Overview

overview

10

Static

static

3

2026-06-25...ar.exe

windows10-2004-x64

7

2026-06-25...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 22:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-25_3e47308a864dbf1427ea4e8fabfc97b4_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_swisyn_vidar.exe
  • Size 3.9MB
  • Sample260629-2vw4bshs21
  • SHA256 b4fab4d71865dd96ab35d6defda1adc697326caf78ecfaf7dba71c5a77b4e4e9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 60 IoCs
  • Drops file in Windows directory 63 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-25_3e47308a864dbf1427ea4e8fabfc97b4_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_swisyn_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-25_3e47308a864dbf1427ea4e8fabfc97b4_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_swisyn_vidar.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1644
    • \??\c:\users\admin\appdata\local\temp\2026-06-25_3e47308a864dbf1427ea4e8fabfc97b4_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_swisyn_vidar.exe 
      c:\users\admin\appdata\local\temp\2026-06-25_3e47308a864dbf1427ea4e8fabfc97b4_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_swisyn_vidar.exe 
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Program Files\WinRAR\uninstall.exe
        "C:\Program Files\WinRAR\uninstall.exe" /setup
        3⤵
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5720
        • C:\Program Files\WinRAR\RarExtInstaller.exe
          "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
          4⤵
          • Executes dropped EXE
          PID:6104
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
          4⤵
            PID:4512
          • C:\Program Files\WinRAR\WinRAR.exe
            "C:\Program Files\WinRAR\WinRAR.exe"
            4⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Enumerates connected drives
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2200
            • C:\Program Files\WinRAR\RarExtInstaller.exe
              "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
              5⤵
              • Executes dropped EXE
              PID:5932
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WinRAR.exe --webview-exe-version=7.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2200.932.11096461308024560130 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
              5⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of WriteProcessMemory
              PID:4164
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb200e5fd8,0x7ffb200e5fe4,0x7ffb200e5ff0
                6⤵
                  PID:5912
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1720 --field-trial-handle=1724,i,10241749562173809827,11424027685034533051,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
                  6⤵
                    PID:4288
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=1984 --field-trial-handle=1724,i,10241749562173809827,11424027685034533051,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
                    6⤵
                      PID:4000
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2500 --field-trial-handle=1724,i,10241749562173809827,11424027685034533051,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
                      6⤵
                        PID:2644
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3320 --field-trial-handle=1724,i,10241749562173809827,11424027685034533051,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
                        6⤵
                          PID:240
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4124 --field-trial-handle=1724,i,10241749562173809827,11424027685034533051,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
                          6⤵
                            PID:4116
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3336 --field-trial-handle=1724,i,10241749562173809827,11424027685034533051,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
                            6⤵
                              PID:4580
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4304 --field-trial-handle=1724,i,10241749562173809827,11424027685034533051,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
                              6⤵
                                PID:4100
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2196 --field-trial-handle=1724,i,10241749562173809827,11424027685034533051,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
                                6⤵
                                  PID:2332
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=3444 --field-trial-handle=1724,i,10241749562173809827,11424027685034533051,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
                                  6⤵
                                    PID:4616
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1724,i,10241749562173809827,11424027685034533051,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
                                    6⤵
                                      PID:4200
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=WinRAR.exe --webview-exe-version=7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4872 --field-trial-handle=1724,i,10241749562173809827,11424027685034533051,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
                                      6⤵
                                        PID:6064
                              • C:\Windows\Resources\Themes\icsys.icn.exe
                                C:\Windows\Resources\Themes\icsys.icn.exe
                                2⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:3580
                                • \??\c:\windows\resources\themes\explorer.exe
                                  c:\windows\resources\themes\explorer.exe
                                  3⤵
                                  • Modifies visibility of hidden/system files in Explorer
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Drops file in System32 directory
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:5588
                                  • \??\c:\windows\resources\spoolsv.exe
                                    c:\windows\resources\spoolsv.exe SE
                                    4⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:1804
                                    • \??\c:\windows\resources\svchost.exe
                                      c:\windows\resources\svchost.exe
                                      5⤵
                                      • Modifies visibility of hidden/system files in Explorer
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Drops file in System32 directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: GetForegroundWindowSpam
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:5560
                                      • \??\c:\windows\resources\spoolsv.exe
                                        c:\windows\resources\spoolsv.exe PR
                                        6⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1036
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              1⤵
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of WriteProcessMemory
                              PID:5804
                              • C:\Windows\explorer.exe
                                explorer.exe /LOADSAVEDWINDOWS
                                2⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Enumerates connected drives
                                • Checks SCSI registry key(s)
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                PID:5372
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:1320
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                              1⤵
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:3596

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  2
                                  T1547

                                  Active Setup

                                  1
                                  T1547.014

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Event Triggered Execution

                                  2
                                  T1546

                                  Change Default File Association

                                  1
                                  T1546.001

                                  Component Object Model Hijacking

                                  1
                                  T1546.015

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  2
                                  T1547

                                  Active Setup

                                  1
                                  T1547.014

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Event Triggered Execution

                                  2
                                  T1546

                                  Change Default File Association

                                  1
                                  T1546.001

                                  Component Object Model Hijacking

                                  1
                                  T1546.015

                                  Defense Evasion

                                  Hide Artifacts

                                  1
                                  T1564

                                  Hidden Files and Directories

                                  1
                                  T1564.001

                                  Modify Registry

                                  5
                                  T1112

                                  Credential Access

                                  Discovery

                                  Network Share Discovery

                                  1
                                  T1135

                                  Peripheral Device Discovery

                                  2
                                  T1120

                                  Query Registry

                                  4
                                  T1012

                                  System Information Discovery

                                  5
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  Lateral Movement

                                  Collection

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  Rar.exe
                                  • Path C:\Program Files\WinRAR\Rar.exe
                                  • Size 744KB
                                  • SHA256 b61f5cd83d9f781e57d17a78ad421e04267dc99bd0a3ebeaa1fc07e271d9e07b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Rar.txt
                                  • Path C:\Program Files\WinRAR\Rar.txt
                                  • Size 105KB
                                  • SHA256 7511c100daa946175efc18082d1923518bf1bfc8c1a80ea0252af585fbe295b5
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  RarExtInstaller.exe
                                  • Path C:\Program Files\WinRAR\RarExtInstaller.exe
                                  • Size 181KB
                                  • SHA256 7d1240aabc797322bba0e42061202125293ebf82ad338f41b66a4ea6d5c4fa42
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  RarExtPackage.msix
                                  • Path C:\Program Files\WinRAR\RarExtPackage.msix
                                  • Size 23KB
                                  • SHA256 e81b33f2661ca239f9edd97c15cc9f5f5da429c0f3dfba3372a422d9a092086e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  UnRAR.exe
                                  • Path C:\Program Files\WinRAR\UnRAR.exe
                                  • Size 494KB
                                  • SHA256 d95bba20f04687b0b821d4fc0a17137db8b9eda5fe3fb34da319abefc45fe0d1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Uninstall.exe
                                  • Path C:\Program Files\WinRAR\Uninstall.exe
                                  • Size 477KB
                                  • SHA256 4d24274b446a85edf45270b606b2a9f789d16ab84714e745512051bd192faad4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  WhatsNew.txt
                                  • Path C:\Program Files\WinRAR\WhatsNew.txt
                                  • Size 43KB
                                  • SHA256 c13db7e2b3fb2430a10abf78efcc2a6fb0ca1dd7d18c9d7b28c09a41238d7157
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  WinRAR.chm
                                  • Path C:\Program Files\WinRAR\WinRAR.chm
                                  • Size 316KB
                                  • SHA256 0879cdd9d81b1cb319692dde76bf3a3c16369ddc33f006ffb199ed08d57bfa18
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  WinRAR.exe
                                  • Path C:\Program Files\WinRAR\WinRAR.exe
                                  • Size 3.1MB
                                  • SHA256 ddc4f274cdec3954acefb624ed3fc7a8f8c5fed767934bb028a85db62b781fb1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
                                  • Size 727B
                                  • SHA256 165ff380429e1df597376880934e5746565310e58745f0e8e50b0d93a0c55b95
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                  • Size 727B
                                  • SHA256 e416b89143bb8067811134a79f5a893accd4835bdccdb8ac00a1ade8df07fe0e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
                                  • Size 404B
                                  • SHA256 347b0141d7d874ec4b12433075d9e1158db7c56d8570a5d5cb1599ad24dc5f81
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                  • Size 412B
                                  • SHA256 193d103d586004ffe65d82e780abadbac3088bcd869d334c5b2b10855ca3664f
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  prep_Activatable Class_Hermes_perf.cache
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                  • Size 595B
                                  • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  2026-06-25_3e47308a864dbf1427ea4e8fabfc97b4_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_swisyn_vidar.exe 
                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-06-25_3e47308a864dbf1427ea4e8fabfc97b4_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_swisyn_vidar.exe 
                                  • Size 3.8MB
                                  • SHA256 ff309d1430fc97fccaa9cb82ddf3d23ce9afdf62dcf8c69512de40820df15e24
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                                  • Size 280B
                                  • SHA256 f13051f21dd95c2bf9fbde804e10345f21ec09080d0d2d01a421f3d9371b412c
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                                  • Size 280B
                                  • SHA256 8e363baae58ca637fed00ee0fcefc458248f52a73eb2b60bd3c439f98f70c8ca
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  throttle_store.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
                                  • Size 20B
                                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  CURRENT
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Scripts\CURRENT
                                  • Size 16B
                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Network Persistent State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State
                                  • Size 111B
                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Network Persistent State~RFe5ae541.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5ae541.TMP
                                  • Size 59B
                                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  SCT Auditing Pending Reports
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
                                  • Size 5KB
                                  • SHA256 9cdb3a63e1540faa64aa3804cc0efd4acdb659bf7b215aad2e881178cb89f234
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences~RFe5a0f34.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences~RFe5a0f34.TMP
                                  • Size 5KB
                                  • SHA256 6798468e3690130070360b5c0eea3d3436ed6861c51976edf4611ae7d99be100
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  MANIFEST-000001
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
                                  • Size 41B
                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  data_0
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
                                  • Size 8KB
                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_1
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
                                  • Size 264KB
                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_2
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
                                  • Size 8KB
                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_3
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
                                  • Size 8KB
                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 15KB
                                  • SHA256 4e39ffc2f0957d25c7e5f8c40d2970bdbdbbd7d7cf5afa191e7709da1b0ae9c3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 2KB
                                  • SHA256 e65498e75c03bfde7f984cfad97b1247c96bdd13ad37854793c82fc16d192b36
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 3KB
                                  • SHA256 79c9ef9e53fbad75c3d32a344bce69f6cee0f04b2b2bad32b6a03cb52a0d16fb
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 3KB
                                  • SHA256 43bc1460126313f9d0373d5b3f79a7c8010bdb713ef2503e8e38535702fa99fe
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State~RFe59bc9f.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State~RFe59bc9f.TMP
                                  • Size 1KB
                                  • SHA256 488f3e8f7be2e2ec2e34376dd597cb62c1b0052a1c0ceb03828513ed60c5a81e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  WinRAR.lnk
                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
                                  • Size 1KB
                                  • SHA256 128d47346e242fd02585e6fe471ccc4527a4355d5d288d464a0beb826f9a647e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  explorer.exe
                                  • Path C:\Windows\Resources\Themes\explorer.exe
                                  • Size 130KB
                                  • SHA256 2687a3b6b0ea23fe6327e909cced3e8b4389254f8e0bc02a59d596c11e8d21c6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  icsys.icn.exe
                                  • Path C:\Windows\Resources\Themes\icsys.icn.exe
                                  • Size 130KB
                                  • SHA256 93d5529a33c0f4a9b7f0c9f418e3e78ca9ea4e1beb9463d1aff6639eef4550fd
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  spoolsv.exe
                                  • Path C:\Windows\Resources\spoolsv.exe
                                  • Size 130KB
                                  • SHA256 a42be1331aa533380de46cdc7c91905d038dab9b2bd67780d1bb00b8f2fa10dc
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  svchost.exe
                                  • Path C:\Windows\Resources\svchost.exe
                                  • Size 130KB
                                  • SHA256 54658203a90949110289a9b95d5dcfe3d03757cbbaffea223c78035287699da3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  hyph-bn.hyb
                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_598136758\hyph-bn.hyb
                                  • Size 703B
                                  • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  hyph-mr.hyb
                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_598136758\hyph-mr.hyb
                                  • Size 687B
                                  • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  hyph-nn.hyb
                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_598136758\hyph-nn.hyb
                                  • Size 141KB
                                  • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  memory/240-253-0x00007FFB385D0000-0x00007FFB385D1000-memory.dmp
                                  Download

                                  memory/1644-0-0x0000000000400000-0x000000000041E000-memory.dmp
                                  Download

                                  memory/3596-349-0x000002B8001E0000-0x000002B8002E0000-memory.dmp
                                  Download

                                  memory/3596-370-0x000002C00D710000-0x000002C00D730000-memory.dmp
                                  Download

                                  memory/3596-357-0x000002B801FA0000-0x000002B801FC0000-memory.dmp
                                  Download

                                  memory/3596-350-0x000002B8001E0000-0x000002B8002E0000-memory.dmp
                                  Download

                                  memory/3596-358-0x000002C00D8D0000-0x000002C00D9D0000-memory.dmp
                                  Download

                                  memory/3596-395-0x000002C01DC90000-0x000002C01DCB0000-memory.dmp
                                  Download

                                  memory/4288-175-0x00007FFB385D0000-0x00007FFB385D1000-memory.dmp
                                  Download

                                  memory/4616-585-0x00007FFB396C0000-0x00007FFB396C1000-memory.dmp
                                  Download

                                  memory/4616-586-0x00007FFB384D0000-0x00007FFB384D1000-memory.dmp
                                  Download

                                  memory/6064-788-0x000001F150B80000-0x000001F150B81000-memory.dmp
                                  Download

                                  memory/6064-790-0x000001F150B80000-0x000001F150B81000-memory.dmp
                                  Download

                                  memory/6064-798-0x000001F150B80000-0x000001F150B81000-memory.dmp
                                  Download

                                  memory/6064-797-0x000001F150B80000-0x000001F150B81000-memory.dmp
                                  Download

                                  memory/6064-794-0x000001F150B80000-0x000001F150B81000-memory.dmp
                                  Download

                                  memory/6064-796-0x000001F150B80000-0x000001F150B81000-memory.dmp
                                  Download

                                  memory/6064-795-0x000001F150B80000-0x000001F150B81000-memory.dmp
                                  Download

                                  memory/6064-799-0x000001F150B80000-0x000001F150B81000-memory.dmp
                                  Download