Malwagon
file icon
VRCW-Recovery-Free.exe File Analysis · first seen Oct 9, 2026 18:49 · 55.9 MB
1proc 10files 102reg 4IOCs
Suspicious69 Completed Public
Get sample Report Sign in

VRCW-Recovery-Free.exetigerrat analysis report - Suspicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

19.3sto launch
153telemetry events
113observed
38agent notes

Suspicious

69/100

34 points past the suspicious line at 35, 1 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+35
Malware family
  • Identified as Tiger RAT (possible confidence, named by static_yara)
+26
Static analysis
  • 2 suspicious signature match(es)
  • 2 high-risk capability bucket(s): Privilege escalation, Process injection
+8
Review confirms
  • 3 of 3 local reviews independently read this as suspicious, on top of 26 points the platform measured itself
+0
Model review
  • findings review (advisory, not scored): suspicious - registry-policy-write, security-setting-change, dns-lookup, dropped-dll-extraction

Model reading

Measured SUSPICIOUS69 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran moved the score
Dynamic ran no points
Threat intel local feeds only no points
AI not included

Sample

TypeFile
MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10
EnvironmentWorkgroup
InternetIsolated
Execution161s
Guest hardware2 vCPU4095 MB RAM

Malware family

1 independent source
Tiger RAT possible

Named by a single source. Treat it as a lead rather than a classification.

LayerSourceWhat it matched
static_yara rule corpus TigerRAT_pe_yaraify

Detection signatures

22 detected · 12 withheld as common
Severity Detection Evidence Layer
HIGH
Thread-context hijack injection (SetThreadContext)
MITRE T1055.003
import kernel32.dll!SetThreadContext requires setthreadcontext
import kernel32.dll!GetThreadContext requires getthreadcontext
static
MED
Creates a suspended process then resumes (hollowing/hijack)
MITRE T1055.012
import kernel32.dll!CreateProcessW requires createprocess
import kernel32.dll!ResumeThread requires resumethread
static
MED
Exception-based anti-debug (SEH/VEH install)
MITRE T1622
import kernel32.dll!AddVectoredExceptionHandler
static
MED
Opens/suspends remote threads
MITRE T1055
import kernel32.dll!OpenThread requires openthread
import kernel32.dll!SuspendThread requires suspendthread
static
MED
Raw socket networking
MITRE T1095
import ws2_32.dll!WSAStartup
static
MED
TLS callback (pre-main execution)
MITRE T1055
pe_header IMAGE_DIRECTORY_ENTRY_TLS present callbacks run before the entry point
static
MED
Token impersonation
MITRE T1134.001
import advapi32.dll!ImpersonateLoggedOnUser
static
LOW
Adjusts token privileges (SeDebug / escalation)
MITRE T1134
seen in 8% of benign software
import advapi32.dll!AdjustTokenPrivileges
static
LOW
Checks system uptime (sandbox age check)
MITRE T1497.001
seen in 12% of benign software
import kernel32.dll!GetTickCount64
static
LOW
Cryptographic capability (packing/ransom)
MITRE T1573
seen in 6% of benign software
capability bcryptgenrandom capability: crypto
static
LOW
Deletes files/backups (WriteFile + DeleteFile recursion)
MITRE T1485
seen in 14% of benign software
import kernel32.dll!DeleteFileW requires deletefile
import kernel32.dll!FindNextFileW requires findnextfile
static
LOW
Direct memory execution (VirtualProtect + memory copy)
MITRE T1055
seen in 9% of benign software
import kernel32.dll!VirtualProtect requires virtualprotect
import kernel32.dll!VirtualAlloc requires virtualalloc
static
LOW
Driver communication via DeviceIoControl
MITRE T1068
seen in 10% of benign software
import kernel32.dll!DeviceIoControl
static
LOW
Duplicates a process handle (handle theft)
MITRE T1134
seen in 10% of benign software
import kernel32.dll!DuplicateHandle
static
LOW
Enumerates processes via EnumProcesses
MITRE T1057
import kernel32.dll!K32EnumProcesses
static
LOW
Executable heap allocation (GlobalAlloc + VirtualProtect)
MITRE T1055
seen in 6% of benign software
import kernel32.dll!GlobalAlloc requires globalalloc
import kernel32.dll!VirtualProtect requires virtualprotect
static
LOW
Network communication capability
MITRE T1071
seen in 6% of benign software
capability bind capability: network
capability recv capability: network
capability send capability: network
capability wsastartup capability: network
static
LOW
Process-injection capability
MITRE T1055
seen in 5% of benign software
capability getthreadcontext capability: injection
capability setthreadcontext capability: injection
static
LOW
Reflective/manual DLL load pattern
MITRE T1620
seen in 8% of benign software
import kernel32.dll!VirtualAlloc requires virtualalloc
import kernel32.dll!GetProcAddress requires getprocaddress
import kernel32.dll!LoadLibraryExW requires loadlibrary
import kernel32.dll!CreateThread requires createthread
static
LOW
Self-deletion pattern (MoveFileEx)
MITRE T1070.004
seen in 7% of benign software
import kernel32.dll!MoveFileExW
static
LOW
Sleep-based sandbox evasion
MITRE T1497.003
import kernel32.dll!SleepEx
static
LOW
Spawns child processes
MITRE T1106
seen in 16% of benign software
import kernel32.dll!CreateProcessW
static
Withheld: 12 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software
Anti-debugging capability fires on 65% of benign software
Dynamic API resolution (obfuscation) fires on 65% of benign software
Anti-debug: checks for a debugger fires on 60% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software
Anti-debug via OutputDebugString probe fires on 41% of benign software
WMI usage (recon / execution) fires on 40% of benign software
Creates a named mutex (single-instance / infection marker) fires on 31% of benign software
Executes external code / commands fires on 30% of benign software
Queries system information (host recon) fires on 25% of benign software
Enumerates registry keys (discovery) fires on 21% of benign software
Enumerates files recursively (staging/collection) fires on 21% of benign software

What the tests returned

8 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

TestResult
Persistence mechanismsnone established at runtime
Cross-process injectionnone observed
Network connectionsnot tested - internet was disabled
Behavioural rule matches (Sigma)none observed
Known-malicious hash (reputation sources)no source reported this file
Local anti-virus enginenot checked - the antivirus pass did not finish
Capability analysis of the file's codenot checked - the check ran past its time limit and was stopped
Anti-analysis / evasion checksnot measured on this run - no in-process API monitor reported in, so the runtime anti-debug and anti-VM calls were never watched

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

  • No reputation source reported this file as malicious.

How much weight this carries

Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: capability analysis of the file's imports.

Instrument coverage

0 of 2 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

LayerRanWhat that means
Runtime anti-analysis watch not measured Not measured. No in-process monitor reported in on this run, so the runtime anti-debug and anti-VM calls were never watched and an empty list is not a finding about the sample.
Live kernel introspection not measured Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature
Microsoft Visual C/C++(19.36.35721)[C++]
Not packed Unsigned
CompilerMicrosoft Visual C/C++(19.36.35721)[C++]
LinkerMicrosoft Linker(14.36.36260)
Library.NET Native(v9.0)[debug]
Identity
File
typeexecutable
size55.9 MB
file arch64-bit (x64)
subsystemGUI
entropy6.7182
date2026-10-09 08:14:02 UTC
version1.0.0.0
descriptionVRCW-Recovery Free
productVRCW-Recovery Free
original nameVRCW-Recovery.dll
languageNEU

Antivirus engine

no result signature set 28148 - 3.6M signatures

The antivirus pass did not produce a result for this file, so neither a detection nor a clean answer was established. This narrows what the run covered; it says nothing about the file itself. Cause: the scan ran past its time limit and was stopped.

Signature setValue
Set version28148
Signatures in the set3,642,847
Set published09 Oct 2026 06:25 +0000
Age when this file was scannedsame day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

no model score

No model score exists for this file: the file is larger than the 32 MB the local model is allowed to read in one scan, so it got a static heuristic instead. That is a gap in coverage and not a finding - the absence of a score here says nothing about the file.

Structural rules of thumb, not a model. 2 cheap static signals fired, for 15 of 100 on a rule-of-thumb scale that is deliberately left out of the verdict score: the packing, entropy and signing cards on this report already price the same facts, and counting them a second time under a machine-learning heading would charge one piece of evidence twice.

  • unsigned executable
  • TLS callback
Packing
Not packed
This file's code is readable on disk - nothing is compressed or encrypted around it.
16/100
packer confidence
Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.
Indicators weighed 2 signals
  • High-entropy resource (possible packed payload)
  • TLS callback present

Family configuration search

Not attempted

The sample is 55.9 MB and the config parser pass is bounded at 16.0 MB, so no family parser was run against it - a family configuration may exist in this file and was not looked for. The absence of an extracted configuration is therefore not evidence about this sample.

Sample size55.9 MB
Bound16.0 MB
Limit reachedSample size, before any parser was loaded.

Capabilities

10 behaviour buckets · 4 high-risk
SeverityCapabilityMITREAPIs
high Privilege escalation
Adjusts tokens / privileges
 T1134, T1134.001 adjusttokenprivileges, impersonateloggedonuser, openprocesstoken
high Process injection
Writes and runs code inside another process
 T1055.012 getthreadcontext, setthreadcontext
high Ransomware behaviour
Enumerates + encrypts files, deletes backups
 T1083 findnextfilew
high Anti-debugging
Detects or obstructs a debugger
 T1622 isdebuggerpresent
med Evasion / stalling
Sleeps, times, or otherwise stalls analysis
 T1497, T1497.003 getsystemtimeasfiletime, gettickcount64, queryperformancecounter, sleep, sleepex
med Network / C2
Opens sockets, HTTP or downloads payloads
 T1071, T1095 bind, recv, send, wsastartup
med Code execution
Creates processes / runs commands or shellcode
 T1106 createprocessw, createthread
med Dynamic API resolution
Resolves APIs at runtime (obfuscation)
 T1129 getprocaddress, loadlibraryw
med Cryptography
Uses crypto APIs (often ransomware / packers)
 T1573 bcryptgenrandom
low Discovery
Enumerates the host, users, processes or network
 T1082 getsysteminfo

Security mitigations

partial posture
ON ASLR (DynamicBase)
ON High-entropy ASLR (64-bit)
ON DEP / NX (NxCompat)
OFF Control Flow Guard
OFF SafeSEH
ON Stack cookies (GS)
OFF Force Integrity
OFF AppContainer isolation
OFF Authenticode signed

Rich header (toolchain)

richhash cef3706840880876
ToolBuildUses
Utc1900 (VS2017)357219
Cvtres 14.103572113
Export 14.103572147
prodid_1473072914
Utc1900 (VS2017)3314523
Import (linker)0398
Utc1900 (VS2017)3522810
Cvtres 14.103522844
Unknown01
Export 14.103522865
Alias362601
AliasObj 14.10362601

Sections

6 sections · the file's memory layout
SectionVirtual addrRaw sizeVirtual sizeAccessEntropy
.textEP
Executable code
 0x1000
16.1 MB
16.1 MB
EXECUTEREAD
6.526
.rdata
Read-only data
 0x101f000
35.7 MB
35.7 MB
READ
6.6747
.data
Initialised data
 0x33df000
1.9 MB
2.3 MB
READWRITE
3.6851
.pdata
Exception unwind data
 0x3634000
995.0 KB
994.8 KB
READ
6.7845
.rsrc
Resources
 0x372d000
98.0 KB
98.0 KB
READ
7.9381
.reloc
Base relocations
 0x3746000
1.1 MB
1.1 MB
READ
5.4667
code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

375 funcs / 18 DLLs · 15 suspicious
▸ADVAPI32.dll29 funcs 3 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
AddMandatoryAce 0x0101f000 - -
AdjustTokenPrivileges 0x0101f008 - T1134
CreateWellKnownSid 0x0101f010 - -
DeregisterEventSource 0x0101f018 - -
EqualSid 0x0101f020 - -
GetAce 0x0101f028 - -
GetLengthSid 0x0101f030 - -
GetSidSubAuthority 0x0101f038 - -
GetSidSubAuthorityCount 0x0101f040 - -
GetTokenInformation 0x0101f048 - -
ImpersonateLoggedOnUser 0x0101f050 - -
InitializeAcl 0x0101f058 - -
InitializeSecurityDescriptor 0x0101f060 - -
LookupPrivilegeValueW 0x0101f068 - T1134
OpenProcessToken 0x0101f070 - T1134
OpenThreadToken 0x0101f078 - -
RegCloseKey 0x0101f080 - -
RegEnumKeyExW 0x0101f088 - -
RegEnumValueW 0x0101f090 - -
RegNotifyChangeKeyValue 0x0101f098 - -
RegOpenKeyExW 0x0101f0a0 - -
RegQueryValueExW 0x0101f0a8 - -
RegisterEventSourceW 0x0101f0b0 - -
ReportEventW 0x0101f0b8 - -
RevertToSelf 0x0101f0c0 - -
SetSecurityDescriptorDacl 0x0101f0c8 - -
SetSecurityDescriptorGroup 0x0101f0d0 - -
SetSecurityDescriptorOwner 0x0101f0d8 - -
SetSecurityDescriptorSacl 0x0101f0e0 - -
▸bcrypt.dll11 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
BCryptHashData 0x0101fb58 - -
BCryptExportKey 0x0101fb60 - -
BCryptGetProperty 0x0101fb68 - -
BCryptGenRandom 0x0101fb70 - -
BCryptFinishHash 0x0101fb78 - -
BCryptCloseAlgorithmProvider 0x0101fb80 - -
BCryptCreateHash 0x0101fb88 - -
BCryptDestroyKey 0x0101fb90 - -
BCryptImportKeyPair 0x0101fb98 - -
BCryptOpenAlgorithmProvider 0x0101fba0 - -
BCryptDestroyHash 0x0101fba8 - -
▸CRYPT32.dll20 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
CertNameToStrW 0x0101f0f0 - -
CertGetNameStringW 0x0101f0f8 - -
CertGetCertificateContextProperty 0x0101f100 - -
CertGetCertificateChain 0x0101f108 - -
CertFreeCertificateContext 0x0101f110 - -
CertFreeCertificateChainEngine 0x0101f118 - -
CertFreeCertificateChain 0x0101f120 - -
CryptImportPublicKeyInfoEx2 0x0101f128 - -
CryptFormatObject 0x0101f130 - -
CryptFindOIDInfo 0x0101f138 - -
CryptDecodeObject 0x0101f140 - -
CertVerifyCertificateChainPolicy 0x0101f148 - -
CertAddCertificateContextToStore 0x0101f150 - -
CertAddCertificateLinkToStore 0x0101f158 - -
CertCloseStore 0x0101f160 - -
CertControlStore 0x0101f168 - -
CertCreateCertificateChainEngine 0x0101f170 - -
CertDuplicateCertificateContext 0x0101f178 - -
CertEnumCertificatesInStore 0x0101f180 - -
CertOpenStore 0x0101f188 - -
▸IPHLPAPI.DLL5 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
ConvertInterfaceNameToLuidW 0x0101f198 - -
GetAdaptersAddresses 0x0101f1a0 - -
GetNetworkParams 0x0101f1a8 - -
GetPerAdapterInfo 0x0101f1b0 - -
ConvertInterfaceLuidToIndex 0x0101f1b8 - -
▸KERNEL32.dll194 funcs 10 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
HeapFree 0x0101f1c8 - -
GetProcessHeap 0x0101f1d0 - -
InitializeSListHead 0x0101f1d8 - -
SetUnhandledExceptionFilter 0x0101f1e0 - -
RtlUnwindEx 0x0101f1e8 yes -
RtlPcToFileHeader 0x0101f1f0 yes -
FlsFree 0x0101f1f8 - -
EncodePointer 0x0101f200 - -
AttachConsole 0x0101f208 - -
CancelIoEx 0x0101f210 - -
CancelSynchronousIo 0x0101f218 - -
CancelThreadpoolIo 0x0101f220 - -
CloseHandle 0x0101f228 - -
CloseThreadpoolIo 0x0101f230 - -
CloseThreadpoolWait 0x0101f238 - -
CloseThreadpoolWork 0x0101f240 - -
CompareStringEx 0x0101f248 - -
CompareStringOrdinal 0x0101f250 - -
CopyFileExW 0x0101f258 - -
CreateDirectoryW 0x0101f260 - -
CreateEventExW 0x0101f268 - -
CreateFileMappingW 0x0101f270 - -
CreateFileW 0x0101f278 - -
CreateHardLinkW 0x0101f280 - -
CreateMutexExW 0x0101f288 - -
CreatePipe 0x0101f290 - -
CreateProcessW 0x0101f298 - T1106
CreateThread 0x0101f2a0 - -
CreateThreadpoolIo 0x0101f2a8 - -
CreateThreadpoolTimer 0x0101f2b0 - -
CreateThreadpoolWait 0x0101f2b8 - -
CreateThreadpoolWork 0x0101f2c0 - -
DeleteCriticalSection 0x0101f2c8 - -
DeleteFileW 0x0101f2d0 - -
DeleteVolumeMountPointW 0x0101f2d8 - -
DeviceIoControl 0x0101f2e0 - -
DuplicateHandle 0x0101f2e8 - -
EnterCriticalSection 0x0101f2f0 - -
EnumCalendarInfoExEx 0x0101f2f8 - -
EnumSystemLocalesEx 0x0101f300 - -
EnumTimeFormatsEx 0x0101f308 - -
ExpandEnvironmentStringsW 0x0101f310 - -
FileTimeToSystemTime 0x0101f318 - -
FindClose 0x0101f320 - -
FindFirstFileExW 0x0101f328 - -
FindNLSStringEx 0x0101f330 - -
FindNextFileW 0x0101f338 - T1083
FindStringOrdinal 0x0101f340 - -
FlushFileBuffers 0x0101f348 - -
FlushViewOfFile 0x0101f350 - -
FormatMessageW 0x0101f358 - -
FreeEnvironmentStringsW 0x0101f360 - -
FreeLibrary 0x0101f368 - -
GetCPInfo 0x0101f370 - -
GetCPInfoExW 0x0101f378 - -
GetCalendarInfoEx 0x0101f380 - -
GetConsoleCP 0x0101f388 - -
GetConsoleMode 0x0101f390 - -
GetConsoleOutputCP 0x0101f398 - -
GetCurrentDirectoryW 0x0101f3a0 - -
GetCurrentProcess 0x0101f3a8 - -
GetCurrentProcessId 0x0101f3b0 - -
GetCurrentProcessorNumberEx 0x0101f3b8 - -
GetCurrentThread 0x0101f3c0 - -
GetCurrentThreadId 0x0101f3c8 - -
GetDynamicTimeZoneInformation 0x0101f3d0 - -
GetEnvironmentStringsW 0x0101f3d8 - -
GetEnvironmentVariableW 0x0101f3e0 - -
GetExitCodeProcess 0x0101f3e8 - -
GetFileAttributesExW 0x0101f3f0 - -
GetFileInformationByHandleEx 0x0101f3f8 - -
GetFileType 0x0101f400 - -
GetFinalPathNameByHandleW 0x0101f408 - -
GetFullPathNameW 0x0101f410 - -
GetLastError 0x0101f418 - -
GetLocaleInfoEx 0x0101f420 - -
GetLongPathNameW 0x0101f428 - -
GetModuleFileNameW 0x0101f430 - -
GetModuleHandleW 0x0101f438 - -
GetOverlappedResult 0x0101f440 - -
GetProcAddress 0x0101f448 - T1129
GetProcessId 0x0101f450 - -
GetProcessTimes 0x0101f458 - -
GetStdHandle 0x0101f460 - -
GetSystemDirectoryW 0x0101f468 - -
GetSystemInfo 0x0101f470 - -
GetSystemTime 0x0101f478 - -
GetThreadPriority 0x0101f480 - -
GetTickCount64 0x0101f488 - -
GetTimeZoneInformation 0x0101f490 - -
GetUserPreferredUILanguages 0x0101f498 - -
GlobalAlloc 0x0101f4a0 - -
GlobalMemoryStatusEx 0x0101f4a8 - -
InitializeConditionVariable 0x0101f4b0 - -
InitializeCriticalSection 0x0101f4b8 - -
InitializeCriticalSectionEx 0x0101f4c0 - -
K32EnumProcesses 0x0101f4c8 - -
LCIDToLocaleName 0x0101f4d0 - -
LCMapStringEx 0x0101f4d8 - -
LeaveCriticalSection 0x0101f4e0 - -
LoadLibraryExW 0x0101f4e8 - -
LoadLibraryW 0x0101f4f0 - T1129
LocalAlloc 0x0101f4f8 - -
LocalFree 0x0101f500 - -
LocalReAlloc 0x0101f508 - -
LocaleNameToLCID 0x0101f510 - -
MapViewOfFile 0x0101f518 - -
MoveFileExW 0x0101f520 - -
MultiByteToWideChar 0x0101f528 - -
OpenProcess 0x0101f530 - -
OpenThread 0x0101f538 - -
OutputDebugStringW 0x0101f540 - T1622
QueryPerformanceCounter 0x0101f548 - T1497
QueryPerformanceFrequency 0x0101f550 - -
QueryUnbiasedInterruptTime 0x0101f558 - -
RaiseFailFastException 0x0101f560 - -
ReadConsoleW 0x0101f568 - -
ReadFile 0x0101f570 - -
ReleaseMutex 0x0101f578 - -
RemoveDirectoryW 0x0101f580 - -
ResetEvent 0x0101f588 - -
ResolveLocaleName 0x0101f590 - -
ResumeThread 0x0101f598 - -
SetConsoleCtrlHandler 0x0101f5a0 - -
SetConsoleOutputCP 0x0101f5a8 - -
SetEvent 0x0101f5b0 - -
SetFileInformationByHandle 0x0101f5b8 - -
SetFilePointerEx 0x0101f5c0 - -
SetLastError 0x0101f5c8 - -
SetThreadErrorMode 0x0101f5d0 - -
SetThreadPriority 0x0101f5d8 - -
SetThreadpoolTimer 0x0101f5e0 - -
SetThreadpoolWait 0x0101f5e8 - -
Sleep 0x0101f5f0 - -
SleepConditionVariableCS 0x0101f5f8 - -
StartThreadpoolIo 0x0101f600 - -
SubmitThreadpoolWork 0x0101f608 - -
SystemTimeToFileTime 0x0101f610 - -
TerminateProcess 0x0101f618 - -
TzSpecificLocalTimeToSystemTime 0x0101f620 - -
UnmapViewOfFile 0x0101f628 - -
VirtualAlloc 0x0101f630 - T1055
VirtualFree 0x0101f638 - -
VirtualQuery 0x0101f640 - -
WaitForMultipleObjectsEx 0x0101f648 - -
WaitForSingleObject 0x0101f650 - -
WaitForThreadpoolWaitCallbacks 0x0101f658 - -
WakeConditionVariable 0x0101f660 - -
WideCharToMultiByte 0x0101f668 - -
WriteConsoleW 0x0101f670 - -
WriteFile 0x0101f678 - -
RaiseException 0x0101f680 - -
AddVectoredExceptionHandler 0x0101f688 - -
RtlVirtualUnwind 0x0101f690 yes -
RtlCaptureContext 0x0101f698 yes -
RtlRestoreContext 0x0101f6a0 yes -
VerSetConditionMask 0x0101f6a8 - -
FlsAlloc 0x0101f6b0 - -
FlsGetValue 0x0101f6b8 - -
FlsSetValue 0x0101f6c0 - -
WaitForSingleObjectEx 0x0101f6c8 - -
CreateEventW 0x0101f6d0 - -
SwitchToThread 0x0101f6d8 - -
SuspendThread 0x0101f6e0 - -
FlushProcessWriteBuffers 0x0101f6e8 - -
GetThreadContext 0x0101f6f0 - -
SetThreadContext 0x0101f6f8 - T1055
FlushInstructionCache 0x0101f700 - -
GetSystemTimeAsFileTime 0x0101f708 - -
VirtualProtect 0x0101f710 - T1055
CreateMemoryResourceNotification 0x0101f718 - -
QueryInformationJobObject 0x0101f720 - -
GetModuleHandleExW 0x0101f728 - -
GetProcessAffinityMask 0x0101f730 - -
VerifyVersionInfoW 0x0101f738 - -
InitializeContext 0x0101f740 - -
GetEnabledXStateFeatures 0x0101f748 - -
LocateXStateFeature 0x0101f750 - -
SetXStateFeaturesMask 0x0101f758 - -
DebugBreak 0x0101f760 - -
SleepEx 0x0101f768 - -
GetLogicalProcessorInformation 0x0101f770 - -
GetLogicalProcessorInformationEx 0x0101f778 - -
GetLargePageMinimum 0x0101f780 - -
VirtualUnlock 0x0101f788 - -
VirtualAllocExNuma 0x0101f790 - -
IsProcessInJob 0x0101f798 - -
GetNumaHighestNodeNumber 0x0101f7a0 - -
GetProcessGroupAffinity 0x0101f7a8 - -
K32GetProcessMemoryInfo 0x0101f7b0 - -
IsDebuggerPresent 0x0101f7b8 - T1622
HeapCreate 0x0101f7c0 - -
HeapDestroy 0x0101f7c8 - -
HeapAlloc 0x0101f7d0 - -
▸ncrypt.dll7 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
NCryptGetProperty 0x0101fbb8 - -
NCryptFreeObject 0x0101fbc0 - -
NCryptImportKey 0x0101fbc8 - -
NCryptOpenKey 0x0101fbd0 - -
NCryptOpenStorageProvider 0x0101fbd8 - -
NCryptSetProperty 0x0101fbe0 - -
NCryptDeleteKey 0x0101fbe8 - -
▸ole32.dll9 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
CoGetApartmentType 0x0101fbf8 - -
CoGetContextToken 0x0101fc00 - -
CoInitializeEx 0x0101fc08 - -
CoCreateInstance 0x0101fc10 - -
CoCreateGuid 0x0101fc18 - -
CoTaskMemAlloc 0x0101fc20 - -
CoTaskMemFree 0x0101fc28 - -
CoUninitialize 0x0101fc30 - -
CoWaitForMultipleHandles 0x0101fc38 - -
▸OLEAUT32.dll7 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
SafeArrayCreate 0x0101f7e0 - -
SysFreeString 0x0101f7e8 - -
SafeArrayDestroy 0x0101f7f0 - -
SafeArrayLock 0x0101f7f8 - -
SafeArrayUnlock 0x0101f800 - -
SysAllocStringLen 0x0101f808 - -
GetErrorInfo 0x0101f810 - -
▸USER32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
LoadStringW 0x0101f820 - -
▸VERSION.dll3 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
VerQueryValueW 0x0101f830 - -
GetFileVersionInfoSizeExW 0x0101f838 - -
GetFileVersionInfoExW 0x0101f840 - -
▸WS2_32.dll26 funcs 2 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
WSAEventSelect 0x0101f850 - -
select 0x0101f858 - -
send 0x0101f860 - T1071
WSAConnect 0x0101f868 - -
listen 0x0101f870 - -
ioctlsocket 0x0101f878 - -
setsockopt 0x0101f880 - -
shutdown 0x0101f888 - -
WSAGetOverlappedResult 0x0101f890 - -
WSAIoctl 0x0101f898 - -
WSARecv 0x0101f8a0 - -
WSASend 0x0101f8a8 - -
GetNameInfoW 0x0101f8b0 - -
WSASocketW 0x0101f8b8 - -
WSAStartup 0x0101f8c0 - T1071
bind 0x0101f8c8 - -
closesocket 0x0101f8d0 - -
getpeername 0x0101f8d8 - -
getsockname 0x0101f8e0 - -
recv 0x0101f8e8 - -
FreeAddrInfoExW 0x0101f8f0 - -
FreeAddrInfoW 0x0101f8f8 - -
GetAddrInfoExW 0x0101f900 - -
GetAddrInfoW 0x0101f908 - -
WSACleanup 0x0101f910 - -
getsockopt 0x0101f918 - -
▸api-ms-win-crt-heap-l1-1-0.dll8 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
realloc 0x0101f938 - -
_aligned_malloc 0x0101f940 - -
calloc 0x0101f948 - -
_set_new_mode 0x0101f950 - -
_callnewh 0x0101f958 - -
malloc 0x0101f960 - -
free 0x0101f968 - -
_aligned_free 0x0101f970 - -
▸api-ms-win-crt-math-l1-1-0.dll21 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
pow 0x0101f990 - -
sin 0x0101f998 - -
sinf 0x0101f9a0 - -
tan 0x0101f9a8 - -
tanf 0x0101f9b0 - -
log10 0x0101f9b8 - -
__setusermatherr 0x0101f9c0 - -
acos 0x0101f9c8 - -
acosf 0x0101f9d0 - -
asin 0x0101f9d8 - -
atan 0x0101f9e0 - -
atan2 0x0101f9e8 - -
modf 0x0101f9f0 - -
ceil 0x0101f9f8 - -
cos 0x0101fa00 - -
cosf 0x0101fa08 - -
exp 0x0101fa10 - -
floor 0x0101fa18 - -
fmod 0x0101fa20 - -
fmodf 0x0101fa28 - -
log 0x0101fa30 - -
▸api-ms-win-crt-string-l1-1-0.dll6 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
strlen 0x0101fb20 - -
_stricmp 0x0101fb28 - -
strcmp 0x0101fb30 - -
strcpy 0x0101fb38 - -
strncpy_s 0x0101fb40 - -
strcpy_s 0x0101fb48 - -
▸api-ms-win-crt-convert-l1-1-0.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
strtoull 0x0101f928 - -
▸api-ms-win-crt-stdio-l1-1-0.dll7 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
__stdio_common_vfprintf 0x0101fae0 - -
__stdio_common_vsprintf_s 0x0101fae8 - -
__stdio_common_vsscanf 0x0101faf0 - -
__acrt_iob_func 0x0101faf8 - -
_set_fmode 0x0101fb00 - -
__p__commode 0x0101fb08 - -
__stdio_common_vsnprintf_s 0x0101fb10 - -
▸api-ms-win-crt-runtime-l1-1-0.dll19 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
_c_exit 0x0101fa40 - -
_cexit 0x0101fa48 - -
_set_app_type 0x0101fa50 - -
__p___wargv 0x0101fa58 - -
terminate 0x0101fa60 - -
_crt_atexit 0x0101fa68 - -
_register_onexit_function 0x0101fa70 - -
__p___argc 0x0101fa78 - -
_configure_wide_argv 0x0101fa80 - -
_initialize_onexit_table 0x0101fa88 - -
_exit 0x0101fa90 - -
exit 0x0101fa98 - -
_initterm_e 0x0101faa0 - -
_seh_filter_exe 0x0101faa8 - -
_initterm 0x0101fab0 - -
abort 0x0101fab8 - -
_initialize_wide_environment 0x0101fac0 - -
_get_initial_wide_environment 0x0101fac8 - -
_register_thread_local_exe_atexit_callback 0x0101fad0 - -
▸api-ms-win-crt-locale-l1-1-0.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
_configthreadlocale 0x0101f980 - -

Binary metadata

what the headers declare about this build
Resource langsNEU
Debug infoyes
TLS callbacksyes

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Threat classification

Signature family candidates
FamilyAgreeing rulesMatched rulesDisposition
Tiger RAT1TigerRAT_pe_yaraify Not a classification: one rule cannot establish a family, so this named nothing and scored nothing.

Capability detection

not completed

The capability analysis of this file's code did not finish, so what the file is able to do was not established from its instructions. This narrows what the run covered - read it alongside Coverage rather than as a finding about the file. Cause: the check ran past its time limit and was stopped.

Signature matches

5 findings · 4 file properties · 2 scored
Rule What it matched Corpus Weight
Suspicious_Anti_Debug_API
Anti-debugging API names referenced
3 of 4 strings matched
$a IsDebuggerPresent at 0x18e53f0 · 4 hits
$c NtQueryInformationProcess at 0x112e5a8 · 3 hits
$d OutputDebugString at 0x11527a0 · 3 hits
Built-in
ruleset this platform ships, and the only one the score reads
 SCORED 5
Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.
Embedded_PE_In_Overlay
A second MZ/PE header appears inside the file body
1 of 1 string matched
$mz MZ at 0x0 · 459 hits
Built-in
ruleset this platform ships, and the only one the score reads
 SCORED 5
Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.
TigerRAT_pe_yaraify
rule dated 2026-08-21
YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits
1 of 1 string matched
$c0 \x0f\xb6\x08B\x0f\xb6\x14\x00+\xcau\x07H\xff\xc0\x85\xd2u\xed at 0x1a948da · 2 hits
Tier 1 - curated family set
licence-gated and benign-tested; may name a malware family
 SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
Names Tiger RAT, but one rule cannot establish a family: two independent rules must agree, so this named nothing.
maldoc_getEIP_method_1
maldoc
No description
1 of 1 string matched
$a \xe8\x00\x00\x00\x00X at 0x29dd60b · 2 hits
Tier 3 - community corpus
casts no family vote; every measured false family match came from here
 SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
possible_includes_base64_packed_functions
Detects possible includes and packed functions
2 of 2 strings matched
$f ;base64 at 0x23aebb4 · 9 hits
$fff This at 0x4e · 1000000 hits
Tier 3 - community corpus
casts no family vote; every measured false family match came from here
 SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
File properties - not findings
IsPE64IsWindowsGUIHasDebugDataHasRichSignature

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

Extracted strings

showing 93
  • !This program cannot be run in DOS mode.
  • Rich
  • .text
  • `.rdata
  • @.data
  • .pdata
  • @.rsrc
  • @.reloc
  • WVUSH
  • edCodeSiH
  • es[sym] H
  • UINT32_MH
  • cur_levH
  • el_of
  • BitBufSiH
  • num_codeH
  • m_capaciH
  • city
  • al_used_H
  • of memoH
  • _bitf
  • rn_decomH
  • e too biH
  • EDD;S
  • T$PAi
  • PHH+C H
  • 9h tHH
  • z%u#f
  • ` WVUSH
  • #WVUSH
  • atem9
  • .wCH
  • 2letA
  • ulet
  • aahtA
  • tbitA
  • tbit
  • 2lmtA
  • lmat
  • 2yroA
  • ayro
  • hnisA
  • hnis
  • gnomA
  • gnom
  • 2mymA
  • adnk
  • 2mlmA
  • urug
  • 2vedA
  • aved
  • baraA
  • bara
  • gneb
  • tsop9
  • BUSG
  • SOPG
  • eman9
  • pamc9
  • =.TD
  • -.NC
  • =.rB
  • .CPv
  • .APv
  • usfA
  • .MXv
  • sHE86H
  • zvutH
  • z%u#A
  • .Wxr
  • A+FPA
  • cuRH
  • .CHv
  • zutH
  • w.fE
  • thfA
  • %l)7
  • tBE86H
  • wHE86H
  • vHE86H
  • L$THc
  • ;k@tTH
  • tBE8$$H
  • u.eH
  • %u H
  • .tmH
  • HostfA
  • flat
  • mutA
  • <N.uAH
  • AXH;E
  • \t.fD
  • t.Hc

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Disassembly

entry point · x64 · 60 insns (listing capped)
AddressBytesMnemonicOperands
0x1410020d04883ec28subrsp, 0x28
0x1410020d4e817090000call0x1410029f0
0x1410020d94883c428addrsp, 0x28
0x1410020dde96efeffffjmp0x141001f50
0x1410020e2ccint3
0x1410020e3ccint3
0x1410020e4ccint3
0x1410020e5ccint3
0x1410020e6ccint3
0x1410020e7ccint3
0x1410020e8ccint3
0x1410020e9ccint3
0x1410020eaccint3
0x1410020ebccint3
0x1410020ecccint3
0x1410020edccint3
0x1410020eeccint3
0x1410020efccint3
0x1410020f083fa02cmpedx, 2
0x1410020f37560jne0x141002155
0x1410020f548895c2408movqword ptr [rsp + 8], rbx
0x1410020fa57pushrdi
0x1410020fb4883ec20subrsp, 0x20
0x1410020ff8b0d531a6302movecx, dword ptr [rip + 0x2631a53]
0x14100210565488b042558000000movrax, qword ptr gs:[0x58]
0x14100210eba28010000movedx, 0x128
0x141002113488b04c8movrax, qword ptr [rax + rcx*8]
0x141002117803c1001cmpbyte ptr [rax + rdx], 1
0x14100211b742eje0x14100214b
0x14100211dc6041001movbyte ptr [rax + rdx], 1
0x141002121488d1db8db0100learbx, [rip + 0x1dbb8]
0x141002128488d3db9db0100leardi, [rip + 0x1dbb9]
0x14100212f483bdfcmprbx, rdi
0x1410021327417je0x14100214b
0x141002134488b03movrax, qword ptr [rbx]
0x1410021374885c0testrax, rax
0x14100213a7406je0x141002142
0x14100213cff1516db0100callqword ptr [rip + 0x1db16]
0x1410021424883c308addrbx, 8
0x141002146483bdfcmprbx, rdi
0x14100214975e9jne0x141002134
0x14100214b488b5c2430movrbx, qword ptr [rsp + 0x30]
0x1410021504883c420addrsp, 0x20
0x1410021545fpoprdi
0x141002155c3ret
0x141002156ccint3
0x141002157ccint3
0x141002158ccint3
0x141002159ccint3
0x14100215accint3
0x14100215bccint3
0x14100215cccint3
0x14100215dccint3
0x14100215eccint3
0x14100215fccint3
0x14100216048895c2408movqword ptr [rsp + 8], rbx
0x14100216557pushrdi
0x1410021664883ec20subrsp, 0x20
0x14100216a8b0de8196302movecx, dword ptr [rip + 0x26319e8]
0x14100217065488b042558000000movrax, qword ptr gs:[0x58]
callbranchretstackarithregisterimmediatememory

Import fingerprint

no related sample
Fingerprint96:95260kr8mq47K9SMVf0BavqXWoTG7g5Znli5tpDXhCsj/sxHIxnXAX19X2Xmn1XP:9lrS47K9S0eNxL5QjPwF9mU1rVQLQog
Imports read375 functions from 18 libraries (375 distinct)
Comparableyes
Compared against8 stored samples
Samples built on the same import table

No stored sample you can see shares this import table.

Screen recording

32 frames · screen recording · 161s
Screen recording frame
1 / 32
0:00 · 1/32
Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 161s

1 process(es) observed

LaunchedC:\Users\user\Desktop\VRCW-Recovery-Free.exe
Privilegestandard
Telemetry sources: Kernel ETW (114 of 461 events) agent poll: 11Process audit: 1keydiff: 86In-process monitor: 24

Evasion / anti-analysis checks

2 checks
MED
Anti-debug API imports static-api
MITRE T1622 · getthreadcontext, isdebuggerpresent
MED
YARA: Suspicious_Anti_Debug_API Signature
MITRE T1497

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 1044 operations on the machine during the run; none of them came from the sample's process tree.

Command lines, unwrapped

1 read

1 captured text was read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

1process
8file operations
16registry operations

VRCW-Recovery-Free.exe

1 process
1 process

Attributed activity

Not attributed to any process

2 kinds

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

File operations2
Registry operations86
0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean
  • Active Setup Installed Component T1547.014 clean
  • Explorer Delay-Load Object T1547.001 clean
  • Explorer Run Key T1547.001 clean
  • Explorer SharedTaskScheduler T1547.001 clean
  • Group Policy Extension DLL T1547.004 clean
  • Group Policy Run Key T1547.001 clean
  • Logon Script T1037.001 clean
  • RDP WDS Startup Program T1547.001 clean
  • Registry Run Key T1547.001 clean
  • Registry RunEx Key T1547.001 clean
  • Registry RunOnce Key T1547.001 clean
  • Registry RunOnceEx Key T1547.001 clean
  • Registry RunServices Key T1547.001 clean
  • Startup Folder Item T1547.001 clean
  • Startup Folder Redirection T1547.001 clean
  • Terminal Services Initial Program T1547.001 clean
  • Winlogon GINA DLL T1547.004 clean
  • Winlogon MPNotify Value T1547.004 clean
  • Winlogon Notify Package T1547.004 clean
  • Winlogon Shell Value T1547.004 clean
  • Winlogon Taskman Value T1547.004 clean
  • Winlogon Userinit Value T1547.004 clean
Services & Tasks 9 clean
  • BITS Job T1197 clean
  • Print Monitor DLL T1547.010 clean
  • Print Processor DLL T1547.012 clean
  • Scheduled Task T1053.005 clean
  • Scheduled Task Registry Implant T1053.005 clean
  • Service Control Manager Security Descriptor T1574.011 clean
  • Service DLL Hijack T1543.003 clean
  • Time Provider DLL T1547.003 clean
  • Windows Service Creation T1543.003 clean
Execution Hijack 17 clean
  • .NET Managed Debugger T1546.012 clean
  • Accessibility Tool Hijack T1546.008 clean
  • AeDebug Postmortem Debugger T1546.012 clean
  • App Paths Hijack T1546.012 clean
  • Application Shim Database T1546.011 clean
  • Boot Verification Program T1547.002 clean
  • Command Processor AutoRun T1546.011 clean
  • Explorer Load Value T1547.001 clean
  • Explorer MyComputer Tool Hijack T1546.001 clean
  • Registry Image File Execution Options T1546.012 clean
  • Screensaver Hijack T1546.002 clean
  • Setup ErrorHandler Script T1546 clean
  • Shell Open Command Hijack T1546.001 clean
  • SilentProcessExit Monitor T1546.012 clean
  • Telemetry Controller Command T1546.015 clean
  • WER ReflectDebugger T1546.012 clean
  • Windows Error Reporting Debugger T1546.012 clean
DLL Load Order 12 clean
  • .NET CLR Profiler DLL T1574.012 clean
  • .NET Startup Hook DLL T1574 clean
  • AppCert DLLs T1546.009 clean
  • AppInit DLLs T1546.010 clean
  • AutodialDLL Winsock Injection T1546.006 clean
  • DLL Search-Order Hijack T1574.001 T1574.002 clean
  • DNS Server Plugin DLL T1574.001 clean
  • HTML Help Helper DLL T1546 clean
  • KnownDLLs Manipulation T1574.001 clean
  • Natural Language Platform DLL Override T1546 clean
  • Netsh Helper DLL T1546.007 clean
  • Winsock Layered Service Provider T1546.006 clean
COM & Browser 6 clean
  • Browser Extension T1176 clean
  • Browser Helper Object T1176 clean
  • COM Server Hijack T1546.015 clean
  • HTML Help COM Object Hijack T1546.015 clean
  • Shell Context Menu Handler T1546.001 clean
  • Shell Extension Handler T1546.001 clean
Security Providers & Accounts 11 clean
  • Account RID Hijack T1098 clean
  • AMSI Provider T1562.001 clean
  • Credential Provider T1547.014 clean
  • DSRM Admin Logon Backdoor T1556 clean
  • Hidden Local Account T1136.001 clean
  • LSA Authentication Package T1547.002 clean
  • LSA Extension DLL T1547.005 clean
  • LSA Notification Package T1547.005 clean
  • LSA Security Package T1547.005 clean
  • Network Provider DLL T1556.008 clean
  • Security Support Provider T1547.005 clean
Scripting & Applications 9 clean
  • Netsh Port Proxy T1090.001 clean
  • Office Add-in T1137.006 clean
  • Office Executable Sideload T1574.002 clean
  • Office Startup Template T1137.001 clean
  • Office Test Key T1137.002 clean
  • Power Automate Flow T1546 clean
  • PowerShell Profile T1546.013 clean
  • Windows Terminal Startup Action T1546 clean
  • WMI Event Subscription T1546.003 clean
Boot & Firmware 4 clean
  • BootExecute Native Image T1547.002 clean
  • PlatformExecute Native Image T1547.002 clean
  • SetupExecute Native Image T1547.002 clean
  • UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 5 write 0 modify 2 delete 0 rename 3

Dropped payload analysis

3 payloads examined

Each payload the sample wrote and this run kept was scanned by the antivirus engine and identified locally. 3 of them were examined and none was flagged. That is a result about these bytes only: a payload the caps turned away, or one the capture never kept, is reported separately.

Whether any of these payloads is already known to an outside source was not established for this scan: reputation enrichment is a paid-plan layer. The antivirus result and the identification below ran locally and are complete.

PayloadWhere it landedWhat it isAntivirusDownload
libSkiaSharp.dll C:\Users\user\AppData\Local\VRCW\native\8f7ae018a6eecd840b3b9959\libSkiaSharp.dll
Windows executablesigned2 signature matches
 no detection ZIP
libHarfBuzzSharp.dll C:\Users\user\AppData\Local\VRCW\native\8f7ae018a6eecd840b3b9959\libHarfBuzzSharp.dll
Windows executablesigned1 signature match
 no detection ZIP
av_libglesv2.dll C:\Users\user\AppData\Local\VRCW\native\8f7ae018a6eecd840b3b9959\av_libglesv2.dll
Windows executablesigned
 no detection ZIP

File & registry ops

10 file · 102 registry · sample scope

File operation times: 10 timed

OperationTargetProcess
create
C:\Users\user\AppData\Local\VRCW
same path
 VRCW-Recovery-Free.exe pid 1532 2026-10-09 18:50:36.197
create
C:\Users\user\AppData\Local\VRCW\native
same path
 VRCW-Recovery-Free.exe pid 1532 2026-10-09 18:50:36.197
create
C:\Users\user\AppData\Local\VRCW\native\8f7ae018a6eecd840b3b9959
same path
 VRCW-Recovery-Free.exe pid 1532 2026-10-09 18:50:36.197
renamepayload
C:\Users\user\AppData\Local\VRCW\native\8f7ae018a6eecd840b3b9959\libSkiaSharp.dll
11.1 MBsame path
 VRCW-Recovery-Free.exe pid 1532 2026-10-09 18:50:36.645
renamepayload
C:\Users\user\AppData\Local\VRCW\native\8f7ae018a6eecd840b3b9959\libHarfBuzzSharp.dll
1.7 MBsame path
 VRCW-Recovery-Free.exe pid 1532 2026-10-09 18:50:36.645
renamepayload
C:\Users\user\AppData\Local\VRCW\native\8f7ae018a6eecd840b3b9959\av_libglesv2.dll
5.1 MBsame path
 VRCW-Recovery-Free.exe pid 1532 2026-10-09 18:50:36.755
create
C:\Users\user\AppData\Local\VRCW\settings.json
same path
 VRCW-Recovery-Free.exe pid 1532 2026-10-09 18:50:54.270
modify
C:\Users\user\AppData\Local\VRCW\native\8f7ae018a6eecd840b3b9959
same path
 - 2026-10-09 18:50:36.630
modify
C:\Users\user\AppData\Local\VRCW\settings.json
same path
 - 2026-10-09 18:50:54.270
create
C:\Users\user\AppData\Local\VRCW\downloads
same path
 VRCW-Recovery-Free.exe pid 1532 2026-10-09 18:51:11.896
create
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
 VRCW-Recovery-Free.exe pid 1532 not timed
create
SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
 VRCW-Recovery-Free.exe pid 1532 not timed
create
TenantRestrictions\Payload
 VRCW-Recovery-Free.exe pid 1532 not timed
create
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
 VRCW-Recovery-Free.exe pid 1532 not timed
create
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
 VRCW-Recovery-Free.exe pid 1532 not timed
create
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders
 VRCW-Recovery-Free.exe pid 1532 not timed
create
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
 VRCW-Recovery-Free.exe pid 1532 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries = <100 bytes, type 3>
 VRCW-Recovery-Free.exe pid 1532 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
CachePrefix =
VRCW-Recovery-Free.exe pid 1532 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
CachePrefix = Cookie:
 VRCW-Recovery-Free.exe pid 1532 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
CachePrefix = Visited:
 VRCW-Recovery-Free.exe pid 1532 not timed
create
SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
 VRCW-Recovery-Free.exe pid 1532 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{E44E9428-BDBC-4987-A099-40DC8FD255E7} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF = <16 bytes, type 3>
 VRCW-Recovery-Free.exe pid 1532 not timed
setvalue
Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\OpenWith.exe.FriendlyAppName = Pick an app
 VRCW-Recovery-Free.exe pid 1532 not timed
setvalue
Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\OpenWith.exe.ApplicationCompany = Microsoft Corporation
 VRCW-Recovery-Free.exe pid 1532 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Local Settings
 VRCW-Recovery-Free.exe pid 1532 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings = <56 bytes>
read back
 - not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
DefaultConnectionSettings = <56 bytes>
read back
 - not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
WinHttpSettings = <20 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
ExplorerStartupTraceRecorded = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
ShellState = <36 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
UserSignedIn = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries = <100 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
SIDUpdatedOnLibraries = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
LocalKnownFoldersMigrated = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
TelemetrySalt = 3
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
FirstRunTelemetryComplete = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
AppReadinessLogonComplete = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
PostAppInstallTasksCompleted = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
ActiveSetupDisabled = 0
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
ActiveSetupTaskOverride = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
AsyncRunOnce = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
AsyncUpdatePCSettings = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
DisableAppInstallsOnFirstLogon = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
DisableResolveStoreCategories = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
DisableUpgradeCleanup = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
EarlyAppResolverStart = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
FileOpenDialog = {DC1C5A9C-E88A-4dde-A5A1-60F82A20AEF7}
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
FSIASleepTimeInMs = 60000
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
GlobalFolderSettings = {EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
IconUnderline = 2
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
ListViewPopupControl = {8be9f5ea-e746-4e47-ad57-3fb191ca1eed}
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
LVPopupSearchControl = {fccf70c8-f4d7-4d8b-8c17-cd6715e37fff}
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
MachineOobeUpdates = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
NoWaitOnRoamingPayloads = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
TaskScheduler = {0f87369f-a4e5-4cfc-bd3e-73e6154572dd}
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
AccessDeniedDialog = {100B4FC8-74C1-470F-B1B7-DD7B6BAE79BD}
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
SmartScreenEnabled = Off
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Explorer
GlobalAssocChangedCounter = 19
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{B2952B16-0E07-4E5A-B993-58C52CB94CAE} {000214E6-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{4234D49B-0245-4DF3-B780-3893943456E1} {000214E6-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{C7657C4A-9F68-40FA-A4DF-96BC08EB3551} {E357FCCD-A995-4576-B01F-234630154E96} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{4E77131D-3629-431C-9818-C5679DC83E81} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{04731B67-D933-450A-90E6-4ACD2E9408FE} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{2227A280-3AEA-1069-A2DE-08002B30309D} {000214E6-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{FF393560-C2A7-11CF-BFF4-444553540000} {000214E6-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{72B66649-3DBF-429F-BD6F-7774A9784B78} {BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{355822FC-86F1-4BE8-B5F0-A33736789641} {BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF} {000214E6-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{E44E9428-BDBC-4987-A099-40DC8FD255E7} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{470C0EBD-5D73-4D58-9CED-E91E22E23282} {000214E4-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{596AB062-B4D2-4215-9F74-E9109B0A8153} {000214E4-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{474C98EE-CF3D-41F5-80E3-4AAB0AB04301} {000214E4-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{E61BF828-5E63-4287-BEF1-60B1A4FDE0E3} {000214E4-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{B41DB860-64E4-11D2-9906-E49FADC173CA} {000214E4-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6} {000214E4-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{99D353BC-C813-41EC-8F28-EAE61E702E57} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {000214E4-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{09A47860-11B0-4DA5-AFA5-26D86198A780} {000214E4-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{A6595CD1-BF77-430A-A452-18696685F7C7} {000214E4-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{1D27F844-3A1F-4410-85AC-14651078412D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{888DCA60-FC0A-11CF-8F0F-00C04FD7D062} {00000122-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} {00000122-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{ECF03A32-103D-11D2-854D-006008059367} {00000122-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} {00000122-0000-0000-C000-000000000046} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = <16 bytes>
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{01822ABA-23F0-4506-9BBC-680F5D6D606C} {A561E69A-B4B8-4113-91A5-64C6BCCA3430} 0x5 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{04731B67-D933-450a-90E6-4ACD2E9408FE} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0x401 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{1685D4AB-A51B-4AF1-A4E5-CEE87002431D} {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} 0x401 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{1bef2128-2f96-4500-ba7c-098dc0049cb2} {000214E6-0000-0000-C000-000000000046} 0x401 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{1cdb2949-8f65-4355-8456-263e7c208a5d} {000214e6-0000-0000-c000-000000000046} 0x401 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{25256C24-3B75-49B3-A433-4BB2F8865896} {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} 0x401 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{72C984BA-0666-4D3F-A0DE-96BF43838E6E} {6A01F55B-4AA5-444B-8CA5-56FF9401A730} 0x1 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{8FE3AA4C-4FFF-11E0-9EAE-3586DFD72085} {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} 0x401 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{9311A763-D284-4CE5-B2AA-6A99D9305D60} {22ffbb0c-954e-47e9-86ee-f94fb719d76b} 0x1 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{9311A763-D284-4CE5-B2AA-6A99D9305D60} {6a01f55b-4aa5-444b-8ca5-56ff9401a730} 0x1 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{9311A763-D284-4CE5-B2AA-6A99D9305D60} {6FFB50EB-65DC-4A8E-B417-4572EC1729A9} 0x1 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{9311A763-D284-4CE5-B2AA-6A99D9305D60} {89B59B87-4E36-4BDB-88FF-0FD2982BB5E4} 0x1 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{9E175BA8-F52A-11D8-B9A5-505054503030} {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} 0x401 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{A4DF5659-0801-4A60-9607-1C48695EFDA9} {000214E6-0000-0000-C000-000000000046} 0x401 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{B2952B16-0E07-4E5A-B993-58C52CB94CAE} {000214E6-0000-0000-C000-000000000046} 0x401 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{C0AB2A0D-F2D2-46E2-9DF9-8885A424C29A} {6a01f55b-4aa5-444b-8ca5-56ff9401a730} 0x1 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{C0AB2A0D-F2D2-46E2-9DF9-8885A424C29A} {9F3B31DF-CE39-4da3-A2F0-F240C1E10F06} 0x1 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{C0AB2A0D-F2D2-46E2-9DF9-8885A424C29A} {C0C083BC-6EC4-4349-96E9-20080FC304FC} 0x1 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{daf95313-e44d-46af-be1b-cbacea2c3065} {000214E6-0000-0000-C000-000000000046} 0x401 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{E345F35F-9397-435C-8F95-4E922C26259E} {000214E6-0000-0000-C000-000000000046} 0x401 = 1
read back
 - not timed
setvalue
Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{F60163CE-2B8D-458D-AB2C-40F215767514} {295C3011-E9B9-43DE-A04C-4800DA69F4D3} 0x401 = 1
read back
 - not timed

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

2 reported a hit 16 answered no 5 had nothing to check
2Sources with a hit
18Sources queriedof 23 available
470.5kFeed records
0Could not answer

File reputation

4 clear · 3 not checked
SourceChecksResultDetailFeed
MalwareBazaar hash feed File hash clean not in feed 2,934 records
44 minutes ago
MalwareBazaar ransomware feed File hash clean not in feed 3,348 records
5 hours ago
ThreatFox hash IOCs File hash clean not in feed 1,146 records
45 minutes ago
URLhaus payload hashes File hash clean not in feed 1,658 records
44 minutes ago
filescan.io File hash not checked no hash lookup ran for this scan live lookup
MalwareBazaar File hash not checked no hash lookup ran for this scan live lookup
VirusTotal File hash not checked no hash lookup ran for this scan live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

1 of 8 listed
SourceChecksResultDetailFeed
URLhaus IP / domain / URL 1 indicator github[.]com no records ingested
blocklist.de IP / domain / URL clean 2 observed indicators, none listed 27.6k records
44 minutes ago
CINS Army IP / domain / URL clean 2 observed indicators, none listed 15k records
44 minutes ago
Emerging Threats IP / domain / URL clean 2 observed indicators, none listed 482 records
44 minutes ago
Feodo Tracker IP / domain / URL clean 2 observed indicators, none listed 5 records
45 minutes ago
IPsum IP / domain / URL clean 2 observed indicators, none listed 19.7k records
44 minutes ago
Phishing.Database IP / domain / URL clean 2 observed indicators, none listed 391.5k records
5 hours ago
ThreatFox IP / domain / URL clean 2 observed indicators, none listed 1,146 records
45 minutes ago

TLS fingerprints

nothing of this kind to check
SourceChecksResultDetailFeed
JA3 / JA4 fingerprint blocklists JA3 / JA4 not checked no TLS client fingerprint observed 97 records
11 hours ago
SSL blocklist Server certificate not checked no server certificate fingerprint is extracted to check live lookup

Detection rules

1 of 2 listed
SourceChecksResultDetailFeed
Signature rules Sample content 5 matches Suspicious_Anti_Debug_API, Embedded_PE_In_Overlay, TigerRAT_pe_yaraify 110 records
45 minutes ago
Sigma rules Behavior log clean - 2,275 records
6 hours ago

Tooling catalogs

4 clear
SourceChecksResultDetailFeed
LOLBAS Process image paths clean 1 process image path, none masqueraded 245 records
45 minutes ago
LOLBootloaders File hash clean not a known vulnerable bootloader 520 records
44 minutes ago
LOLDrivers File hash clean not a known vulnerable driver 2,333 records
45 minutes ago
LOLRMM Names and domains clean 4 name/domain indicators checked, no remote-management tooling 360 records
44 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

1 malicious 3 suspicious 0 info

File indicators

3
SeverityTypeIndicatorDescription
suspicious sample_sha256 badd0e11e392a027a00c10873cdfaddc7f6ce1f4667f1688fc6f3001f0aba580 Submitted sample (SHA256)
suspicious sample_md5 803872b6fe51a7ff99a6970c1daa3a1c Submitted sample (MD5)
malicious imphash e2fcdee14b25e8edb17e6f016ce82b62 Import table hash (imphash)

Registry indicators

1
SeverityTypeIndicatorDescription
suspicious registry_key \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Autostart / persistence key

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

Sigma: auto_file_2713_sigma_reg

Auto-generated
title: Auto-generated registry behavior rule (sandbox scan 2713)
id: sandbox-auto-2713-reg
status: experimental
description: Auto-generated from sandbox scan 2713
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections'
            - 'SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload'
            - 'TenantRestrictions\Payload'
            - '\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content'
    condition: selection
level: medium

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

Artifacts

6 files
TypeNameSizeWhat it isSHA-256Download
Dropped file libSkiaSharp.dll 11.1 MB - 7dec3ba900ab353491e6446f0083739924c6f8dd668832e2f09d38ebffdbbe1c ZIP
Dropped file libHarfBuzzSharp.dll 1.7 MB - 145ade963eba427027d5e1381db5d51a0ef9e98e9fef9efbfa6074ca20da246f ZIP
Dropped file av_libglesv2.dll 5.1 MB - 53191a77fe783cd757ca7767077c2a64a662e7043777a5b4ab74980d4a0b73e3 ZIP
Extracted file embedded_pe_163b46d69f74 5.1 MB PEno detection 163b46d69f741f3fcea8770f287aa3e27d321bc001b64971a73307ed183d0744 ZIP
Extracted file embedded_pe_0d0a7a85d4aa 1.7 MB PEno detection 0d0a7a85d4aa40b95b9b7992b3db1035bb2e9c51cf533fdd8c2a7331f4bdaa6b ZIP
Extracted file embedded_pe_1b4e745f90cf 11.1 MB PEno detection 1b4e745f90cf8e2dc10035d58b338f3c9dae2d5f9bca720780ba137471e45a60 ZIP

Export & download

/s/2713

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run
SubmittedEnvironmentVerdictScore
2026-10-09 18:49 Shown below Windows 10 22H2 Suspicious 69/100