Overview

overview

7

Static

static

3

2026-07-23...ar.exe

windows10-2004-x64

7

2026-07-23...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/07/2026, 04:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  • Size 3.7MB
  • Sample260723-fa3jqagc74
  • SHA256 e6cf5ac508830fb86b9cc4a275189b6de024311ddb2694295ce8001762ed1d03
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4800.2140.15138105938157937277
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:3220
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffbc1a7b078,0x7ffbc1a7b084,0x7ffbc1a7b090
        3⤵
          PID:5780
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,3242326123439467953,2912745444499379223,262144 --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:2
          3⤵
            PID:5172
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2032,i,3242326123439467953,2912745444499379223,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
            3⤵
              PID:4000
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2368,i,3242326123439467953,2912745444499379223,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
              3⤵
                PID:632
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,3242326123439467953,2912745444499379223,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
                3⤵
                  PID:2588
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3968,i,3242326123439467953,2912745444499379223,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:1
                  3⤵
                    PID:4716
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3728,i,3242326123439467953,2912745444499379223,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
                    3⤵
                      PID:972
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3896,i,3242326123439467953,2912745444499379223,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
                      3⤵
                        PID:4824
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3900,i,3242326123439467953,2912745444499379223,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
                        3⤵
                          PID:4264
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3836,i,3242326123439467953,2912745444499379223,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
                          3⤵
                            PID:4544
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=5064,i,3242326123439467953,2912745444499379223,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:8
                            3⤵
                              PID:5136
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4916,i,3242326123439467953,2912745444499379223,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:8
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1320
                        • C:\Windows\System32\alg.exe
                          C:\Windows\System32\alg.exe
                          1⤵
                          • Executes dropped EXE
                          PID:4844
                        • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                          C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                          1⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5600
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                          1⤵
                            PID:3376
                          • C:\Windows\system32\fxssvc.exe
                            C:\Windows\system32\fxssvc.exe
                            1⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1644
                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:4176
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:5296
                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:1596
                          • C:\Windows\System32\msdtc.exe
                            C:\Windows\System32\msdtc.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            PID:4356
                          • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                            "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                            1⤵
                            • Executes dropped EXE
                            PID:4268
                          • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                            C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                            1⤵
                            • Executes dropped EXE
                            PID:5356
                          • C:\Windows\SysWow64\perfhost.exe
                            C:\Windows\SysWow64\perfhost.exe
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2896
                          • C:\Windows\system32\locator.exe
                            C:\Windows\system32\locator.exe
                            1⤵
                            • Executes dropped EXE
                            PID:5004
                          • C:\Windows\System32\SensorDataService.exe
                            C:\Windows\System32\SensorDataService.exe
                            1⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            PID:5524
                          • C:\Windows\System32\snmptrap.exe
                            C:\Windows\System32\snmptrap.exe
                            1⤵
                            • Executes dropped EXE
                            PID:4940
                          • C:\Windows\system32\spectrum.exe
                            C:\Windows\system32\spectrum.exe
                            1⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            PID:5272
                          • C:\Windows\System32\OpenSSH\ssh-agent.exe
                            C:\Windows\System32\OpenSSH\ssh-agent.exe
                            1⤵
                            • Executes dropped EXE
                            PID:6048
                          • C:\Windows\system32\TieringEngineService.exe
                            C:\Windows\system32\TieringEngineService.exe
                            1⤵
                            • Executes dropped EXE
                            • Checks processor information in registry
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1432
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                            1⤵
                              PID:1292
                            • C:\Windows\system32\AgentService.exe
                              C:\Windows\system32\AgentService.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5804
                            • C:\Windows\System32\vds.exe
                              C:\Windows\System32\vds.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2424
                            • C:\Windows\system32\vssvc.exe
                              C:\Windows\system32\vssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1104
                            • C:\Windows\system32\wbengine.exe
                              "C:\Windows\system32\wbengine.exe"
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2100
                            • C:\Windows\system32\wbem\WmiApSrv.exe
                              C:\Windows\system32\wbem\WmiApSrv.exe
                              1⤵
                              • Executes dropped EXE
                              PID:5212
                            • C:\Windows\system32\SearchIndexer.exe
                              C:\Windows\system32\SearchIndexer.exe /Embedding
                              1⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:3092
                              • C:\Windows\system32\SearchProtocolHost.exe
                                "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:4556
                              • C:\Windows\system32\SearchFilterHost.exe
                                "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:4652

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  elevation_service.exe
                                  • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                  • Size 2.7MB
                                  • SHA256 29fd4979167a96406151285381e59d101d45db1f1dd8be238a997672fcfc7ec5
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  maintenanceservice.exe
                                  • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                  • Size 1.5MB
                                  • SHA256 6767e5adb292150048bb8f05898a0d78c100a3eb32a4cfcbb1707733e3cd1d35
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  7z.exe
                                  • Path C:\Program Files\7-Zip\7z.exe
                                  • Size 1.8MB
                                  • SHA256 63ada0e59eae02b63ed67625f32b57c0afe297aaf3a273781400e38dbf89012e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  7zFM.exe
                                  • Path C:\Program Files\7-Zip\7zFM.exe
                                  • Size 1.5MB
                                  • SHA256 672a52ce1227003dd3fedd2328fd9ed169d406b4a323d6632a7b791dec705b9e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  7zG.exe
                                  • Path C:\Program Files\7-Zip\7zG.exe
                                  • Size 1.2MB
                                  • SHA256 b4f498475e3280fe2209e18803f2641a8b3289dabce08b18342500b9a3544830
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Uninstall.exe
                                  • Path C:\Program Files\7-Zip\Uninstall.exe
                                  • Size 1.2MB
                                  • SHA256 e7c0e529f19be12b2254233afe9865f7af2834543eb1044254e77df67366956c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  AppVShNotify.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                  • Size 1.5MB
                                  • SHA256 5af77021f7ec07262670594dc5b22febe218821db11eae259e671b57d547da1a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  IntegratedOffice.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                  • Size 4.6MB
                                  • SHA256 04d0f97765e92b27182d5c56c5074043639564486896ef4f57609292fb180bb3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  MavInject32.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                  • Size 1.6MB
                                  • SHA256 9a844c7edc51dcb672d7d56cd2e2c5b257c476bdf6f4cc31c516dd103d633fd4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  OfficeC2RClient.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                  • Size 24.0MB
                                  • SHA256 9e088505f9ca41fbac33315eaa10809bdb9c7cb709f393f3ebbf05a41daac3ec
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  appvcleaner.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                  • Size 2.7MB
                                  • SHA256 8f3a9296afc528d0f66de9b1d6da7fdc28a9eaae226e8c31e71d18e3cb11fa3d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  LICLUA.EXE
                                  • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                  • Size 1.1MB
                                  • SHA256 5607457d7a0f6068cb246eb07b494e127a5931d07a0d9f93046b20fba483a537
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  OSE.EXE
                                  • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                  • Size 1.5MB
                                  • SHA256 1bcdd7f48c50abb4fb5a1a0601d8cf7a148331a2b066b5e0a1768fc7b3d30132
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  VSTOInstaller.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                  • Size 1.3MB
                                  • SHA256 381b53b4ab4b2599d9f1ce8d8d6e86f2d99a8b1d4894295938cf4d69e1875fa2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  chrmstp.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                                  • Size 6.6MB
                                  • SHA256 c3a8bc2ecafe869879a2eae6a7b6b6974128e8f0855cf49d754298f8767cbf9d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  setup.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                                  • Size 6.6MB
                                  • SHA256 53a5ed1b47efd7abdd5833fc562d825ce5f5d16b2bb7593f86ec2df79756fcfb
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  chrome_pwa_launcher.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                                  • Size 2.3MB
                                  • SHA256 5314d02c8de5ad14a5e9b1217af7248199773e7e7ece6d50c155582246d4db56
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  elevated_tracing_service.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                                  • Size 4.0MB
                                  • SHA256 b2a55db5d1a8b7289353a52d2bf23e77513132bbbe541a03e1cdfb8821d0206f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  elevation_service.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                  • Size 2.8MB
                                  • SHA256 8983f80d0c1e23b9ea247c2a3f2b789554abef2c0e9ec63253724da5aa34eef7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  notification_helper.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                                  • Size 2.2MB
                                  • SHA256 5d9ead570117aa63227ab139448dad32b3229d898a3406772b8381bd9eef13d6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  os_update_handler.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                                  • Size 2.4MB
                                  • SHA256 6072d0de5216aa35b322c2ef95557b1bcc438e2cd342304af4ca60d107daab6a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  chrome_proxy.exe
                                  • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                                  • Size 2.0MB
                                  • SHA256 b97221d9d2fd004a5c6b330c6911f1f211b838c5e77e8dbcaea9ed3bc7288bdf
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  appletviewer.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                                  • Size 1.2MB
                                  • SHA256 2918d91afae5b1fe61ebbb18344bee60e4cd3e65171b755ac85bed7c18bb6aef
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  extcheck.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                                  • Size 1.2MB
                                  • SHA256 8a63cdeae9793d19fff3f2aaa40d19a816b5ae439e8021af51731ccb8f873787
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  idlj.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                                  • Size 1.2MB
                                  • SHA256 8d19dc99a861fb33488f50cd1ff1eab3c8e57e9469d66ffd1381519724f3a4f3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  jabswitch.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                                  • Size 1.3MB
                                  • SHA256 1a3c618ef7dead6a3ceb7b2a8c3e0b21321153cf586f5e4353a633adf1c214ff
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  jar.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                                  • Size 1.2MB
                                  • SHA256 65ce1bfa01d62390ebadd84cf51f7145c5e577cded512783832c138b57234171
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  wmpnetwk.exe
                                  • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                  • Size 1.5MB
                                  • SHA256 a14bd1d8092ddd0300320d505ad7cf8e507dd67ff40ce5a217ab72414f1ad79e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  crs.pb
                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3220_1611034102\crs.pb
                                  • Size 233KB
                                  • SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  manifest.json
                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3220_1611034102\manifest.json
                                  • Size 102B
                                  • SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  manifest.json
                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3220_20037984\manifest.json
                                  • Size 113B
                                  • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  dotnet.exe
                                  • Path C:\Program Files\dotnet\dotnet.exe
                                  • Size 1.4MB
                                  • SHA256 e597826411107501b21f133b3719b97bca162bb04e7f989b03963cf9e9875e50
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  WinRAR.lnk
                                  • Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
                                  • Size 1KB
                                  • SHA256 68592d76dad86148ac10e7a3370b0e9c2e07e630b1cde212e52e2cf44e0bf814
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  crl-set
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                                  • Size 22KB
                                  • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                                  • Size 280B
                                  • SHA256 4e6223d54930d5f5a1ead568ae64a3e2a8f2b105ac45a679d3580691a8d8d080
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                                  • Size 280B
                                  • SHA256 be189d1bc6a09ff8082253485f41b07628482049803068e55ad5877ee2a63662
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  throttle_store.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
                                  • Size 20B
                                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  data_0
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
                                  • Size 8KB
                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_1
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
                                  • Size 264KB
                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_2
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
                                  • Size 8KB
                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_3
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
                                  • Size 8KB
                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  CURRENT
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT
                                  • Size 16B
                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  MANIFEST-000001
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001
                                  • Size 41B
                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Network Persistent State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State
                                  • Size 111B
                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Network Persistent State~RFe594e45.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe594e45.TMP
                                  • Size 59B
                                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  SCT Auditing Pending Reports
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
                                  • Size 6KB
                                  • SHA256 776dd56610e4a4082794bed409d96dcd2ad79e387a0e465a560ae09567a93bc8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
                                  • Size 6KB
                                  • SHA256 f453d833da54ecabf050974cfb244ffa28bf2df66532e2749155a5d473d5ad6d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences~RFe587b94.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences~RFe587b94.TMP
                                  • Size 5KB
                                  • SHA256 6e0de967c9615c26e78171b015e0c40def0d725fd96956f1b9c8d06b42cda414
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 1KB
                                  • SHA256 b5510ce989a110378b73d96200f8cba492d4ae674ca69f9d7677f5d865be3180
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 2KB
                                  • SHA256 bfa6a7be51992a91caf4e77ff53951f582ef8ac81bbc07a036dff39bdf16661f
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 3KB
                                  • SHA256 f9a475ebc6bf7c209872f1411eaf31533bc3052c2e2941c65cd0f0b3431c89b3
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 4KB
                                  • SHA256 dc91dc014816ccbc624b9b7efb1ea37a3bb596cffb131b18cb2d998a5fcb4714
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 16KB
                                  • SHA256 801eb1879d75e7ccd776740f71edf8f1093a553937297caea6abb7206a5476b9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Local State~RFe58272a.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State~RFe58272a.TMP
                                  • Size 1KB
                                  • SHA256 8946659c02e07c45ba22555aa1a5869ad5f6fb3fe273de35b616718791b76b36
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  ct_config.pb
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
                                  • Size 16KB
                                  • SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  kp_pinslist.pb
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
                                  • Size 10KB
                                  • SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  perfhost.exe
                                  • Path C:\Windows\SysWOW64\perfhost.exe
                                  • Size 1.2MB
                                  • SHA256 9e0f7990c97df2278633279b6d09806d82d008c2f5fd13033bf0f10affc468f4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  AgentService.exe
                                  • Path C:\Windows\System32\AgentService.exe
                                  • Size 1.7MB
                                  • SHA256 dbaeafd28fc811a99387776dd3609961fef63394f4843eb9068247892a888824
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  DiagnosticsHub.StandardCollector.Service.exe
                                  • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                  • Size 1.3MB
                                  • SHA256 f8e3938bb36910c79a17aeb954cd4012b6783fa6dc2a095f01f2ae2a59813af3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  FXSSVC.exe
                                  • Path C:\Windows\System32\FXSSVC.exe
                                  • Size 1.2MB
                                  • SHA256 b0631b85a3f75aa0619b7d90e5367de73b0e89db48339b988a6042f851002ffe
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Locator.exe
                                  • Path C:\Windows\System32\Locator.exe
                                  • Size 1.2MB
                                  • SHA256 e0c4c2b3d903421ec1d619177700b679356152d4d6b2f6684c331a84e0f740ae
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ssh-agent.exe
                                  • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                  • Size 1.6MB
                                  • SHA256 75b6ca505017663576d9bb91eee60dd8a53ca719de49515fbd7d434d9e5dc793
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  PerceptionSimulationService.exe
                                  • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                  • Size 1.3MB
                                  • SHA256 7951b6877399ed7d6e2f84a2504d3e1c178d1980c4faff83a915ae698e4805d0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  SearchIndexer.exe
                                  • Path C:\Windows\System32\SearchIndexer.exe
                                  • Size 1.4MB
                                  • SHA256 d2b43aabf0e775aced2a4a59b6d32e24ea9974c322303162071956b9f49357e0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  SensorDataService.exe
                                  • Path C:\Windows\System32\SensorDataService.exe
                                  • Size 1.8MB
                                  • SHA256 8c2c5311d676fd3ffda9368d19e50690fd684434e035fa7172f054ece2bfe780
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Spectrum.exe
                                  • Path C:\Windows\System32\Spectrum.exe
                                  • Size 1.4MB
                                  • SHA256 7feb1707f7782271b9e3cdfe6e67aff4ee71be8eaaa0276771e3e2032efce413
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  TieringEngineService.exe
                                  • Path C:\Windows\System32\TieringEngineService.exe
                                  • Size 1.5MB
                                  • SHA256 55cd69a662ae5035aa3c99d2549d397f7aefca7bfac65b2a53a2f15ae0563b9c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  VSSVC.exe
                                  • Path C:\Windows\System32\VSSVC.exe
                                  • Size 2.0MB
                                  • SHA256 1d01ff6defe6159976fbb2682afdd940be8535f4f304c1f738dbf1715b105d3d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  alg.exe
                                  • Path C:\Windows\System32\alg.exe
                                  • Size 1.3MB
                                  • SHA256 73d1e1fc4148a0310221878691c459fe3fe0c9910dba838dda9470580d0ba830
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  msdtc.exe
                                  • Path C:\Windows\System32\msdtc.exe
                                  • Size 1.4MB
                                  • SHA256 c4ee503f243620d99cf857d3dfeb1e3504cee2613bc922caf661e142d1d019e2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  snmptrap.exe
                                  • Path C:\Windows\System32\snmptrap.exe
                                  • Size 1.2MB
                                  • SHA256 35f9bc57810a7eb9691c2b335a22623c5fd28aa9a9fd27bdee7698ff52fd8976
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  vds.exe
                                  • Path C:\Windows\System32\vds.exe
                                  • Size 1.3MB
                                  • SHA256 d8def35f66caf22e9dcf0447ed8454fd731f2e86d0369ba4f400ad9f431875f4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  WmiApSrv.exe
                                  • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                  • Size 1.4MB
                                  • SHA256 a76a6d1bc0a20f803d49f61b6b5b17560ce7f34b8cb9b72d9449dbd7dbb24b62
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  wbengine.exe
                                  • Path C:\Windows\System32\wbengine.exe
                                  • Size 2.1MB
                                  • SHA256 310ae07c413a8be5275c413826dd4b462af5742ee55f98d2febd1ab5bec0ad7c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  AppVClient.exe
                                  • Path C:\Windows\system32\AppVClient.exe
                                  • Size 1.3MB
                                  • SHA256 67cf6b9c51f161b8358812d01310719b2ec4abb3b80faf891d801ff15b2d1d54
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  SgrmBroker.exe
                                  • Path C:\Windows\system32\SgrmBroker.exe
                                  • Size 1.5MB
                                  • SHA256 407323dc36744dd01f1b89f523c72a41f6e59a057696a4b030bbb43c75b8a422
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  msiexec.exe
                                  • Path C:\Windows\system32\msiexec.exe
                                  • Size 1.3MB
                                  • SHA256 898fa6f404246c18de6947eb7a076509c4bfe0e04b90d5685059cc2b822e312d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  memory/1104-158-0x0000000140000000-0x00000001401FC000-memory.dmp
                                  Download

                                  memory/1104-413-0x0000000140000000-0x00000001401FC000-memory.dmp
                                  Download

                                  memory/1432-361-0x0000000140000000-0x0000000140239000-memory.dmp
                                  Download

                                  memory/1432-147-0x0000000140000000-0x0000000140239000-memory.dmp
                                  Download

                                  memory/1596-54-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                  Download

                                  memory/1596-66-0x0000000140000000-0x000000014022C000-memory.dmp
                                  Download

                                  memory/1596-60-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                  Download

                                  memory/1596-64-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                  Download

                                  memory/1644-67-0x0000000140000000-0x0000000140135000-memory.dmp
                                  Download

                                  memory/1644-31-0x0000000140000000-0x0000000140135000-memory.dmp
                                  Download

                                  memory/2100-163-0x0000000140000000-0x0000000140216000-memory.dmp
                                  Download

                                  memory/2100-436-0x0000000140000000-0x0000000140216000-memory.dmp
                                  Download

                                  memory/2424-155-0x0000000140000000-0x0000000140147000-memory.dmp
                                  Download

                                  memory/2424-380-0x0000000140000000-0x0000000140147000-memory.dmp
                                  Download

                                  memory/2896-101-0x0000000000950000-0x00000000009B6000-memory.dmp
                                  Download

                                  memory/2896-106-0x0000000000950000-0x00000000009B6000-memory.dmp
                                  Download

                                  memory/2896-162-0x0000000000400000-0x00000000005EE000-memory.dmp
                                  Download

                                  memory/2896-109-0x0000000000400000-0x00000000005EE000-memory.dmp
                                  Download

                                  memory/3092-171-0x0000000140000000-0x0000000140179000-memory.dmp
                                  Download

                                  memory/3092-188-0x0000000001780000-0x0000000001790000-memory.dmp
                                  Download

                                  memory/3092-237-0x0000000009E70000-0x0000000009E78000-memory.dmp
                                  Download

                                  memory/3092-362-0x000000000CD20000-0x000000000CD28000-memory.dmp
                                  Download

                                  memory/3092-204-0x0000000001A30000-0x0000000001A40000-memory.dmp
                                  Download

                                  memory/3092-621-0x0000000140000000-0x0000000140179000-memory.dmp
                                  Download

                                  memory/4176-143-0x0000000140000000-0x00000001402E9000-memory.dmp
                                  Download

                                  memory/4176-71-0x0000000140000000-0x00000001402E9000-memory.dmp
                                  Download

                                  memory/4176-40-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                  Download

                                  memory/4176-34-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                  Download

                                  memory/4268-154-0x0000000140000000-0x0000000140226000-memory.dmp
                                  Download

                                  memory/4268-84-0x0000000140000000-0x0000000140226000-memory.dmp
                                  Download

                                  memory/4268-80-0x00000000007F0000-0x0000000000850000-memory.dmp
                                  Download

                                  memory/4268-74-0x00000000007F0000-0x0000000000850000-memory.dmp
                                  Download

                                  memory/4356-72-0x0000000140000000-0x0000000140210000-memory.dmp
                                  Download

                                  memory/4652-376-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-368-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-393-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-392-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-391-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-390-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-389-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-388-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-387-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-386-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-385-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-384-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-383-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-382-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-381-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-395-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-396-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-397-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-398-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-399-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-400-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-401-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-402-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-403-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-404-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-405-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-370-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-364-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-371-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-372-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-373-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-374-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-375-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-365-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-377-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-378-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-379-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-394-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-369-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-367-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4652-366-0x00000225AC1F0000-0x00000225AC200000-memory.dmp
                                  Download

                                  memory/4800-9-0x0000000000530000-0x0000000000590000-memory.dmp
                                  Download

                                  memory/4800-8-0x0000000140000000-0x0000000140407000-memory.dmp
                                  Download

                                  memory/4800-0-0x0000000000530000-0x0000000000590000-memory.dmp
                                  Download

                                  memory/4800-95-0x0000000140000000-0x0000000140407000-memory.dmp
                                  Download

                                  memory/4844-14-0x0000000140000000-0x0000000140201000-memory.dmp
                                  Download

                                  memory/4844-115-0x0000000140000000-0x0000000140201000-memory.dmp
                                  Download

                                  memory/4940-119-0x0000000140000000-0x00000001401ED000-memory.dmp
                                  Download

                                  memory/4940-310-0x0000000140000000-0x00000001401ED000-memory.dmp
                                  Download

                                  memory/5004-112-0x0000000140000000-0x00000001401EC000-memory.dmp
                                  Download

                                  memory/5004-166-0x0000000140000000-0x00000001401EC000-memory.dmp
                                  Download

                                  memory/5212-554-0x0000000140000000-0x000000014021D000-memory.dmp
                                  Download

                                  memory/5212-167-0x0000000140000000-0x000000014021D000-memory.dmp
                                  Download

                                  memory/5272-333-0x0000000140000000-0x0000000140169000-memory.dmp
                                  Download

                                  memory/5272-128-0x00000000006B0000-0x0000000000710000-memory.dmp
                                  Download

                                  memory/5272-130-0x0000000140000000-0x0000000140169000-memory.dmp
                                  Download

                                  memory/5272-122-0x00000000006B0000-0x0000000000710000-memory.dmp
                                  Download

                                  memory/5296-83-0x0000000140000000-0x00000001402D4000-memory.dmp
                                  Download

                                  memory/5296-50-0x0000000000890000-0x00000000008F0000-memory.dmp
                                  Download

                                  memory/5296-44-0x0000000000890000-0x00000000008F0000-memory.dmp
                                  Download

                                  memory/5356-92-0x00000000006D0000-0x0000000000730000-memory.dmp
                                  Download

                                  memory/5356-157-0x0000000140000000-0x0000000140202000-memory.dmp
                                  Download

                                  memory/5356-96-0x0000000140000000-0x0000000140202000-memory.dmp
                                  Download

                                  memory/5356-86-0x00000000006D0000-0x0000000000730000-memory.dmp
                                  Download

                                  memory/5524-116-0x0000000140000000-0x00000001401D7000-memory.dmp
                                  Download

                                  memory/5524-170-0x0000000140000000-0x00000001401D7000-memory.dmp
                                  Download

                                  memory/5524-351-0x0000000140000000-0x00000001401D7000-memory.dmp
                                  Download

                                  memory/5600-27-0x0000000140000000-0x0000000140200000-memory.dmp
                                  Download

                                  memory/5600-28-0x00000000004C0000-0x0000000000520000-memory.dmp
                                  Download

                                  memory/5600-18-0x00000000004C0000-0x0000000000520000-memory.dmp
                                  Download

                                  memory/5804-151-0x0000000140000000-0x00000001401C0000-memory.dmp
                                  Download

                                  memory/5804-149-0x0000000140000000-0x00000001401C0000-memory.dmp
                                  Download

                                  memory/6048-144-0x0000000140000000-0x0000000140259000-memory.dmp
                                  Download

                                  memory/6048-140-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                  Download

                                  memory/6048-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                  Download

                                  memory/6048-359-0x0000000140000000-0x0000000140259000-memory.dmp
                                  Download