Overview

overview

7

Static

static

3

2026-08-13...ar.exe

windows10-2004-x64

7

2026-08-13...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/08/2026, 22:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  • Size 3.7MB
  • Sample260813-2xgreszgkh
  • SHA256 92be542440f26cea06a013892af11fabd24c2370debb3aa76c2e68892cd7f140
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=1700.1416.17964211980007237875
      2⤵
      • Drops file in Program Files directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:3240
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x11c,0x7fff3b3eb078,0x7fff3b3eb084,0x7fff3b3eb090
        3⤵
          PID:4696
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1668,i,16288142057782210506,15554658610122731252,262144 --variations-seed-version --mojo-platform-channel-handle=1664 /prefetch:2
          3⤵
            PID:4932
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2012,i,16288142057782210506,15554658610122731252,262144 --variations-seed-version --mojo-platform-channel-handle=1656 /prefetch:3
            3⤵
              PID:1888
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2336,i,16288142057782210506,15554658610122731252,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
              3⤵
                PID:5000
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3608,i,16288142057782210506,15554658610122731252,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
                3⤵
                  PID:5224
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3800,i,16288142057782210506,15554658610122731252,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
                  3⤵
                    PID:216
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3616,i,16288142057782210506,15554658610122731252,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
                    3⤵
                      PID:4296
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3660,i,16288142057782210506,15554658610122731252,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
                      3⤵
                        PID:6100
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4420,i,16288142057782210506,15554658610122731252,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:1
                        3⤵
                          PID:5504
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3756,i,16288142057782210506,15554658610122731252,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:8
                          3⤵
                            PID:6044
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4732,i,16288142057782210506,15554658610122731252,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
                            3⤵
                              PID:4300
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4464,i,16288142057782210506,15554658610122731252,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6060
                        • C:\Windows\System32\alg.exe
                          C:\Windows\System32\alg.exe
                          1⤵
                          • Executes dropped EXE
                          PID:2688
                        • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                          C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                          1⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2040
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                          1⤵
                            PID:1148
                          • C:\Windows\system32\fxssvc.exe
                            C:\Windows\system32\fxssvc.exe
                            1⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1740
                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:1460
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:2936
                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:4580
                          • C:\Windows\System32\msdtc.exe
                            C:\Windows\System32\msdtc.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            PID:4084
                          • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                            "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                            1⤵
                            • Executes dropped EXE
                            PID:4988
                          • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                            C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                            1⤵
                            • Executes dropped EXE
                            PID:3580
                          • C:\Windows\SysWow64\perfhost.exe
                            C:\Windows\SysWow64\perfhost.exe
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3724
                          • C:\Windows\system32\locator.exe
                            C:\Windows\system32\locator.exe
                            1⤵
                            • Executes dropped EXE
                            PID:3264
                          • C:\Windows\System32\SensorDataService.exe
                            C:\Windows\System32\SensorDataService.exe
                            1⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            PID:2068
                          • C:\Windows\System32\snmptrap.exe
                            C:\Windows\System32\snmptrap.exe
                            1⤵
                            • Executes dropped EXE
                            PID:3968
                          • C:\Windows\system32\spectrum.exe
                            C:\Windows\system32\spectrum.exe
                            1⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            PID:4388
                          • C:\Windows\System32\OpenSSH\ssh-agent.exe
                            C:\Windows\System32\OpenSSH\ssh-agent.exe
                            1⤵
                            • Executes dropped EXE
                            PID:2028
                          • C:\Windows\system32\TieringEngineService.exe
                            C:\Windows\system32\TieringEngineService.exe
                            1⤵
                            • Executes dropped EXE
                            • Checks processor information in registry
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2732
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                            1⤵
                              PID:3908
                            • C:\Windows\system32\AgentService.exe
                              C:\Windows\system32\AgentService.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:520
                            • C:\Windows\System32\vds.exe
                              C:\Windows\System32\vds.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4236
                            • C:\Windows\system32\vssvc.exe
                              C:\Windows\system32\vssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2744
                            • C:\Windows\system32\wbengine.exe
                              "C:\Windows\system32\wbengine.exe"
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2188
                            • C:\Windows\system32\wbem\WmiApSrv.exe
                              C:\Windows\system32\wbem\WmiApSrv.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1408
                            • C:\Windows\system32\SearchIndexer.exe
                              C:\Windows\system32\SearchIndexer.exe /Embedding
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:3496
                              • C:\Windows\system32\SearchProtocolHost.exe
                                "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:4028
                              • C:\Windows\system32\SearchFilterHost.exe
                                "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:4204

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  elevation_service.exe
                                  • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                  • Size 2.7MB
                                  • SHA256 af7ea3efd68d3e223b92ba5853c8c7585df8a273aeff0801f50d04b2e09c81cd
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  maintenanceservice.exe
                                  • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                  • Size 1.7MB
                                  • SHA256 401b9fb42fddcc74f63ac65bf2ec935b24016e48fec4b779dad53083b4307b7f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  7z.exe
                                  • Path C:\Program Files\7-Zip\7z.exe
                                  • Size 2.0MB
                                  • SHA256 41ddebad4bf8a5a69c87f1a6f5b56fb9800cd54bb3072e2b2bd3bdb0e01ea820
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  7zFM.exe
                                  • Path C:\Program Files\7-Zip\7zFM.exe
                                  • Size 1.5MB
                                  • SHA256 4abfb6c8cecad3a0689b698dff461fc6dc82dbb36cf70dcfc47592982e7351ca
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  7zG.exe
                                  • Path C:\Program Files\7-Zip\7zG.exe
                                  • Size 1.2MB
                                  • SHA256 4b6802fe9b29953801826f3bddd0369d27683b461808dcc4c8ef2fd7b357326d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Uninstall.exe
                                  • Path C:\Program Files\7-Zip\Uninstall.exe
                                  • Size 1.5MB
                                  • SHA256 ef81a64fb8ffc67b0ba0fcacb9d9287fee91ff0991051fc14baead79f2badea0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  AppVShNotify.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                  • Size 1.8MB
                                  • SHA256 d1d42c8e85bac99a9ac39e721914daa5f4a35d9cbd324fa2a517243d0886f958
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  IntegratedOffice.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                  • Size 4.6MB
                                  • SHA256 53a0b76515df744db3ae4b74e3a5c61fb073e8f43d63669be568912ce7bc3dad
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  MavInject32.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                  • Size 1.8MB
                                  • SHA256 a187ef20bdd2540a6a30c1a31d40789dd8c697c3521315881183bd342ad0665b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  OfficeC2RClient.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                  • Size 24.0MB
                                  • SHA256 89bed89b9ca9cdb6f6c04f2d201c7495f260ec9740a6b17bddc77d0d40834b45
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  appvcleaner.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                  • Size 2.7MB
                                  • SHA256 4c93789780fba5798954645f3c583aadc3124d71d9fe4819f6271c850bdc74bf
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  LICLUA.EXE
                                  • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                  • Size 1.1MB
                                  • SHA256 1c63796937ac45c6cb444270d2700d7bcb00b98d958c20d9ce9161b0c57de0b4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  OSE.EXE
                                  • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                  • Size 1.7MB
                                  • SHA256 e08446346d08ea62a220a06a4ea5408ee4e4175f955a8775ee284fba9b46e10e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  VSTOInstaller.exe
                                  • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                  • Size 1.6MB
                                  • SHA256 9c2fbdaeb976001bb754a883861992b5f7d1d2294ea8cffde0e371df332eea47
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  chrmstp.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                                  • Size 6.6MB
                                  • SHA256 128ebfc63f7768ffb4ca0bc292d09b5a25502ca2eabe20f77c9e166e8fe7b66b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  setup.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                                  • Size 6.6MB
                                  • SHA256 64093ef3ac0d4d0b53805d1565a8f5b13d0359147af636a6f685e3f673957071
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  chrome_pwa_launcher.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                                  • Size 2.3MB
                                  • SHA256 8e772588b9894fece6c19159ac76c8bce5c0a17d88b655900a699f5c3ffb6a3d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  elevated_tracing_service.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                                  • Size 4.0MB
                                  • SHA256 fc0cac739e2448f8a15b0d4f5fa5d81f5d8af5248a43b30c9cb9613515b3b8a7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  elevation_service.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                  • Size 2.8MB
                                  • SHA256 003c15d6d94dc2e282f68cef426b277af1ac1be9fb34d16c1eb388d56d3ea255
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  notification_helper.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                                  • Size 2.2MB
                                  • SHA256 92519d9f818d662715f0bfd1229ba897b1e2dad17fdcae33ef7ff5f6e9c92d62
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  os_update_handler.exe
                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                                  • Size 2.4MB
                                  • SHA256 fa2458a05a80e1d083dd239173ca37276ea46e638c6ddc45349e3b5c1aa11879
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  chrome_proxy.exe
                                  • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                                  • Size 2.0MB
                                  • SHA256 922aede5a9eeb27c9775107c02f810eab794ba6ca6e467d2483bf18ac681485e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  appletviewer.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                                  • Size 1.5MB
                                  • SHA256 3fa5e26d706f77d9ad3a0774364e50d5880c3da6c4f1b5e44996e47785fed3a7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  extcheck.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                                  • Size 1.5MB
                                  • SHA256 6014f60ee2f5672bbe5c5b506d4f7a10320101242b6ec5fd9c7571f7b5e78110
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  idlj.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                                  • Size 1.5MB
                                  • SHA256 acd782eb43bc5e6f938ffdba61a13654649b172c4ff002cef7f91ac3bb37e78c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  jabswitch.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                                  • Size 1.5MB
                                  • SHA256 b92d243fedc81397646ef0b29bbe72379abffdb54461cf2480bf0f30f21079dc
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  jar.exe
                                  • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                                  • Size 1.5MB
                                  • SHA256 d66e8bcbd1c5cfc687f6d7bdd4320464cbd9852b4aafe2aaaf6ad40b881c9b01
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  wmpnetwk.exe
                                  • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                  • Size 1.5MB
                                  • SHA256 1fb55692a7511d04d582a61ef34ac40dd6bd83fbbd2769999d3214589a8e3de7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  manifest.json
                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3240_1577076436\manifest.json
                                  • Size 135B
                                  • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  hyph-af.hyb
                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3240_171543525\hyph-af.hyb
                                  • Size 70KB
                                  • SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  hyph-as.hyb
                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3240_171543525\hyph-as.hyb
                                  • Size 703B
                                  • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  hyph-hi.hyb
                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3240_171543525\hyph-hi.hyb
                                  • Size 687B
                                  • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  hyph-nb.hyb
                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3240_171543525\hyph-nb.hyb
                                  • Size 141KB
                                  • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  manifest.json
                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3240_171543525\manifest.json
                                  • Size 82B
                                  • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  dotnet.exe
                                  • Path C:\Program Files\dotnet\dotnet.exe
                                  • Size 1.6MB
                                  • SHA256 76ea4a899125ff523b9b93f64b9417f73c9f425a78fe65d6e7420eb779d30056
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  WinRAR.lnk
                                  • Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
                                  • Size 1KB
                                  • SHA256 3e7924fab96ea5eab41c99b8ea2f92ea27d938bea8b672f15101408912662ea1
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  protocols.json
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                  • Size 3KB
                                  • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                                  • Size 280B
                                  • SHA256 736d1d45d8a48e1b4ea503e28e1f154ca41a6cc8be0a5d3475eb8b055c76103f
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
                                  • Size 280B
                                  • SHA256 9c3c49bc5bdadad710cc96ed5f0932083c5cfd9a1b7f47b70788aa96c59a34ac
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  throttle_store.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
                                  • Size 20B
                                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  data_0
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
                                  • Size 8KB
                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_1
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
                                  • Size 264KB
                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_2
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
                                  • Size 8KB
                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_3
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
                                  • Size 8KB
                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  MANIFEST-000001
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
                                  • Size 41B
                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Network Persistent State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State
                                  • Size 111B
                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Network Persistent State~RFe5a1c63.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a1c63.TMP
                                  • Size 59B
                                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  SCT Auditing Pending Reports
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
                                  • Size 6KB
                                  • SHA256 e96762f9856a21b03203679cecd653bb36ad7a7bfcdad35312ee6450a6114d5b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
                                  • Size 6KB
                                  • SHA256 e1191ae5a49aab66591547bd5698aadf330a6311ab35ae73d93e8ead3e421871
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences~RFe5949e0.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences~RFe5949e0.TMP
                                  • Size 5KB
                                  • SHA256 7e7d890d9d208772e1be156b35c9b00a0c6bab912ff51c4c342aa3eeec4c9b69
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  CURRENT
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
                                  • Size 16B
                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 1KB
                                  • SHA256 2b89f334817fd7b546e6f7c116d1c6b0363d99658efed4b26907b49357865608
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 2KB
                                  • SHA256 16a828c1a568c1ec58f287edfa55485c3aa3a1d399328ca1ed621433528990f2
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 3KB
                                  • SHA256 79d15a92ca3cec7f0010998da42ba3b6c702821354086e726a53fa1d654b0b44
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 4KB
                                  • SHA256 22f2314cde3dd0ad8a76cc5aa06777329b50dadb17dc0220abecaf48f70f434f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
                                  • Size 16KB
                                  • SHA256 7685e0f5087c45a0b885a8b21a5c0c54d4356f67e6e228e39cf515c08994912a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Local State~RFe58f567.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State~RFe58f567.TMP
                                  • Size 1KB
                                  • SHA256 251f18b5315c7cb3e11c27cf485daa3cffbe95720e54657e8e13bdbe002b58f5
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  perfhost.exe
                                  • Path C:\Windows\SysWOW64\perfhost.exe
                                  • Size 1.5MB
                                  • SHA256 a32ce2fd5892462c3b3c9a6d0cdb2b0f75e8335a7bf316cdf72e065bce02ca9e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  AgentService.exe
                                  • Path C:\Windows\System32\AgentService.exe
                                  • Size 1.7MB
                                  • SHA256 7044e440dc0fd7db3c1e728e81e90d85de949ce3130a3844af0222edd871ae6e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  DiagnosticsHub.StandardCollector.Service.exe
                                  • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                  • Size 1.6MB
                                  • SHA256 00828ae541895c5ad553a1ee21f5c2bb3ccf1fa14c1615a477c175b2633e33f0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  FXSSVC.exe
                                  • Path C:\Windows\System32\FXSSVC.exe
                                  • Size 1.2MB
                                  • SHA256 5046f47ad6d7cc8715f98baf824b11669ce0271113026a1a80f6ef207f2665fd
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Locator.exe
                                  • Path C:\Windows\System32\Locator.exe
                                  • Size 1.5MB
                                  • SHA256 c8ec9b136137fabccac8f008099d370a7185383d5678cae3b746d2a48a679659
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ssh-agent.exe
                                  • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                  • Size 1.9MB
                                  • SHA256 6819b69fcbdc9d2cdb603d61f5b3a7bf0f4268b0f5e974c16f9165b9c8665e4e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  PerceptionSimulationService.exe
                                  • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                  • Size 1.6MB
                                  • SHA256 ddcc322e6ae0dab680a47374fcc48ba07516e9d61d002cd37eeeb1563a0e14e1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  SearchIndexer.exe
                                  • Path C:\Windows\System32\SearchIndexer.exe
                                  • Size 1.4MB
                                  • SHA256 af071f5d08182f054a137b7347b67d8ce5f4ca7ae86c454e0ed1e291d1b95347
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  SensorDataService.exe
                                  • Path C:\Windows\System32\SensorDataService.exe
                                  • Size 1.8MB
                                  • SHA256 98d016fc6038f796252c2625800778bae1098fb99da4737252fd7a0f785a8b0c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Spectrum.exe
                                  • Path C:\Windows\System32\Spectrum.exe
                                  • Size 1.4MB
                                  • SHA256 5dc26891d13aa9dc462440c941ffb7fe4b46f612c95eecd642876579c501a5a7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  TieringEngineService.exe
                                  • Path C:\Windows\System32\TieringEngineService.exe
                                  • Size 1.8MB
                                  • SHA256 2cb49d3335ebd79f6e96e49a33b88a5c1632c1f7ffb1390923fdaac05d4726c1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  VSSVC.exe
                                  • Path C:\Windows\System32\VSSVC.exe
                                  • Size 2.0MB
                                  • SHA256 6f5a1b6ed299145417978828e6ab0f1f90f3f48b86b8d72f455df02e23a192c5
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  alg.exe
                                  • Path C:\Windows\System32\alg.exe
                                  • Size 1.6MB
                                  • SHA256 1c90089e5e788a78f39595c389dd7b683645b47f7ac9d761efae602245fbf939
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  msdtc.exe
                                  • Path C:\Windows\System32\msdtc.exe
                                  • Size 1.6MB
                                  • SHA256 c0b5b1d2f4e3a947f462ade9e49c41d0c04d1f165636d617e807611a2e242699
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  snmptrap.exe
                                  • Path C:\Windows\System32\snmptrap.exe
                                  • Size 1.5MB
                                  • SHA256 bd8ae66ca4934add89f6abec96eb431e4bf15a45830f5489d62db4be6d7d09c6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  vds.exe
                                  • Path C:\Windows\System32\vds.exe
                                  • Size 1.3MB
                                  • SHA256 9a3d3c073a8853246db973f28b77ce78b77aa0d05bc42c1516933eea3d3a8286
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  WmiApSrv.exe
                                  • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                  • Size 1.7MB
                                  • SHA256 9f7880b70ec19747ef8dfefc0b40b6a8be6eff64af8736c185cef4b65367ff58
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  wbengine.exe
                                  • Path C:\Windows\System32\wbengine.exe
                                  • Size 2.1MB
                                  • SHA256 e4ca57b30c043056471a52349eb5ab7a5241ca01ab014ff8ba94a85e24245050
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  AppVClient.exe
                                  • Path C:\Windows\system32\AppVClient.exe
                                  • Size 1.3MB
                                  • SHA256 42dd4a48c54b5606670e66858d4ff3717e7c3cb3dfeccfbb788a2013c423af2d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  SgrmBroker.exe
                                  • Path C:\Windows\system32\SgrmBroker.exe
                                  • Size 1.8MB
                                  • SHA256 3e06721bf8a9ae86c1ad052f82d9c0fd6a23771e130ce6f8d13dd8174b8cc3f2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  msiexec.exe
                                  • Path C:\Windows\system32\msiexec.exe
                                  • Size 1.6MB
                                  • SHA256 15066f73d2fbeedc329344af53f9f3ede245ca700287a09c0783c532d27b9600
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  memory/520-153-0x0000000140000000-0x00000001401C0000-memory.dmp
                                  Download

                                  memory/520-151-0x0000000140000000-0x00000001401C0000-memory.dmp
                                  Download

                                  memory/1408-170-0x0000000140000000-0x00000001402A3000-memory.dmp
                                  Download

                                  memory/1408-512-0x0000000140000000-0x00000001402A3000-memory.dmp
                                  Download

                                  memory/1460-34-0x0000000000DA0000-0x0000000000E00000-memory.dmp
                                  Download

                                  memory/1460-33-0x0000000140000000-0x00000001402E9000-memory.dmp
                                  Download

                                  memory/1460-40-0x0000000000DA0000-0x0000000000E00000-memory.dmp
                                  Download

                                  memory/1460-131-0x0000000140000000-0x00000001402E9000-memory.dmp
                                  Download

                                  memory/1700-0-0x0000000001F20000-0x0000000001F80000-memory.dmp
                                  Download

                                  memory/1700-6-0x0000000001F20000-0x0000000001F80000-memory.dmp
                                  Download

                                  memory/1700-72-0x0000000140000000-0x0000000140400000-memory.dmp
                                  Download

                                  memory/1700-8-0x0000000140000000-0x0000000140400000-memory.dmp
                                  Download

                                  memory/1740-30-0x0000000140000000-0x0000000140135000-memory.dmp
                                  Download

                                  memory/1740-69-0x0000000140000000-0x0000000140135000-memory.dmp
                                  Download

                                  memory/2028-142-0x0000000000810000-0x0000000000870000-memory.dmp
                                  Download

                                  memory/2028-146-0x0000000140000000-0x00000001402DF000-memory.dmp
                                  Download

                                  memory/2028-136-0x0000000000810000-0x0000000000870000-memory.dmp
                                  Download

                                  memory/2028-354-0x0000000140000000-0x00000001402DF000-memory.dmp
                                  Download

                                  memory/2040-24-0x0000000140000000-0x0000000140286000-memory.dmp
                                  Download

                                  memory/2040-110-0x0000000140000000-0x0000000140286000-memory.dmp
                                  Download

                                  memory/2040-17-0x00000000004C0000-0x0000000000520000-memory.dmp
                                  Download

                                  memory/2040-26-0x00000000004C0000-0x0000000000520000-memory.dmp
                                  Download

                                  memory/2068-277-0x0000000140000000-0x00000001401D7000-memory.dmp
                                  Download

                                  memory/2068-116-0x0000000140000000-0x00000001401D7000-memory.dmp
                                  Download

                                  memory/2068-172-0x0000000140000000-0x00000001401D7000-memory.dmp
                                  Download

                                  memory/2188-165-0x0000000140000000-0x0000000140216000-memory.dmp
                                  Download

                                  memory/2188-391-0x0000000140000000-0x0000000140216000-memory.dmp
                                  Download

                                  memory/2688-109-0x0000000140000000-0x0000000140287000-memory.dmp
                                  Download

                                  memory/2688-13-0x0000000140000000-0x0000000140287000-memory.dmp
                                  Download

                                  memory/2732-365-0x0000000140000000-0x00000001402BF000-memory.dmp
                                  Download

                                  memory/2732-149-0x0000000140000000-0x00000001402BF000-memory.dmp
                                  Download

                                  memory/2744-384-0x0000000140000000-0x00000001401FC000-memory.dmp
                                  Download

                                  memory/2744-160-0x0000000140000000-0x00000001401FC000-memory.dmp
                                  Download

                                  memory/2936-50-0x0000000140000000-0x00000001402D4000-memory.dmp
                                  Download

                                  memory/2936-44-0x0000000000890000-0x00000000008F0000-memory.dmp
                                  Download

                                  memory/2936-51-0x0000000000890000-0x00000000008F0000-memory.dmp
                                  Download

                                  memory/2936-145-0x0000000140000000-0x00000001402D4000-memory.dmp
                                  Download

                                  memory/3264-168-0x0000000140000000-0x0000000140272000-memory.dmp
                                  Download

                                  memory/3264-114-0x0000000140000000-0x0000000140272000-memory.dmp
                                  Download

                                  memory/3496-222-0x0000000009E60000-0x0000000009E68000-memory.dmp
                                  Download

                                  memory/3496-187-0x0000000001770000-0x0000000001780000-memory.dmp
                                  Download

                                  memory/3496-360-0x000000000C8E0000-0x000000000C8E8000-memory.dmp
                                  Download

                                  memory/3496-173-0x0000000140000000-0x0000000140179000-memory.dmp
                                  Download

                                  memory/3496-203-0x0000000001A20000-0x0000000001A30000-memory.dmp
                                  Download

                                  memory/3496-591-0x0000000140000000-0x0000000140179000-memory.dmp
                                  Download

                                  memory/3580-93-0x0000000000B30000-0x0000000000B90000-memory.dmp
                                  Download

                                  memory/3580-87-0x0000000000B30000-0x0000000000B90000-memory.dmp
                                  Download

                                  memory/3580-98-0x0000000140000000-0x0000000140288000-memory.dmp
                                  Download

                                  memory/3580-159-0x0000000140000000-0x0000000140288000-memory.dmp
                                  Download

                                  memory/3724-101-0x0000000000940000-0x00000000009A6000-memory.dmp
                                  Download

                                  memory/3724-164-0x0000000000400000-0x0000000000674000-memory.dmp
                                  Download

                                  memory/3724-111-0x0000000000400000-0x0000000000674000-memory.dmp
                                  Download

                                  memory/3724-106-0x0000000000940000-0x00000000009A6000-memory.dmp
                                  Download

                                  memory/3968-121-0x0000000140000000-0x0000000140273000-memory.dmp
                                  Download

                                  memory/3968-290-0x0000000140000000-0x0000000140273000-memory.dmp
                                  Download

                                  memory/4084-73-0x0000000140000000-0x0000000140296000-memory.dmp
                                  Download

                                  memory/4204-371-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-378-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-585-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-584-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-583-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-582-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-581-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-587-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-592-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-593-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-594-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-595-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-589-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-590-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-588-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-578-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-579-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-580-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-577-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-576-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-575-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-374-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-375-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-377-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-380-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-381-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-382-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-586-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-379-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-376-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-373-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-372-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-370-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-369-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-368-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4204-367-0x000001A4BED70000-0x000001A4BED80000-memory.dmp
                                  Download

                                  memory/4236-157-0x0000000140000000-0x0000000140147000-memory.dmp
                                  Download

                                  memory/4236-366-0x0000000140000000-0x0000000140147000-memory.dmp
                                  Download

                                  memory/4388-123-0x0000000000690000-0x00000000006F0000-memory.dmp
                                  Download

                                  memory/4388-132-0x0000000140000000-0x0000000140169000-memory.dmp
                                  Download

                                  memory/4388-333-0x0000000140000000-0x0000000140169000-memory.dmp
                                  Download

                                  memory/4388-129-0x0000000000690000-0x00000000006F0000-memory.dmp
                                  Download

                                  memory/4580-64-0x0000000140000000-0x00000001402B2000-memory.dmp
                                  Download

                                  memory/4580-68-0x0000000140000000-0x00000001402B2000-memory.dmp
                                  Download

                                  memory/4580-66-0x0000000001A40000-0x0000000001AA0000-memory.dmp
                                  Download

                                  memory/4580-55-0x0000000001A40000-0x0000000001AA0000-memory.dmp
                                  Download

                                  memory/4580-61-0x0000000001A40000-0x0000000001AA0000-memory.dmp
                                  Download

                                  memory/4932-411-0x00007FFF5BCC0000-0x00007FFF5BCC1000-memory.dmp
                                  Download

                                  memory/4988-77-0x00000000004E0000-0x0000000000540000-memory.dmp
                                  Download

                                  memory/4988-156-0x0000000140000000-0x00000001402AC000-memory.dmp
                                  Download

                                  memory/4988-83-0x00000000004E0000-0x0000000000540000-memory.dmp
                                  Download

                                  memory/4988-76-0x0000000140000000-0x00000001402AC000-memory.dmp
                                  Download

                                  memory/5000-493-0x00007FFF5BAF0000-0x00007FFF5BAF1000-memory.dmp
                                  Download

                                  memory/5000-496-0x00007FFF5C6B0000-0x00007FFF5C6B1000-memory.dmp
                                  Download

                                  memory/5224-506-0x00007FFF5BCC0000-0x00007FFF5BCC1000-memory.dmp
                                  Download