Overview

overview

7

Static

static

3

2026-05-28...ar.exe

windows10-2004-x64

7

2026-05-28...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/05/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  • Size 3.7MB
  • Sample260528-e7vdyaft7q
  • SHA256 2485b6e2a52b79f19da77ce942f94b17d5cfe17d43388a6f686c0778a8fac911
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 35 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4736.4612.5469518772692496356
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:5064
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff95610b078,0x7ff95610b084,0x7ff95610b090
        3⤵
          PID:2692
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1664,i,11032737801974063761,12121902293668745202,262144 --variations-seed-version --mojo-platform-channel-handle=1652 /prefetch:2
          3⤵
            PID:3652
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1964,i,11032737801974063761,12121902293668745202,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:11
            3⤵
              PID:2136
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2244,i,11032737801974063761,12121902293668745202,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:13
              3⤵
                PID:664
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3396,i,11032737801974063761,12121902293668745202,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
                3⤵
                  PID:3460
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=312,i,11032737801974063761,12121902293668745202,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
                  3⤵
                    PID:1124
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4368,i,11032737801974063761,12121902293668745202,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
                    3⤵
                      PID:2436
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4504,i,11032737801974063761,12121902293668745202,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
                      3⤵
                        PID:760
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4976,i,11032737801974063761,12121902293668745202,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
                        3⤵
                          PID:1244
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4372,i,11032737801974063761,12121902293668745202,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
                          3⤵
                            PID:3064
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4932,i,11032737801974063761,12121902293668745202,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:10
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1992
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-28_b7aba458ebcb5ee002459b1a3e28f86a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4548,i,11032737801974063761,12121902293668745202,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
                            3⤵
                              PID:1132
                        • C:\Windows\System32\alg.exe
                          C:\Windows\System32\alg.exe
                          1⤵
                          • Executes dropped EXE
                          PID:2064
                        • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                          C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                          1⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4232
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                          1⤵
                            PID:2712
                          • C:\Windows\system32\fxssvc.exe
                            C:\Windows\system32\fxssvc.exe
                            1⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5024
                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:4460
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:1216
                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:2520
                          • C:\Windows\System32\msdtc.exe
                            C:\Windows\System32\msdtc.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            PID:2036
                          • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                            "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                            1⤵
                            • Executes dropped EXE
                            PID:2584
                          • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                            C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                            1⤵
                            • Executes dropped EXE
                            PID:3224
                          • C:\Windows\SysWow64\perfhost.exe
                            C:\Windows\SysWow64\perfhost.exe
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:4944
                          • C:\Windows\system32\locator.exe
                            C:\Windows\system32\locator.exe
                            1⤵
                            • Executes dropped EXE
                            PID:4404
                          • C:\Windows\System32\SensorDataService.exe
                            C:\Windows\System32\SensorDataService.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Checks SCSI registry key(s)
                            PID:4516
                          • C:\Windows\System32\snmptrap.exe
                            C:\Windows\System32\snmptrap.exe
                            1⤵
                            • Executes dropped EXE
                            PID:412
                          • C:\Windows\system32\spectrum.exe
                            C:\Windows\system32\spectrum.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Checks SCSI registry key(s)
                            PID:1884
                          • C:\Windows\System32\OpenSSH\ssh-agent.exe
                            C:\Windows\System32\OpenSSH\ssh-agent.exe
                            1⤵
                            • Executes dropped EXE
                            PID:4592
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                            1⤵
                              PID:4012
                            • C:\Windows\system32\TieringEngineService.exe
                              C:\Windows\system32\TieringEngineService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks processor information in registry
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1196
                            • C:\Windows\system32\AgentService.exe
                              C:\Windows\system32\AgentService.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4480
                            • C:\Windows\System32\vds.exe
                              C:\Windows\System32\vds.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3200
                            • C:\Windows\system32\vssvc.exe
                              C:\Windows\system32\vssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4408
                            • C:\Windows\system32\wbengine.exe
                              "C:\Windows\system32\wbengine.exe"
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1976
                            • C:\Windows\system32\wbem\WmiApSrv.exe
                              C:\Windows\system32\wbem\WmiApSrv.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2656
                            • C:\Windows\system32\SearchIndexer.exe
                              C:\Windows\system32\SearchIndexer.exe /Embedding
                              1⤵
                              • Executes dropped EXE
                              • Enumerates connected drives
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:1716
                              • C:\Windows\System32\SearchProtocolHost.exe
                                "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:4280
                              • C:\Windows\system32\SearchFilterHost.exe
                                "C:\Windows\system32\SearchFilterHost.exe" 944 2904 2864 928 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:2608
                              • C:\Windows\system32\SearchFilterHost.exe
                                "C:\Windows\system32\SearchFilterHost.exe" 944 2888 2892 928 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:5032

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  elevation_service.exe
                                  • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                  • Size 2.7MB
                                  • SHA256 8f4fa672c4cf936ff2c9f445add8f1704a1dcc7961f9536f0ceb163491bfae67
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  maintenanceservice.exe
                                  • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                  • Size 1.5MB
                                  • SHA256 6ca3bf2a54d39ee1aefe90cfef3f1219d30634a7c12b38961580ced3283bc775
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  7z.exe
                                  • Path C:\Program Files\7-Zip\7z.exe
                                  • Size 1.8MB
                                  • SHA256 e2cc63a3dee4f0734bf68aa031489770e0933ff61a1780b811f0e5a63685f9e9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  7zFM.exe
                                  • Path C:\Program Files\7-Zip\7zFM.exe
                                  • Size 1.5MB
                                  • SHA256 6022fb614e82340beb24fd6c5ff1b6e2ef98ebebac3e2495c5cf0a096f668d26
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  7zG.exe
                                  • Path C:\Program Files\7-Zip\7zG.exe
                                  • Size 1.2MB
                                  • SHA256 df89d4d2258c1dc76218757081dff1f43f7c4ed5b0e5cf53cd5f8a0b5beed885
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Uninstall.exe
                                  • Path C:\Program Files\7-Zip\Uninstall.exe
                                  • Size 1.2MB
                                  • SHA256 3b790a55c204bf8ee001e4c32c75ead1ac38df851a9d97680e4a23063ab51549
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  AppVShNotify.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                  • Size 1.5MB
                                  • SHA256 2df336f56cbaf8688d73c1e47e6b5fed30123c8d82aa78f58205655e18426a68
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  IntegratedOffice.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                  • Size 4.6MB
                                  • SHA256 938ee63913fcb19fb716a70095c87f54bbf7336a83b6db12a4fda37b9c492ff8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  MavInject32.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                  • Size 1.6MB
                                  • SHA256 5ad6395d1e1388ffc70305365dc753f6e629064df5dbe86817ac2d2e1c438edf
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  OfficeC2RClient.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                  • Size 24.0MB
                                  • SHA256 fcbaefbec5c2cdaf8654f4b74329df1846a12e173dc2037db000badba30b0dba
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  appvcleaner.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                  • Size 2.7MB
                                  • SHA256 2325a6c7934818f0d465a866619af156597cadc0d64e13598dd90cbc6bbbfaa9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  LICLUA.EXE
                                  • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                  • Size 1.1MB
                                  • SHA256 dcdcc3e11ac772035122dbadd9214bc26c5685cbd56dd57288347f15c2053db2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  OSE.EXE
                                  • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                  • Size 1.5MB
                                  • SHA256 ac08170c0c88bff696c9b14aa31698562cd195b9364ec5c3a43c70a0a2ece0be
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  VSTOInstaller.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                  • Size 1.3MB
                                  • SHA256 f03c85ee1af0fd67d3571864bc52b4d59125f1b9a87c7840facc0cef44821d3c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  chrmstp.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                                  • Size 6.6MB
                                  • SHA256 d88d86c781b15a37134d2cdc1347c45f1aa2be88a6cf4baf35a24c3a869c8030
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  setup.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                                  • Size 6.6MB
                                  • SHA256 e71b6df7f40229ce93f273f23a7704d0e7ea9a33742c75fa1be79f4ac93726a6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  chrome_pwa_launcher.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                                  • Size 2.3MB
                                  • SHA256 1ee39cc407f173e9ab711d6d13662a8cecff8bbe34db31169d29e4858eaa8abb
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  elevated_tracing_service.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                                  • Size 4.0MB
                                  • SHA256 8706e767d09b51f5d4e175eaa90a61a81edd5ea0b0a8df360a86c42bd89fdb4f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  elevation_service.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                  • Size 2.8MB
                                  • SHA256 ee885c0d9b29575f1abc9567292c0ae2b6cb16b06c03ed885e96695b0bf6afbd
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  notification_helper.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                                  • Size 2.2MB
                                  • SHA256 d5b9032afd11e7317486c2f387d4cd372cc847b43c7417c91d591536e02b4815
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  os_update_handler.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                                  • Size 2.4MB
                                  • SHA256 3308dfedecc4fc35d96a2ea5b3a5148e2946f40c2f2f13e7bc9c9ba61fb7fd2a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  chrome_proxy.exe
                                  • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                                  • Size 2.0MB
                                  • SHA256 e2c5630d2bd78614bef59b9b8e8bc9a60b66df1c45a03b4ed3c06a854ee9bec8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  appletviewer.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                                  • Size 1.2MB
                                  • SHA256 fbd93d28c208942f762926e06e8be6927ce9400aa23365ec227c8ee0c6d3c914
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  extcheck.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                                  • Size 1.2MB
                                  • SHA256 210d369be6e904e9c5ae0a09f09db98b42448a59650ef51b5019201cec23eee5
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  idlj.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                                  • Size 1.2MB
                                  • SHA256 3efad03cffbdccb3ca4eb68747f13379621a3df42b0eaaa3e803176886b7bc63
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  jabswitch.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                                  • Size 1.3MB
                                  • SHA256 68072651bd94301376e3c7768921c0d0f308a4fcbf74c57c7131478e4e052dc6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  jar.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                                  • Size 1.2MB
                                  • SHA256 a0cbf356a5664cfdfbff06f6566cba76ca39a643e0c202b7771d2c98e4d5f2d3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  wmpnetwk.exe
                                  • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                  • Size 1.5MB
                                  • SHA256 0b4ff208a42f3f7a70dc4abe117831a155764320dbcff0bc2b73e97893147475
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  dotnet.exe
                                  • Path C:\Program Files\dotnet\dotnet.exe
                                  • Size 1.4MB
                                  • SHA256 44ce8be31e31aa5133263b28c4ceb5a9af1f40dc2c9606d5615956b4da3a4d9d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                                  • Size 280B
                                  • SHA256 6943b9239e923989a6ab6b8000715dc9d1539b5db4297acaea0b56e16c466d8e
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                                  • Size 280B
                                  • SHA256 e4440c755b36c86727729e61b04b35c89b41fe88a62928f5311b519426f71112
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  throttle_store.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
                                  • Size 20B
                                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  index
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnGraphiteCache\index
                                  • Size 256KB
                                  • SHA256 d70463213326cb7724c87a3796fc5c09032fce70ee117055dd70174e81d62b43
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  MANIFEST-000001
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
                                  • Size 41B
                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Network Persistent State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State
                                  • Size 111B
                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Network Persistent State~RFe597a85.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe597a85.TMP
                                  • Size 59B
                                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  SCT Auditing Pending Reports
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  TransportSecurity
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                  • Size 188B
                                  • SHA256 e3e4091aa164a4c0e9172513bb2ae072d7b71d83c069db8a795f9ab0cd70b371
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  TransportSecurity~RFe58f75b.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\TransportSecurity~RFe58f75b.TMP
                                  • Size 188B
                                  • SHA256 b8086ca61835c8e84474c48144b9316e15c70ccb60503d2df4198bbff2e6b5d7
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
                                  • Size 6KB
                                  • SHA256 502027224266b9c0c405cbdd813efd8f76f6eeb958362adfa7f9d00a7a6dc3b9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences~RFe58f1be.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences~RFe58f1be.TMP
                                  • Size 5KB
                                  • SHA256 005a22fcd6ea58e5fa47aa41ae915454c20c54fa9e0830c8756b66dfc8d45bab
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  CURRENT
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
                                  • Size 16B
                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  data_0
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_0
                                  • Size 8KB
                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_1
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_1
                                  • Size 264KB
                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_2
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_2
                                  • Size 8KB
                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_3
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_3
                                  • Size 8KB
                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 1KB
                                  • SHA256 3007bb90817bfb3aedec36315d932da10f29d261aa274c8f59cbdcf57324856f
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 2KB
                                  • SHA256 60fb0add0d3156ac2d8fe8f2ca72744b052df0634b7e4e223e802c9341fc0867
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 3KB
                                  • SHA256 04e99b7f8eb92a0ac08597fd0c71a7064ca3c4fa0251141d5c7f93e0bd8e79b8
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 4KB
                                  • SHA256 9c46107e83546e64881009d99745d2dc2fd3fe81acff5cc58f1c48b834812adc
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 16KB
                                  • SHA256 956ebbf1d331e998a5c06d2703666dba1c4e806e61515a1603f4fc4ed87bddea
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Local State~RFe58530d.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State~RFe58530d.TMP
                                  • Size 1KB
                                  • SHA256 cc73611db6e020be5c21a5c85445a56611aac03ea83ef260dd864943f5a9c254
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  perfhost.exe
                                  • Path C:\Windows\SysWOW64\perfhost.exe
                                  • Size 1.2MB
                                  • SHA256 663eca485b02b2762f51d93354c36b66fca3b9d00b56f24160e01a1f5a30a7c7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  AgentService.exe
                                  • Path C:\Windows\System32\AgentService.exe
                                  • Size 1.7MB
                                  • SHA256 b3d9eff993abb9bd5248b98136060c4a8669973691139d25f4bf757ccf8c37f5
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  DiagnosticsHub.StandardCollector.Service.exe
                                  • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                  • Size 1.3MB
                                  • SHA256 07474141f1f1d8f3ee620a882440861238c006bdd9b7063ef6ce41136d5f0295
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  FXSSVC.exe
                                  • Path C:\Windows\System32\FXSSVC.exe
                                  • Size 1.2MB
                                  • SHA256 e6480318c1429d5046943c368b873c2ba1f9a30fdd92f6d4d0f0c6d48e7c317b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Locator.exe
                                  • Path C:\Windows\System32\Locator.exe
                                  • Size 1.2MB
                                  • SHA256 c968da7642186e8b2b4ab5e01d454047bb132a7f4e718ed4929f15e503ea7600
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ssh-agent.exe
                                  • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                  • Size 1.6MB
                                  • SHA256 cd7e46617d4b17af2c23715755fb11892851a54cd706bd6d075e46c900d5bcd2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  PerceptionSimulationService.exe
                                  • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                  • Size 1.4MB
                                  • SHA256 4a84d767c7ef3aa96326fdafcb3c8957f99869767f3f43ad892e5ea412ef97e2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  SearchIndexer.exe
                                  • Path C:\Windows\System32\SearchIndexer.exe
                                  • Size 1.4MB
                                  • SHA256 c0ce9e160ffd6136c8613332e3653a6fd0cabe9308a8f51826e5ac6e2fb1ba43
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  SensorDataService.exe
                                  • Path C:\Windows\System32\SensorDataService.exe
                                  • Size 1.7MB
                                  • SHA256 1c2649561fde4ada000c055855a352f773f39258f56d85682e1f4a76c77148e3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Spectrum.exe
                                  • Path C:\Windows\System32\Spectrum.exe
                                  • Size 1.3MB
                                  • SHA256 2e3dc9b2c98b95a9b0cca63997196cf0c00b487b8f88096fbf2ef95d21191dbf
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  TieringEngineService.exe
                                  • Path C:\Windows\System32\TieringEngineService.exe
                                  • Size 1.6MB
                                  • SHA256 2120992ff06578f14629c138629a8add189b7a9c2f008c6b71a3c9dfb33ec2f9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  VSSVC.exe
                                  • Path C:\Windows\System32\VSSVC.exe
                                  • Size 2.0MB
                                  • SHA256 a2300c7a94f6825dc47c439552cfa5a122dcd97c53b2a1df21b1a4d25837b110
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  alg.exe
                                  • Path C:\Windows\System32\alg.exe
                                  • Size 1.3MB
                                  • SHA256 182cc22af8ebd0f838c9a46b19a3598ea3c53a3d7de855655be79dc97201dac4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  msdtc.exe
                                  • Path C:\Windows\System32\msdtc.exe
                                  • Size 1.4MB
                                  • SHA256 2c9be9fbdb75bd5e69a067fad15fc75225f59d07f236ac68c77493a4a04fdf00
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  snmptrap.exe
                                  • Path C:\Windows\System32\snmptrap.exe
                                  • Size 1.3MB
                                  • SHA256 dc7181507da6a3e0670450507babdc6a475ecb695acf9d6022410ea0438e2e94
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  vds.exe
                                  • Path C:\Windows\System32\vds.exe
                                  • Size 1.3MB
                                  • SHA256 e9fc33fa3fd8b517ed36f453b52ec462d7c6084e7b752417ba56438af345aad9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  WmiApSrv.exe
                                  • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                  • Size 1.4MB
                                  • SHA256 08b47d2216ff1ad0885c404136a8c4b3dfe951c6dd564ce29c2442e48b5501ab
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  wbengine.exe
                                  • Path C:\Windows\System32\wbengine.exe
                                  • Size 2.1MB
                                  • SHA256 fedb11237e4ea88e2b577d9c80466498313bbf80ec2f5f49bb975c857d98f578
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  english_wikipedia.txt
                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1715191016\english_wikipedia.txt
                                  • Size 269KB
                                  • SHA256 ff105c5b6e65386cd0af95272607eca296c5b8b786c2f0bb4a9ffef20b4cd4f1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  manifest.json
                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1715191016\manifest.json
                                  • Size 69B
                                  • SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  AppVClient.exe
                                  • Path C:\Windows\system32\AppVClient.exe
                                  • Size 1.3MB
                                  • SHA256 9f111aadcf9d9d0db3994c2c70842699065723da2d2dddbfca2af8218c5981bf
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  SgrmBroker.exe
                                  • Path C:\Windows\system32\SgrmBroker.exe
                                  • Size 1.6MB
                                  • SHA256 31ca40f7add4c89c7802448dc8da7ee4024a46f9f2a0853ac9c5abeb0682b73e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  StructuredQuerySchema.bin
                                  • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
                                  • Size 414KB
                                  • SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  msiexec.exe
                                  • Path C:\Windows\system32\msiexec.exe
                                  • Size 1.4MB
                                  • SHA256 493495e5754ddc3c5891c9884c440a38bff9090b14e4c898cdc592e48f549460
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  memory/412-318-0x0000000140000000-0x0000000140143000-memory.dmp
                                  Download

                                  memory/412-121-0x0000000140000000-0x0000000140143000-memory.dmp
                                  Download

                                  memory/1196-153-0x0000000140000000-0x000000014018E000-memory.dmp
                                  Download

                                  memory/1196-558-0x0000000140000000-0x000000014018E000-memory.dmp
                                  Download

                                  memory/1216-150-0x0000000140000000-0x00000001402D4000-memory.dmp
                                  Download

                                  memory/1216-51-0x00000000008F0000-0x0000000000950000-memory.dmp
                                  Download

                                  memory/1216-54-0x0000000140000000-0x00000001402D4000-memory.dmp
                                  Download

                                  memory/1216-45-0x00000000008F0000-0x0000000000950000-memory.dmp
                                  Download

                                  memory/1716-579-0x0000000140000000-0x0000000140172000-memory.dmp
                                  Download

                                  memory/1716-581-0x000000000BE20000-0x000000000BE21000-memory.dmp
                                  Download

                                  memory/1716-376-0x0000000001EE0000-0x0000000001EF0000-memory.dmp
                                  Download

                                  memory/1716-360-0x0000000001C30000-0x0000000001C40000-memory.dmp
                                  Download

                                  memory/1716-580-0x000000000BE30000-0x000000000BE38000-memory.dmp
                                  Download

                                  memory/1716-320-0x0000000000910000-0x0000000000970000-memory.dmp
                                  Download

                                  memory/1716-306-0x0000000000910000-0x0000000000970000-memory.dmp
                                  Download

                                  memory/1716-398-0x000000000A520000-0x000000000A528000-memory.dmp
                                  Download

                                  memory/1716-583-0x000000000BE20000-0x000000000BE28000-memory.dmp
                                  Download

                                  memory/1716-319-0x0000000140000000-0x0000000140172000-memory.dmp
                                  Download

                                  memory/1884-135-0x0000000140000000-0x0000000140149000-memory.dmp
                                  Download

                                  memory/1884-128-0x0000000000780000-0x00000000007E0000-memory.dmp
                                  Download

                                  memory/1884-408-0x0000000140000000-0x0000000140149000-memory.dmp
                                  Download

                                  memory/1884-136-0x0000000000780000-0x00000000007E0000-memory.dmp
                                  Download

                                  memory/1976-253-0x0000000140000000-0x0000000140216000-memory.dmp
                                  Download

                                  memory/1976-562-0x0000000140000000-0x0000000140216000-memory.dmp
                                  Download

                                  memory/2036-73-0x0000000140000000-0x0000000140165000-memory.dmp
                                  Download

                                  memory/2064-15-0x0000000140000000-0x0000000140155000-memory.dmp
                                  Download

                                  memory/2064-98-0x0000000140000000-0x0000000140155000-memory.dmp
                                  Download

                                  memory/2520-71-0x0000000001AA0000-0x0000000001B00000-memory.dmp
                                  Download

                                  memory/2520-63-0x0000000001AA0000-0x0000000001B00000-memory.dmp
                                  Download

                                  memory/2520-57-0x0000000001AA0000-0x0000000001B00000-memory.dmp
                                  Download

                                  memory/2520-56-0x0000000140000000-0x0000000140180000-memory.dmp
                                  Download

                                  memory/2520-84-0x0000000140000000-0x0000000140180000-memory.dmp
                                  Download

                                  memory/2584-159-0x0000000140000000-0x000000014017A000-memory.dmp
                                  Download

                                  memory/2584-75-0x00000000007C0000-0x0000000000820000-memory.dmp
                                  Download

                                  memory/2584-81-0x00000000007C0000-0x0000000000820000-memory.dmp
                                  Download

                                  memory/2584-85-0x0000000140000000-0x000000014017A000-memory.dmp
                                  Download

                                  memory/2608-619-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-622-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-624-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-585-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-586-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-587-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-589-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-590-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-588-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-591-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-594-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-592-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-593-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-597-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-600-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-599-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-598-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-596-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-595-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-608-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-609-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-610-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-613-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-612-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-611-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-614-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-615-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-617-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-618-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-625-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-616-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-623-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-621-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2608-620-0x0000027563620000-0x0000027563630000-memory.dmp
                                  Download

                                  memory/2656-564-0x0000000140000000-0x000000014016D000-memory.dmp
                                  Download

                                  memory/2656-276-0x0000000140000000-0x000000014016D000-memory.dmp
                                  Download

                                  memory/3200-166-0x0000000140000000-0x0000000140147000-memory.dmp
                                  Download

                                  memory/3200-559-0x0000000140000000-0x0000000140147000-memory.dmp
                                  Download

                                  memory/3224-93-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                  Download

                                  memory/3224-165-0x0000000140000000-0x0000000140175000-memory.dmp
                                  Download

                                  memory/3224-87-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                  Download

                                  memory/3224-96-0x0000000140000000-0x0000000140175000-memory.dmp
                                  Download

                                  memory/3460-292-0x00007FF9750A0000-0x00007FF9750A1000-memory.dmp
                                  Download

                                  memory/3652-190-0x00007FF9750A0000-0x00007FF9750A1000-memory.dmp
                                  Download

                                  memory/4232-113-0x0000000140000000-0x0000000140155000-memory.dmp
                                  Download

                                  memory/4232-18-0x0000000000710000-0x0000000000770000-memory.dmp
                                  Download

                                  memory/4232-26-0x0000000140000000-0x0000000140155000-memory.dmp
                                  Download

                                  memory/4232-24-0x0000000000710000-0x0000000000770000-memory.dmp
                                  Download

                                  memory/4404-195-0x0000000140000000-0x0000000140141000-memory.dmp
                                  Download

                                  memory/4404-114-0x0000000140000000-0x0000000140141000-memory.dmp
                                  Download

                                  memory/4408-188-0x0000000140000000-0x00000001401F6000-memory.dmp
                                  Download

                                  memory/4408-561-0x0000000140000000-0x00000001401F6000-memory.dmp
                                  Download

                                  memory/4460-33-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                                  Download

                                  memory/4460-39-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                                  Download

                                  memory/4460-41-0x0000000140000000-0x00000001402E9000-memory.dmp
                                  Download

                                  memory/4460-134-0x0000000140000000-0x00000001402E9000-memory.dmp
                                  Download

                                  memory/4480-160-0x0000000140000000-0x00000001401AD000-memory.dmp
                                  Download

                                  memory/4480-161-0x0000000140000000-0x00000001401AD000-memory.dmp
                                  Download

                                  memory/4516-560-0x0000000140000000-0x00000001401C1000-memory.dmp
                                  Download

                                  memory/4516-263-0x0000000140000000-0x00000001401C1000-memory.dmp
                                  Download

                                  memory/4516-118-0x0000000140000000-0x00000001401C1000-memory.dmp
                                  Download

                                  memory/4592-519-0x0000000140000000-0x00000001401AD000-memory.dmp
                                  Download

                                  memory/4592-147-0x0000000000850000-0x00000000008B0000-memory.dmp
                                  Download

                                  memory/4592-151-0x0000000140000000-0x00000001401AD000-memory.dmp
                                  Download

                                  memory/4592-141-0x0000000000850000-0x00000000008B0000-memory.dmp
                                  Download

                                  memory/4736-8-0x0000000140000000-0x0000000140405000-memory.dmp
                                  Download

                                  memory/4736-9-0x0000000002120000-0x0000000002180000-memory.dmp
                                  Download

                                  memory/4736-70-0x0000000140000000-0x0000000140405000-memory.dmp
                                  Download

                                  memory/4736-0-0x0000000002120000-0x0000000002180000-memory.dmp
                                  Download

                                  memory/4944-107-0x0000000000400000-0x0000000000542000-memory.dmp
                                  Download

                                  memory/4944-99-0x0000000000760000-0x00000000007C6000-memory.dmp
                                  Download

                                  memory/4944-169-0x0000000000400000-0x0000000000542000-memory.dmp
                                  Download

                                  memory/4944-104-0x0000000000760000-0x00000000007C6000-memory.dmp
                                  Download

                                  memory/5024-30-0x0000000140000000-0x0000000140136000-memory.dmp
                                  Download

                                  memory/5024-44-0x0000000140000000-0x0000000140136000-memory.dmp
                                  Download