                • SHA256 639c25c91796c8dfbcd43d087d9405253081268278972b526fd0074d674a8713
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                TieringEngineService.exe
                                • Path C:\Windows\System32\TieringEngineService.exe
                                • Size 1.5MB
                                • SHA256 139a1b4946d9b9d5e164b6f71876166afb4906cbd7ba9975c4a984a2cb621dc0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                VSSVC.exe
                                • Path C:\Windows\System32\VSSVC.exe
                                • Size 2.0MB
                                • SHA256 9957ea1fdedefccc26a53db88e51b4478aeae1002071e9760ed742eaed4bc611
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                alg.exe
                                • Path C:\Windows\System32\alg.exe
                                • Size 1.3MB
                                • SHA256 94343a9afe98ba6785270ea2b513e039995ab972521b03fcaeab2c0e195a0942
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                msdtc.exe
                                • Path C:\Windows\System32\msdtc.exe
                                • Size 1.4MB
                                • SHA256 18dd181e75fa30e589f9644fc8b8276d3c84756e780e2489d82b7bbd1670220f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                snmptrap.exe
                                • Path C:\Windows\System32\snmptrap.exe
                                • Size 1.2MB
                                • SHA256 86b03855cbfdb4a26ddae28d89c64b9bfd5c5600d19444cfc708ab3f8f8351e3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                vds.exe
                                • Path C:\Windows\System32\vds.exe
                                • Size 1.3MB
                                • SHA256 179bdcb7f78502fc69d3b6a0ccb6b26e90b21a7b3e69b8e888365d3e968c737b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                WmiApSrv.exe
                                • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                • Size 1.4MB
                                • SHA256 1891de4c3120d48abd99570d50fa458257afabdf29ebac0c622793bb3b25d9a3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                wbengine.exe
                                • Path C:\Windows\System32\wbengine.exe
                                • Size 2.1MB
                                • SHA256 e46483bf3675711dac19f28d185331dde26fbbef19a5998e37bba829a9dfc7fc
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                AppVClient.exe
                                • Path C:\Windows\system32\AppVClient.exe
                                • Size 1.3MB
                                • SHA256 0d680e53353c3538fa8e20bd1873e85463a1cd931e181540dc371e106a1be7e1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                SgrmBroker.exe
                                • Path C:\Windows\system32\SgrmBroker.exe
                                • Size 1.5MB
                                • SHA256 e6a2f6441073b178c359905d8370ffbd4cd3c4e1d41c5bdc6387626c2d3658c9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                msiexec.exe
                                • Path C:\Windows\system32\msiexec.exe
                                • Size 1.3MB
                                • SHA256 fa095acaac1f9ae304cae9ee82fb3cec68c7b17c951c48d312efc285922dd54b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                memory/736-61-0x0000000140000000-0x00000001402D4000-memory.dmp
                                Download

                                memory/736-50-0x0000000000890000-0x00000000008F0000-memory.dmp
                                Download

                                memory/736-44-0x0000000000890000-0x00000000008F0000-memory.dmp
                                Download

                                memory/736-133-0x0000000140000000-0x00000001402D4000-memory.dmp
                                Download

                                memory/996-78-0x00000000007F0000-0x0000000000850000-memory.dmp
                                Download

                                memory/996-77-0x0000000140000000-0x000000014017A000-memory.dmp
                                Download

                                memory/996-84-0x00000000007F0000-0x0000000000850000-memory.dmp
                                Download

                                memory/996-157-0x0000000140000000-0x000000014017A000-memory.dmp
                                Download

                                memory/1392-158-0x0000000140000000-0x0000000140147000-memory.dmp
                                Download

                                memory/1392-367-0x0000000140000000-0x0000000140147000-memory.dmp
                                Download

                                memory/1560-134-0x0000000140000000-0x0000000140169000-memory.dmp
                                Download

                                memory/1560-334-0x0000000140000000-0x0000000140169000-memory.dmp
                                Download

                                memory/1560-125-0x00000000006D0000-0x0000000000730000-memory.dmp
                                Download

                                memory/1560-131-0x00000000006D0000-0x0000000000730000-memory.dmp
                                Download

                                memory/1692-154-0x0000000140000000-0x00000001401C0000-memory.dmp
                                Download

                                memory/1692-152-0x0000000140000000-0x00000001401C0000-memory.dmp
                                Download

                                memory/2116-371-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-369-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-374-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-378-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-381-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-382-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-383-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-380-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-379-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-377-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-376-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-375-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-609-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-372-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-373-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-606-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-370-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-577-0x000001C5D84E0000-0x000001C5DA3B7000-memory.dmp
                                Download

                                memory/2116-604-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-368-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-601-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-602-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-603-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-600-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-599-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-598-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-608-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-611-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-610-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-615-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-614-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-613-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-612-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-605-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2116-607-0x000001C5DA3F0000-0x000001C5DA400000-memory.dmp
                                Download

                                memory/2132-27-0x0000000000660000-0x00000000006C0000-memory.dmp
                                Download

                                memory/2132-111-0x0000000140000000-0x0000000140154000-memory.dmp
                                Download

                                memory/2132-18-0x0000000000660000-0x00000000006C0000-memory.dmp
                                Download

                                memory/2132-26-0x0000000140000000-0x0000000140154000-memory.dmp
                                Download

                                memory/2464-103-0x00000000005D0000-0x0000000000636000-memory.dmp
                                Download

                                memory/2464-108-0x00000000005D0000-0x0000000000636000-memory.dmp
                                Download

                                memory/2464-112-0x0000000000400000-0x0000000000542000-memory.dmp
                                Download

                                memory/2464-165-0x0000000000400000-0x0000000000542000-memory.dmp
                                Download

                                memory/2488-115-0x0000000140000000-0x0000000140140000-memory.dmp
                                Download

                                memory/2488-169-0x0000000140000000-0x0000000140140000-memory.dmp
                                Download

                                memory/2960-31-0x0000000140000000-0x0000000140135000-memory.dmp
                                Download

                                memory/2960-70-0x0000000140000000-0x0000000140135000-memory.dmp
                                Download

                                memory/3092-122-0x0000000140000000-0x0000000140141000-memory.dmp
                                Download

                                memory/3092-268-0x0000000140000000-0x0000000140141000-memory.dmp
                                Download

                                memory/3240-173-0x0000000140000000-0x00000001401D7000-memory.dmp
                                Download

                                memory/3240-117-0x0000000140000000-0x00000001401D7000-memory.dmp
                                Download

                                memory/3240-330-0x0000000140000000-0x00000001401D7000-memory.dmp
                                Download

                                memory/3256-145-0x0000000000C80000-0x0000000000CE0000-memory.dmp
                                Download

                                memory/3256-144-0x0000000140000000-0x00000001401AD000-memory.dmp
                                Download

                                memory/3256-138-0x0000000000C80000-0x0000000000CE0000-memory.dmp
                                Download

                                memory/3256-349-0x0000000140000000-0x00000001401AD000-memory.dmp
                                Download

                                memory/3444-88-0x0000000000B60000-0x0000000000BC0000-memory.dmp
                                Download

                                memory/3444-160-0x0000000140000000-0x0000000140156000-memory.dmp
                                Download

                                memory/3444-97-0x0000000140000000-0x0000000140156000-memory.dmp
                                Download

                                memory/3444-94-0x0000000000B60000-0x0000000000BC0000-memory.dmp
                                Download

                                memory/3564-75-0x0000000140000000-0x0000000140164000-memory.dmp
                                Download

                                memory/3808-40-0x0000000000440000-0x00000000004A0000-memory.dmp
                                Download

                                memory/3808-121-0x0000000140000000-0x00000001402E9000-memory.dmp
                                Download

                                memory/3808-34-0x0000000000440000-0x00000000004A0000-memory.dmp
                                Download

                                memory/3808-52-0x0000000140000000-0x00000001402E9000-memory.dmp
                                Download

                                memory/4004-166-0x0000000140000000-0x0000000140216000-memory.dmp
                                Download

                                memory/4004-392-0x0000000140000000-0x0000000140216000-memory.dmp
                                Download

                                memory/4332-64-0x0000000140000000-0x0000000140180000-memory.dmp
                                Download

                                memory/4332-62-0x0000000001A80000-0x0000000001AE0000-memory.dmp
                                Download

                                memory/4332-69-0x0000000140000000-0x0000000140180000-memory.dmp
                                Download

                                memory/4332-67-0x0000000001A80000-0x0000000001AE0000-memory.dmp
                                Download

                                memory/4332-55-0x0000000001A80000-0x0000000001AE0000-memory.dmp
                                Download

                                memory/4404-150-0x0000000140000000-0x000000014018D000-memory.dmp
                                Download

                                memory/4404-364-0x0000000140000000-0x000000014018D000-memory.dmp
                                Download

                                memory/4508-189-0x0000000001780000-0x0000000001790000-memory.dmp
                                Download

                                memory/4508-365-0x000000000C950000-0x000000000C958000-memory.dmp
                                Download

                                memory/4508-576-0x0000000140000000-0x0000000140179000-memory.dmp
                                Download

                                memory/4508-174-0x0000000140000000-0x0000000140179000-memory.dmp
                                Download

                                memory/4508-205-0x0000000001A20000-0x0000000001A30000-memory.dmp
                                Download

                                memory/4508-231-0x0000000009E60000-0x0000000009E68000-memory.dmp
                                Download

                                memory/4652-170-0x0000000140000000-0x0000000140171000-memory.dmp
                                Download

                                memory/4652-492-0x0000000140000000-0x0000000140171000-memory.dmp
                                Download

                                memory/4944-9-0x0000000001ED0000-0x0000000001F30000-memory.dmp
                                Download

                                memory/4944-8-0x0000000140000000-0x0000000140405000-memory.dmp
                                Download

                                memory/4944-73-0x0000000140000000-0x0000000140405000-memory.dmp
                                Download

                                memory/4944-0-0x0000000001ED0000-0x0000000001F30000-memory.dmp
                                Download

                                memory/4956-14-0x0000000140000000-0x0000000140155000-memory.dmp
                                Download

                                memory/4956-102-0x0000000140000000-0x0000000140155000-memory.dmp
                                Download

                                memory/5072-161-0x0000000140000000-0x00000001401FC000-memory.dmp
                                Download

                                memory/5072-385-0x0000000140000000-0x00000001401FC000-memory.dmp
                                Download

                                memory/5192-592-0x000001E33CE40000-0x000001E33CEDB000-memory.dmp
                                Download

                                memory/5192-412-0x00007FFBFDA80000-0x00007FFBFDA81000-memory.dmp
                                Download

                                memory/5316-480-0x00007FFBFF930000-0x00007FFBFF931000-memory.dmp
                                Download

                                memory/5316-479-0x00007FFBFF8F0000-0x00007FFBFF8F1000-memory.dmp
                                Download

                                memory/5828-597-0x000002BDB17A0000-0x000002BDB183B000-memory.dmp
                                Download

                                memory/5828-515-0x00007FFBFDA80000-0x00007FFBFDA81000-memory.dmp
                                Download