512e0add6ee43d041614b01646f3c03313acb55d3d4730d0bc3a153d584b478c

Analysis

max time kernel
144s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_53a85ed43f995f74a17c8c085f133d93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 2.0MB
Sample260424-eahc4sd12y
SHA256 512e0add6ee43d041614b01646f3c03313acb55d3d4730d0bc3a153d584b478c
MD5 53a85ed43f995f74a17c8c085f133d93
SHA1 b117845929f1d1d1abda899710ff110c031bb285
SHA512 6f2aafae4186a40912abc66791ff437566f699f38544bf3edf22baa759ac95ca561f3efb595fadec6f1568ec6986629d0f97e12e7dd33514c7df6483719a06e8
SSDEEP 49152:OkQTAOYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpF:OaO5CbhZcT2lvnDFpFW/twU7+F
TLSH
T126A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Signatures

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3696	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	616	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	416	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	2224	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	2224	schtasks.exe	80

Detects executables packed with SmartAssembly 7 IoCs

resource	yara_rule
behavioral2/memory/2096-5242-0x0000000006C30000-0x0000000006C3A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2096-5249-0x0000000008430000-0x000000000843C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2096-5259-0x0000000008890000-0x000000000889A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2096-5254-0x0000000008490000-0x000000000849A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2096-5252-0x0000000008480000-0x000000000848C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2096-5250-0x0000000008450000-0x000000000845C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2096-5235-0x0000000006500000-0x0000000006510000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
9064	powershell.exe
6716	powershell.exe
10432	powershell.exe
12164	powershell.exe
11628	powershell.exe
7140	powershell.exe
8284	powershell.exe
6688	powershell.exe
11108	powershell.exe
9584	powershell.exe
11692	powershell.exe
12092	powershell.exe
10916	powershell.exe
4812	powershell.exe
5168	powershell.exe
12040	powershell.exe
12104	powershell.exe
12140	powershell.exe

SmartAssembly .NET packer 7 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/2096-5242-0x0000000006C30000-0x0000000006C3A000-memory.dmp	SmartAssembly
behavioral2/memory/2096-5249-0x0000000008430000-0x000000000843C000-memory.dmp	SmartAssembly
behavioral2/memory/2096-5259-0x0000000008890000-0x000000000889A000-memory.dmp	SmartAssembly
behavioral2/memory/2096-5254-0x0000000008490000-0x000000000849A000-memory.dmp	SmartAssembly
behavioral2/memory/2096-5252-0x0000000008480000-0x000000000848C000-memory.dmp	SmartAssembly
behavioral2/memory/2096-5250-0x0000000008450000-0x000000000845C000-memory.dmp	SmartAssembly
behavioral2/memory/2096-5235-0x0000000006500000-0x0000000006510000-memory.dmp	SmartAssembly

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_53a85ed43f995f74a17c8c085f133d93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1420	schtasks.exe
3828	schtasks.exe
3696	schtasks.exe
988	schtasks.exe
3940	schtasks.exe
416	schtasks.exe
4948	schtasks.exe
5076	schtasks.exe
1996	schtasks.exe
4600	schtasks.exe
2424	schtasks.exe
3840	schtasks.exe
3124	schtasks.exe
4340	schtasks.exe
1584	schtasks.exe
4032	schtasks.exe
4608	schtasks.exe
4988	schtasks.exe
2028	schtasks.exe
2072	schtasks.exe
4320	schtasks.exe
3364	schtasks.exe
1876	schtasks.exe
1980	schtasks.exe
3944	schtasks.exe
1444	schtasks.exe
2140	schtasks.exe
1460	schtasks.exe
4604	schtasks.exe
4656	schtasks.exe
4596	schtasks.exe
3360	schtasks.exe
1040	schtasks.exe
836	schtasks.exe
3492	schtasks.exe
4364	schtasks.exe
4856	schtasks.exe
1520	schtasks.exe
4036	schtasks.exe
3356	schtasks.exe
2148	schtasks.exe
2012	schtasks.exe
616	schtasks.exe
1116	schtasks.exe
3132	schtasks.exe
2496	schtasks.exe
4476	schtasks.exe
4516	schtasks.exe
2008	schtasks.exe
3628	schtasks.exe
1764	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	2026-04-24_53a85ed43f995f74a17c8c085f133d93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-24_53a85ed43f995f74a17c8c085f133d93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_53a85ed43f995f74a17c8c085f133d93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2096
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-24_53a85ed43f995f74a17c8c085f133d93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7140
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:11628
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:12092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:12140
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:12104
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:12164
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:12040
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:11692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\es-ES\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10432
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6716
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9064
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5168
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8284
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\My Documents\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9584
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4812
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:11108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Downloads\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Update\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Update\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Java\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\My Documents\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\My Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Recovery\WindowsRE\winlogon.exe
"C:\Recovery\WindowsRE\winlogon.exe"
1⤵
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Program Files\Java\dllhost.exe
"C:\Program Files\Java\dllhost.exe"
1⤵
PID:3788

C:\Users\Public\Downloads\wininit.exe
"C:\Users\Public\Downloads\wininit.exe"
1⤵
PID:1444

C:\Program Files (x86)\Google\Update\csrss.exe
"C:\Program Files (x86)\Google\Update\csrss.exe"
1⤵
PID:2572

C:\Recovery\WindowsRE\dllhost.exe
"C:\Recovery\WindowsRE\dllhost.exe"
1⤵
PID:5364

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RuntimeBroker.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RuntimeBroker.exe"
1⤵
PID:5396

C:\Users\Default User\Registry.exe
"C:\Users\Default User\Registry.exe"
1⤵
PID:5584

C:\Program Files (x86)\Microsoft.NET\OfficeClickToRun.exe
"C:\Program Files (x86)\Microsoft.NET\OfficeClickToRun.exe"
1⤵
PID:5736

C:\Recovery\WindowsRE\wininit.exe
"C:\Recovery\WindowsRE\wininit.exe"
1⤵
PID:5836

C:\Program Files (x86)\Windows Photo Viewer\es-ES\smss.exe
"C:\Program Files (x86)\Windows Photo Viewer\es-ES\smss.exe"
1⤵
PID:5848

C:\Program Files\Internet Explorer\smss.exe
"C:\Program Files\Internet Explorer\smss.exe"
1⤵
PID:5864

C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe
"C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe"
1⤵
PID:5876

C:\Recovery\WindowsRE\OfficeClickToRun.exe
"C:\Recovery\WindowsRE\OfficeClickToRun.exe"
1⤵
PID:5892

C:\Users\Admin\My Documents\csrss.exe
"C:\Users\Admin\My Documents\csrss.exe"
1⤵
PID:6196

C:\Recovery\WindowsRE\Registry.exe
"C:\Recovery\WindowsRE\Registry.exe"
1⤵
PID:7016

C:\Recovery\WindowsRE\explorer.exe
"C:\Recovery\WindowsRE\explorer.exe"
1⤵
PID:2012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXE20B.tmp

Path C:\Recovery\WindowsRE\RCXE20B.tmp
Size 2.0MB
SHA256 393d8d3e29eea87290eb212eb42e8d19e13c7957d5057c326a27a9108f39a33d
MD5 2ed21e4835f51a9697e4893ec1ae5976
SHA1 4a172a1a3bd1ec8a5f5670d02def403417876d59
SHA512 af9f3d68b99505fd40b413c273da4873573ba79d09374c2cd52038ffeab6e60eb76f3d61c341f7eafe5cfcf70d886c630c541b21912967c0e521cbd87d46afce
SSDEEP 49152:OkQTAaYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpl:Oaa5CbhZcT2lvnDFpFW/twU7+l
TLSH
T1D8A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon.exe

Path C:\Recovery\WindowsRE\winlogon.exe
Size 2.0MB
SHA256 512e0add6ee43d041614b01646f3c03313acb55d3d4730d0bc3a153d584b478c
MD5 53a85ed43f995f74a17c8c085f133d93
SHA1 b117845929f1d1d1abda899710ff110c031bb285
SHA512 6f2aafae4186a40912abc66791ff437566f699f38544bf3edf22baa759ac95ca561f3efb595fadec6f1568ec6986629d0f97e12e7dd33514c7df6483719a06e8
SSDEEP 49152:OkQTAOYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpF:OaO5CbhZcT2lvnDFpFW/twU7+F
TLSH
T126A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2096-0-0x0000000002880000-0x0000000002890000-memory.dmp

Download

memory/2096-2-0x0000000002880000-0x0000000002890000-memory.dmp

Download

memory/2096-3-0x0000000002880000-0x0000000002890000-memory.dmp

Download

memory/2096-4-0x0000000005A30000-0x0000000005FD6000-memory.dmp

Download

memory/2096-5-0x00000000054B0000-0x0000000005766000-memory.dmp

Download

memory/2096-9-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-15-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-31-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-45-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-55-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-77-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-85-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-103-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-119-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-123-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-125-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-127-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-131-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-129-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-121-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-117-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-115-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-113-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-111-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-107-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-110-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-105-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-102-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-100-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-97-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-93-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-91-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-95-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-1650-0x0000000002880000-0x0000000002890000-memory.dmp

Download

memory/2096-89-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-1903-0x0000000002880000-0x0000000002890000-memory.dmp

Download

memory/2096-87-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-2157-0x0000000002880000-0x0000000002890000-memory.dmp

Download

memory/2096-83-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-81-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-79-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-75-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-73-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-71-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-69-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-67-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-61-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-59-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-57-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-53-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-65-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-63-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-51-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-43-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-41-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-39-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-38-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-49-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-47-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-33-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-35-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-25-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-23-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-21-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-19-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-29-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-27-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-17-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-13-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-11-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-7-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-6-0x00000000054B0000-0x0000000005761000-memory.dmp

Download

memory/2096-1-0x0000000005770000-0x0000000005A28000-memory.dmp

Download

memory/2096-5231-0x0000000002880000-0x0000000002890000-memory.dmp

Download

memory/2096-5233-0x0000000002ED0000-0x0000000002F20000-memory.dmp

Download

memory/2096-5240-0x0000000006C10000-0x0000000006C20000-memory.dmp

Download

memory/2096-5242-0x0000000006C30000-0x0000000006C3A000-memory.dmp

Download

memory/2096-5244-0x0000000006E30000-0x0000000006E3C000-memory.dmp

Download

memory/2096-5247-0x0000000006E60000-0x0000000006E72000-memory.dmp

Download

memory/2096-5249-0x0000000008430000-0x000000000843C000-memory.dmp

Download

memory/2096-5251-0x0000000008460000-0x000000000846C000-memory.dmp

Download

memory/2096-5260-0x00000000088A0000-0x00000000088AC000-memory.dmp

Download

memory/2096-5263-0x00000000088F0000-0x0000000008956000-memory.dmp

Download

memory/2096-5259-0x0000000008890000-0x000000000889A000-memory.dmp

Download

memory/2096-5258-0x0000000002880000-0x0000000002890000-memory.dmp

Download

memory/2096-5257-0x0000000008880000-0x0000000008888000-memory.dmp

Download

memory/2096-5256-0x0000000008870000-0x0000000008878000-memory.dmp

Download

memory/2096-5255-0x0000000008840000-0x000000000884E000-memory.dmp

Download

memory/2096-5254-0x0000000008490000-0x000000000849A000-memory.dmp

Download

memory/2096-5253-0x0000000008730000-0x0000000008738000-memory.dmp

Download

memory/2096-5252-0x0000000008480000-0x000000000848C000-memory.dmp

Download

memory/2096-5250-0x0000000008450000-0x000000000845C000-memory.dmp

Download

memory/2096-5248-0x0000000007EC0000-0x00000000083EC000-memory.dmp

Download

memory/2096-5245-0x0000000006E50000-0x0000000006E58000-memory.dmp

Download

memory/2096-5243-0x0000000006E10000-0x0000000006E18000-memory.dmp

Download

memory/2096-5241-0x0000000006C50000-0x0000000006CE2000-memory.dmp

Download

memory/2096-5239-0x0000000006BB0000-0x0000000006BB8000-memory.dmp

Download

memory/2096-5238-0x0000000006CF0000-0x0000000006D02000-memory.dmp

Download

memory/2096-5237-0x0000000006BA0000-0x0000000006BA8000-memory.dmp

Download

memory/2096-5236-0x0000000006820000-0x0000000006836000-memory.dmp

Download

memory/2096-5235-0x0000000006500000-0x0000000006510000-memory.dmp

Download

memory/2096-5234-0x0000000002F30000-0x0000000002F38000-memory.dmp

Download

memory/2096-5232-0x0000000002EA0000-0x0000000002EBC000-memory.dmp

Download

memory/2096-7449-0x0000000002880000-0x0000000002890000-memory.dmp

Download

memory/2096-7050-0x0000000002880000-0x0000000002890000-memory.dmp

Download

memory/12040-54411-0x00000000029A0000-0x00000000029D6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads