dcrat | b50c0dc51dea6b723cd1010b62129c958927b0e657098dc67e617e7669dfab9b

Analysis

max time kernel
27s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample260422-py2f1afv7p
SHA256 b50c0dc51dea6b723cd1010b62129c958927b0e657098dc67e617e7669dfab9b
MD5 07701b0cb29dda455c7fa39eae3419dd
SHA1 dae424e709986a91d4879d3c37c02798c964dbb0
SHA512 2a5b527041f9f081097584487425d4294c285585587fe63ec1bc7a3f8ca98b91bf26cce4bda46aded70db05c817764189a043e6a4e3746bf8914934dff84f1f6
SSDEEP 49152:ckQTAzIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scE:caJuRD9JdOR4m+lmY/4rx8cE
TLSH
T1BA8523097181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 58 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		3224	schtasks.exe
		692	schtasks.exe
		3764	schtasks.exe
		3764	schtasks.exe
		5404	schtasks.exe
		3668	schtasks.exe
		4888	schtasks.exe
		5976	schtasks.exe
		400	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		5956	schtasks.exe
		4308	schtasks.exe
		4524	schtasks.exe
		5900	schtasks.exe
		5996	schtasks.exe
		2596	schtasks.exe
		5336	schtasks.exe
		3636	schtasks.exe
		3824	schtasks.exe
		5936	schtasks.exe
		5056	schtasks.exe
		2344	schtasks.exe
		916	schtasks.exe
		1432	schtasks.exe
		4864	schtasks.exe
		4876	schtasks.exe
		4300	schtasks.exe
		1920	schtasks.exe
		5940	schtasks.exe
		5708	schtasks.exe
		4896	schtasks.exe
		3916	schtasks.exe
		5236	schtasks.exe
		5840	schtasks.exe
		3904	schtasks.exe
		3808	schtasks.exe
		3944	schtasks.exe
		4560	schtasks.exe
		1188	schtasks.exe
		2276	schtasks.exe
		6044	schtasks.exe
		2948	schtasks.exe
		912	schtasks.exe
		5172	schtasks.exe
		2336	schtasks.exe
		4556	schtasks.exe
		5352	schtasks.exe
		1724	schtasks.exe
		4996	schtasks.exe
		3820	schtasks.exe
		3360	schtasks.exe
		6016	schtasks.exe
		4236	schtasks.exe
		5016	schtasks.exe
		4760	schtasks.exe
		864	schtasks.exe
		1224	schtasks.exe
		4332	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Templates\\services.exe\""	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Templates\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\""	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5404	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5352	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5900	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5956	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6044	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3764	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5940	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5708	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5996	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6016	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5936	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3820	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5236	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5336	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5976	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3764	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5840	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5172	5356	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	5356	schtasks.exe	79

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral2/memory/2564-5234-0x0000000006300000-0x0000000006310000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2564-5238-0x0000000006850000-0x000000000685A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2564-5243-0x0000000006930000-0x000000000693C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2564-5244-0x0000000006960000-0x000000000696A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2564-5246-0x0000000007260000-0x000000000726C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
8304	powershell.exe
10704	powershell.exe
8456	powershell.exe
3836	powershell.exe
9984	powershell.exe
7812	powershell.exe
6988	powershell.exe
6856	powershell.exe
6476	powershell.exe
5516	powershell.exe
8988	powershell.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\""	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\All Users\\Templates\\services.exe\""	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\All Users\\Templates\\services.exe\""	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\winlogon.exe\""	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/2564-5234-0x0000000006300000-0x0000000006310000-memory.dmp	SmartAssembly
behavioral2/memory/2564-5238-0x0000000006850000-0x000000000685A000-memory.dmp	SmartAssembly
behavioral2/memory/2564-5243-0x0000000006930000-0x000000000693C000-memory.dmp	SmartAssembly
behavioral2/memory/2564-5244-0x0000000006960000-0x000000000696A000-memory.dmp	SmartAssembly
behavioral2/memory/2564-5246-0x0000000007260000-0x000000000726C000-memory.dmp	SmartAssembly

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\cc11b995f2a76d	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\9e8d7a4ca61bd9	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4896	schtasks.exe
5708	schtasks.exe
3904	schtasks.exe
2336	schtasks.exe
1188	schtasks.exe
3808	schtasks.exe
2276	schtasks.exe
3916	schtasks.exe
2596	schtasks.exe
4308	schtasks.exe
4560	schtasks.exe
1920	schtasks.exe
5956	schtasks.exe
4556	schtasks.exe
3636	schtasks.exe
4888	schtasks.exe
3360	schtasks.exe
4760	schtasks.exe
3944	schtasks.exe
3824	schtasks.exe
1224	schtasks.exe
4524	schtasks.exe
5900	schtasks.exe
5336	schtasks.exe
5976	schtasks.exe
6044	schtasks.exe
4996	schtasks.exe
5996	schtasks.exe
1724	schtasks.exe
3668	schtasks.exe
6016	schtasks.exe
5840	schtasks.exe
3764	schtasks.exe
3820	schtasks.exe
5236	schtasks.exe
5056	schtasks.exe
4864	schtasks.exe
5404	schtasks.exe
400	schtasks.exe
5940	schtasks.exe
2948	schtasks.exe
692	schtasks.exe
4332	schtasks.exe
864	schtasks.exe
5352	schtasks.exe
5016	schtasks.exe
3224	schtasks.exe
912	schtasks.exe
916	schtasks.exe
1432	schtasks.exe
4236	schtasks.exe
5936	schtasks.exe
4876	schtasks.exe
3764	schtasks.exe
4300	schtasks.exe
5172	schtasks.exe
2344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2564	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2564	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2564	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2564	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2564	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2564
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8304
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6856
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7812
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9984
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3836
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10704
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\services.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\Templates\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Templates\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee2" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee2" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Windows\Prefetch\ReadyBoot\sihost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\sihost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Windows\Prefetch\ReadyBoot\sihost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\lsass.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Documents\My Videos\Registry.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Videos\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Documents\My Videos\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\LiveKernelReports\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows\LiveKernelReports\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Windows\TAPI\StartMenuExperienceHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\TAPI\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\TAPI\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360

C:\Users\All Users\Templates\services.exe
"C:\Users\All Users\Templates\services.exe"
1⤵
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3764

C:\Recovery\WindowsRE\SearchHost.exe
"C:\Recovery\WindowsRE\SearchHost.exe"
1⤵
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\Gadgets\SppExtComObj.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Gadgets\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\Prefetch\ReadyBoot\sihost.exe
"C:\Windows\Prefetch\ReadyBoot\sihost.exe"
1⤵
PID:5664

C:\Windows\LiveKernelReports\fontdrvhost.exe
"C:\Windows\LiveKernelReports\fontdrvhost.exe"
1⤵
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\Configuration\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300

C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe
"C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe"
1⤵
PID:3128

C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe
"C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"
1⤵
PID:72

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\Configuration\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5172

C:\Windows\TAPI\StartMenuExperienceHost.exe
"C:\Windows\TAPI\StartMenuExperienceHost.exe"
1⤵
PID:6608

C:\Program Files\Windows Sidebar\Gadgets\SppExtComObj.exe
"C:\Program Files\Windows Sidebar\Gadgets\SppExtComObj.exe"
1⤵
PID:6340

C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
1⤵
PID:10324

C:\Users\Default\Documents\My Videos\Registry.exe
"C:\Users\Default\Documents\My Videos\Registry.exe"
1⤵
PID:7088

C:\Program Files\Mozilla Firefox\2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Program Files\Mozilla Firefox\2026-04-22_07701b0cb29dda455c7fa39eae3419dd_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
PID:11092

C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe
"C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe"
1⤵
PID:9580

C:\Program Files (x86)\Windows Mail\fontdrvhost.exe
"C:\Program Files (x86)\Windows Mail\fontdrvhost.exe"
1⤵
PID:11384

C:\Recovery\WindowsRE\Idle.exe
"C:\Recovery\WindowsRE\Idle.exe"
1⤵
PID:11404

C:\Recovery\WindowsRE\RuntimeBroker.exe
"C:\Recovery\WindowsRE\RuntimeBroker.exe"
1⤵
PID:11732

C:\Program Files\Microsoft Office 15\ClientX64\lsass.exe
"C:\Program Files\Microsoft Office 15\ClientX64\lsass.exe"
1⤵
PID:11456

C:\Users\All Users\csrss.exe
"C:\Users\All Users\csrss.exe"
1⤵
PID:11472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontdrvhost.exe

Path C:\Program Files (x86)\Windows Mail\fontdrvhost.exe
Size 1.3MB
SHA256 167ba8fcfb24422f3db428766efcf6aab6938d0f71af094626689513606c5a52
MD5 31157d4bc4b2887ef7aab005ed3f4a5d
SHA1 e18e8c0620dff31da15dde667fa23da4a95b73ba
SHA512 47750d66cef2a5e4e813dcda20a93ddb77f8c86ccb87e1bdac5a5a52f8d7b2634dd0970326f8795ad70bb5c116fec92d0c95eb1ba3140d7d3b229306051b739a
SSDEEP 24576:ck70TrcigBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJ4sytPXic8Z:ckQTAzIwMtuvMDVPG4JdXeR4aT6LQ+di
TLSH
T1DC5523197181D3B3C2BB003189D5CB715A2671710B7AA5DFF7A8ABA62F102F4B7271C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dllhost.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe
Size 1.1MB
SHA256 bce213b75a9edce00ed9a2f07d67a991011f446a68c2e7526cca894605f2b149
MD5 4aa12b138ce46dcc000e39a37cddcda1
SHA1 70cdca23ce800fecc883bd2a044759dac3d9825c
SHA512 2467f157340d3fdc4f92dcbb967351010359dad3081ee6ca28eeeb3d5671d00f6a76c62827178e6b04625af2f4e7a9ea31cb716f631456cf726754b214e6dade
SSDEEP 24576:ck70TrcigBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJo:ckQTAzIwMtuvMDVPG4JdXeR4aT6LQ+D
TLSH
T1A14523157180D3B3C5F7013189D1CB746B2675B20B76A5EFB6AC6BA62F202F0B7261C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\lsass.exe
Size 256KB
SHA256 b796fb4f1a65ddb1e71b9fa0c93fe3a80ba5148eebea9dc48a3c8eeab0d306ad
MD5 9b03c289f2ff11b010c56e2edfeaaf54
SHA1 bbc8491e18f3b0d639a57b3af8af5bdc2e9c658b
SHA512 b9edc77e6d76bc107ac27e791b284e89a380400f6254780fe9583f959a5870fb19884b894268042990e8c5333d560ee807b60a1d2f800773a963b9571500b30d
SSDEEP 6144:GDKW1Lgbdl0TBBvjc/pUSsSAgutvhQcw0tSIXf20vo:gh1Lk70TnvjchUgAgux61IP20vo
TLSH
T13244D0217181C2B3C4B7013144E6CA759E3A70710B7A95D7BADD6BBA6F203E1A7362CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Idle.exe

Path C:\Recovery\WindowsRE\Idle.exe
Size 1.7MB
SHA256 b50c0dc51dea6b723cd1010b62129c958927b0e657098dc67e617e7669dfab9b
MD5 07701b0cb29dda455c7fa39eae3419dd
SHA1 dae424e709986a91d4879d3c37c02798c964dbb0
SHA512 2a5b527041f9f081097584487425d4294c285585587fe63ec1bc7a3f8ca98b91bf26cce4bda46aded70db05c817764189a043e6a4e3746bf8914934dff84f1f6
SSDEEP 49152:ckQTAzIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scE:caJuRD9JdOR4m+lmY/4rx8cE
TLSH
T1BA8523097181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2564-0-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/2564-1-0x0000000005470000-0x00000000056EC000-memory.dmp

Download

memory/2564-2-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/2564-3-0x00000000056F0000-0x0000000005C96000-memory.dmp

Download

memory/2564-4-0x00000000051F0000-0x000000000546A000-memory.dmp

Download

memory/2564-5-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-17-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-18-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-26-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-51-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-75-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-80-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-91-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-88-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-108-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-122-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-120-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-130-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-128-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-126-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-124-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-118-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-116-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-114-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-112-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-110-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-106-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-104-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-102-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-100-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-98-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-96-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-94-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-92-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-86-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-84-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-82-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-78-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-76-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-72-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-70-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-68-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-66-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-64-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-62-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-60-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-58-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-56-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-54-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-48-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-44-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-42-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-52-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-46-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-40-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-38-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-36-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-32-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-31-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-28-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-34-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-20-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-24-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-22-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-14-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-12-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-10-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-8-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-6-0x00000000051F0000-0x0000000005464000-memory.dmp

Download

memory/2564-1675-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/2564-1943-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/2564-2248-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/2564-5230-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/2564-5231-0x00000000024A0000-0x00000000024BC000-memory.dmp

Download

memory/2564-5232-0x00000000024D0000-0x0000000002520000-memory.dmp

Download

memory/2564-5233-0x0000000002530000-0x0000000002538000-memory.dmp

Download

memory/2564-5234-0x0000000006300000-0x0000000006310000-memory.dmp

Download

memory/2564-5235-0x0000000006830000-0x0000000006846000-memory.dmp

Download

memory/2564-5236-0x0000000006610000-0x0000000006618000-memory.dmp

Download

memory/2564-5237-0x0000000006990000-0x00000000069A0000-memory.dmp

Download

memory/2564-5238-0x0000000006850000-0x000000000685A000-memory.dmp

Download

memory/2564-5239-0x0000000006880000-0x000000000688C000-memory.dmp

Download

memory/2564-5240-0x0000000006890000-0x00000000068A2000-memory.dmp

Download

memory/2564-5241-0x00000000069B0000-0x0000000006EDC000-memory.dmp

Download

memory/2564-5242-0x0000000006920000-0x000000000692C000-memory.dmp

Download

memory/2564-5243-0x0000000006930000-0x000000000693C000-memory.dmp

Download

memory/2564-5244-0x0000000006960000-0x000000000696A000-memory.dmp

Download

memory/2564-5245-0x0000000006980000-0x0000000006988000-memory.dmp

Download

memory/2564-5246-0x0000000007260000-0x000000000726C000-memory.dmp

Download

memory/2564-5247-0x0000000007270000-0x0000000007302000-memory.dmp

Download

memory/2564-5249-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/2564-5248-0x0000000007350000-0x000000000735C000-memory.dmp

Download

memory/2564-5252-0x0000000007370000-0x00000000073D6000-memory.dmp

Download

memory/2564-7794-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/2564-7302-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download