dcrat | dd579ad6573fdcc3c17aec1bd5e900b19828d66f22711fd865f86bd1d845a45f

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/04/2026, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample260428-b6fydact8v
SHA256 dd579ad6573fdcc3c17aec1bd5e900b19828d66f22711fd865f86bd1d845a45f
MD5 80e5f3b6746cdbaf3b3e526ae4a8a8ee
SHA1 de0ceabdb8bc1dfefabf04e86ef61379f2872585
SHA512 ce7c49bf0e0b0a03929c5c52d26e8c775229c7a07206a0a5121f89c3ecd193820d95edd3f38515635f2bdf86524130a6d012346288670e38eecdfdeda22ac73e
SSDEEP 49152:8kQTArIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scC:8ahuRD9JdOR4m+lmY/4rx8cC
TLSH
T1948523157181D333C2FB003085C58FB55A2566224F7666EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 58 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1588	schtasks.exe
		3580	schtasks.exe
		2680	schtasks.exe
		3312	schtasks.exe
		5148	schtasks.exe
		5064	schtasks.exe
		5068	schtasks.exe
		7032	schtasks.exe
		6128	schtasks.exe
		5796	schtasks.exe
		1708	schtasks.exe
		2940	schtasks.exe
		3692	schtasks.exe
		4992	schtasks.exe
		5260	schtasks.exe
		6116	schtasks.exe
		7000	schtasks.exe
		584	schtasks.exe
		6120	schtasks.exe
		2552	schtasks.exe
		4920	schtasks.exe
		4916	schtasks.exe
		5084	schtasks.exe
		2132	schtasks.exe
		5716	schtasks.exe
		536	schtasks.exe
		892	schtasks.exe
		6996	schtasks.exe
		1072	schtasks.exe
		1664	schtasks.exe
		4272	schtasks.exe
		1744	schtasks.exe
		4312	schtasks.exe
		4620	schtasks.exe
		464	schtasks.exe
		4696	schtasks.exe
		5044	schtasks.exe
		2884	schtasks.exe
		3064	schtasks.exe
		6404	schtasks.exe
		3100	schtasks.exe
		6548	schtasks.exe
		1288	schtasks.exe
		3296	schtasks.exe
		4072	schtasks.exe
		6932	schtasks.exe
		7080	schtasks.exe
		1056	schtasks.exe
		3428	schtasks.exe
		5276	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		3352	schtasks.exe
		4000	schtasks.exe
		1216	schtasks.exe
		228	schtasks.exe
		2060	schtasks.exe
		3300	schtasks.exe
		3880	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\csrss.exe\""	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4312	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	464	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6128	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5148	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7080	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7000	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6932	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5276	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5716	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7032	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6120	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5260	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6548	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6996	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5796	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6404	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	1700	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6116	1700	schtasks.exe	86

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Custom signature

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral1/memory/4172-5235-0x0000000006220000-0x0000000006230000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/4172-5239-0x00000000067C0000-0x00000000067CA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/4172-5244-0x0000000006DD0000-0x0000000006DDC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/4172-5247-0x00000000071B0000-0x00000000071BC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/4172-5245-0x0000000006E00000-0x0000000006E0A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\csrss.exe\""	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\csrss.exe\""	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/4172-5235-0x0000000006220000-0x0000000006230000-memory.dmp	SmartAssembly
behavioral1/memory/4172-5239-0x00000000067C0000-0x00000000067CA000-memory.dmp	SmartAssembly
behavioral1/memory/4172-5244-0x0000000006DD0000-0x0000000006DDC000-memory.dmp	SmartAssembly
behavioral1/memory/4172-5247-0x00000000071B0000-0x00000000071BC000-memory.dmp	SmartAssembly
behavioral1/memory/4172-5245-0x0000000006E00000-0x0000000006E0A000-memory.dmp	SmartAssembly

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5044	schtasks.exe
5716	schtasks.exe
6404	schtasks.exe
4272	schtasks.exe
4696	schtasks.exe
2680	schtasks.exe
464	schtasks.exe
1072	schtasks.exe
3064	schtasks.exe
1056	schtasks.exe
6116	schtasks.exe
536	schtasks.exe
3580	schtasks.exe
5068	schtasks.exe
4920	schtasks.exe
5260	schtasks.exe
2132	schtasks.exe
4000	schtasks.exe
4620	schtasks.exe
892	schtasks.exe
1588	schtasks.exe
6120	schtasks.exe
3312	schtasks.exe
4992	schtasks.exe
5084	schtasks.exe
5276	schtasks.exe
3428	schtasks.exe
2884	schtasks.exe
5796	schtasks.exe
1744	schtasks.exe
3100	schtasks.exe
228	schtasks.exe
2060	schtasks.exe
5064	schtasks.exe
2940	schtasks.exe
584	schtasks.exe
6128	schtasks.exe
4916	schtasks.exe
7032	schtasks.exe
3296	schtasks.exe
2552	schtasks.exe
6996	schtasks.exe
3692	schtasks.exe
3300	schtasks.exe
1664	schtasks.exe
4072	schtasks.exe
3880	schtasks.exe
1288	schtasks.exe
1708	schtasks.exe
5148	schtasks.exe
7000	schtasks.exe
6932	schtasks.exe
6548	schtasks.exe
4312	schtasks.exe
3352	schtasks.exe
7080	schtasks.exe
1216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4172	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4172	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4172	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4172	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4172	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4172	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-28_80e5f3b6746cdbaf3b3e526ae4a8a8ee_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\WUDFHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\lua\playlist\System.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\playlist\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\lua\playlist\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Program Files (x86)\Windows Multimedia Platform\WUDFHost.exe
"C:\Program Files (x86)\Windows Multimedia Platform\WUDFHost.exe"
1⤵
PID:1008

C:\Recovery\WindowsRE\sihost.exe
"C:\Recovery\WindowsRE\sihost.exe"
1⤵
PID:4536

C:\Users\All Users\csrss.exe
"C:\Users\All Users\csrss.exe"
1⤵
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Windows\Resources\Ease of Access Themes\WmiPrvSE.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Windows\Resources\Ease of Access Themes\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\RemotePackages\SppExtComObj.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\RemotePackages\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Windows\RemotePackages\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\TextInputHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\SearchApp.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Offline Web Pages\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\Offline Web Pages\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\Registry.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\LiveKernelReports\SppExtComObj.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Windows\LiveKernelReports\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Default\NetHood\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\NetHood\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default\NetHood\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\twain_32\winlogon.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\twain_32\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\twain_32\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Users\Public\AccountPictures\StartMenuExperienceHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\twain_32\winlogon.exe
"C:\Windows\twain_32\winlogon.exe"
1⤵
PID:6188

C:\Recovery\WindowsRE\TextInputHost.exe
"C:\Recovery\WindowsRE\TextInputHost.exe"
1⤵
PID:6352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\AccountPictures\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6116

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
PID:9200

C:\Program Files\VideoLAN\VLC\lua\playlist\System.exe
"C:\Program Files\VideoLAN\VLC\lua\playlist\System.exe"
1⤵
PID:8552

C:\Windows\RemotePackages\SppExtComObj.exe
"C:\Windows\RemotePackages\SppExtComObj.exe"
1⤵
PID:8524

C:\Windows\Resources\Ease of Access Themes\WmiPrvSE.exe
"C:\Windows\Resources\Ease of Access Themes\WmiPrvSE.exe"
1⤵
PID:7832

C:\Recovery\WindowsRE\explorer.exe
"C:\Recovery\WindowsRE\explorer.exe"
1⤵
PID:1708

C:\Users\Public\AccountPictures\StartMenuExperienceHost.exe
"C:\Users\Public\AccountPictures\StartMenuExperienceHost.exe"
1⤵
PID:6652

C:\Recovery\WindowsRE\winlogon.exe
"C:\Recovery\WindowsRE\winlogon.exe"
1⤵
PID:4880

C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe
"C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe"
1⤵
PID:8036

C:\Users\Default User\Registry.exe
"C:\Users\Default User\Registry.exe"
1⤵
PID:1040

C:\Windows\Offline Web Pages\RuntimeBroker.exe
"C:\Windows\Offline Web Pages\RuntimeBroker.exe"
1⤵
PID:1216

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\TextInputHost.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\TextInputHost.exe"
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.exe

Path C:\Program Files\VideoLAN\VLC\lua\playlist\System.exe
Size 1.7MB
SHA256 6af568bfa6510e36f30bf2ae5045780646c70d98fa381c8ab85bc5aeec61eeb2
MD5 e17aee384dcbfd05a6924af02a9064e4
SHA1 32c77bfa1d9fcc7457be70891ec1d708ffac122f
SHA512 06037c136a21eeb58154746bb6ccd5477f6fd82e7d1247f77a22fe6115cdde55e21b3d2a73cf976bd5f0c883898713d3cb156146c781ef503361100d18a27d5b
SSDEEP 49152:8kQTArIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sc+:8ahuRD9JdOR4m+lmY/4rx8c+
TLSH
T11C8523197181D373C2BB003085C58FB55A2566220F7566DFFBE89B662F202F4BB7A1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.exe

Path C:\Program Files\VideoLAN\VLC\lua\playlist\System.exe
Size 1.7MB
SHA256 dd579ad6573fdcc3c17aec1bd5e900b19828d66f22711fd865f86bd1d845a45f
MD5 80e5f3b6746cdbaf3b3e526ae4a8a8ee
SHA1 de0ceabdb8bc1dfefabf04e86ef61379f2872585
SHA512 ce7c49bf0e0b0a03929c5c52d26e8c775229c7a07206a0a5121f89c3ecd193820d95edd3f38515635f2bdf86524130a6d012346288670e38eecdfdeda22ac73e
SSDEEP 49152:8kQTArIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scC:8ahuRD9JdOR4m+lmY/4rx8cC
TLSH
T1948523157181D333C2FB003085C58FB55A2566224F7666EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Recovery\WindowsRE\explorer.exe
Size 1.3MB
SHA256 77e72b2555d806e91953b69ac3d60a2f2c3a65425c37b793e8f1d1aa2e5779b3
MD5 96d37778587c0361450d423b92ec9f6e
SHA1 09dfa9effdc3e9315c918b782e3a5f36b3327dd1
SHA512 3012b2626d41b0808561d93a1fa3c280ebf25ac81f7c955720662fc6afc479272657a72eef22a5e3651d25c9dd1b377e74b1f66a68d1f24d0e7a4da2c6feaeaa
SSDEEP 24576:8k70TrcagBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJ4sytPXic8Z:8kQTArIwMtuvMDVPG4JdXeR4aT6LQ+di
TLSH
T1A75523197181D3B3C2BB003189D5CB715A2671710B7AA5DFF7A8ABA62F102F4B7271C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Registry.exe

Path C:\Users\Default User\Registry.exe
Size 576KB
SHA256 9aaf9c56fe835f33bcc822062b889e524b64639301ebacbede2f4a4264c8c8c3
MD5 6b81d06aebd388ad86544d2870af027f
SHA1 4d48dece8126ddf070d97f2a7821a2d96cfe25f8
SHA512 0b0ccffbd901179d8d5e5cd362f5d2ff12aaa0eb11b3189bb9387591db7f627cca766e6e4cb4890beb9c182c802b32f192e243d8c40cf8bd747b419ea81cfe0e
SSDEEP 12288:Ah1Lk70TnvjcJUgAgux61IP20vhe/ShQnvgTRPxX3VOKGHYxi2yqJJ:8k70TrcagBukmO0ZthkvMjHVOKG4s0J
TLSH
T17BC412217180C2B3C5B7017484D5CB35AA3671710B7AA5DBBAD96BBA6F203E4B7321CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SppExtComObj.exe

Path C:\Windows\RemotePackages\SppExtComObj.exe
Size 1.2MB
SHA256 1b804cbda4ec61b1882eaee3bab78a4eea7b9c2b04f42cbca064e4261576e4e8
MD5 5f1135a85322296efb821cca2e0ff065
SHA1 8fe053b5dc66f7a810f001d98274fe3efef6303c
SHA512 539cc1674b5ef9d0ae0fcafb4e61dc7bc7c5c21809f42bc6eb4964a567707eff368001b9260cad16ee35d02df647755fa5b75ab8acaf474812a2787c61a253c6
SSDEEP 24576:8k70TrcagBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJ4sytPX8:8kQTArIwMtuvMDVPG4JdXeR4aT6LQ+dE
TLSH
T1445523197080D373C6B701318AD5CB615A2671710B7AA6DFF7ACABA62F102F4B7271C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiPrvSE.exe

Path C:\Windows\Resources\Ease of Access Themes\WmiPrvSE.exe
Size 960KB
SHA256 aad09ff7badf7f2268d5cbc6fba034396dafc3abf4fb2af00abf423215109954
MD5 17d415d330adaef4fc051e02795e5f58
SHA1 1e2cd0198ab248f039c73f865c4a6513457baf6a
SHA512 77f43c0a637975f54b04133f5e0266c0e309f05e7d71f958075ef884a7f298f4955b78596a5e5f6963d7954f973d18239f83deeb2bd6010d6ac2a12da1f855ef
SSDEEP 24576:8k70TrcagBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/6A:8kQTArIwMtuvMDVPG4JdXeR4aT6A
TLSH
T140252215B180D273C5BB113188D5CB355F2275B10BB9A5EBBAEC6BB26F102E4A7321CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4172-128-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-117-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-4-0x0000000005240000-0x00000000054BA000-memory.dmp

Download

memory/4172-8-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-20-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-48-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-62-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-70-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-74-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-72-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-68-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-66-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-64-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-60-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-58-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-56-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-54-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-52-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-50-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-46-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-118-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-42-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-40-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-36-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-32-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-30-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-28-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-38-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-34-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-26-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-24-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-22-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-18-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-17-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-14-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-12-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-10-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-6-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-5-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-80-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-82-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-120-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-130-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-2-0x0000000005230000-0x0000000005240000-memory.dmp

Download

memory/4172-127-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-124-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-3-0x0000000005750000-0x0000000005CF4000-memory.dmp

Download

memory/4172-122-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-44-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-112-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-110-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-108-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-104-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-102-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-100-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-96-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-94-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-92-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-90-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-88-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-86-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-79-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-76-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-114-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-106-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-98-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-85-0x0000000005240000-0x00000000054B4000-memory.dmp

Download

memory/4172-1534-0x0000000005230000-0x0000000005240000-memory.dmp

Download

memory/4172-1782-0x0000000005230000-0x0000000005240000-memory.dmp

Download

memory/4172-2042-0x0000000005230000-0x0000000005240000-memory.dmp

Download

memory/4172-5231-0x0000000005230000-0x0000000005240000-memory.dmp

Download

memory/4172-5232-0x0000000002AD0000-0x0000000002AEC000-memory.dmp

Download

memory/4172-5233-0x0000000002B00000-0x0000000002B50000-memory.dmp

Download

memory/4172-5235-0x0000000006220000-0x0000000006230000-memory.dmp

Download

memory/4172-5234-0x0000000002B60000-0x0000000002B68000-memory.dmp

Download

memory/4172-5236-0x00000000062E0000-0x00000000062F6000-memory.dmp

Download

memory/4172-5237-0x0000000006260000-0x0000000006268000-memory.dmp

Download

memory/4172-5238-0x0000000006300000-0x0000000006310000-memory.dmp

Download

memory/4172-5239-0x00000000067C0000-0x00000000067CA000-memory.dmp

Download

memory/4172-5240-0x00000000067F0000-0x00000000067FC000-memory.dmp

Download

memory/4172-5241-0x0000000006800000-0x0000000006812000-memory.dmp

Download

memory/4172-5242-0x0000000006830000-0x0000000006D5C000-memory.dmp

Download

memory/4172-5243-0x0000000006DC0000-0x0000000006DCC000-memory.dmp

Download

memory/4172-5244-0x0000000006DD0000-0x0000000006DDC000-memory.dmp

Download

memory/4172-5247-0x00000000071B0000-0x00000000071BC000-memory.dmp

Download

memory/4172-5246-0x00000000071A0000-0x00000000071A8000-memory.dmp

Download

memory/4172-5245-0x0000000006E00000-0x0000000006E0A000-memory.dmp

Download

memory/4172-5249-0x0000000007280000-0x000000000728C000-memory.dmp

Download

memory/4172-5250-0x0000000005230000-0x0000000005240000-memory.dmp

Download

memory/4172-1-0x00000000054D0000-0x000000000574C000-memory.dmp

Download

memory/4172-0-0x0000000005230000-0x0000000005240000-memory.dmp

Download

memory/4172-5248-0x00000000071C0000-0x0000000007252000-memory.dmp

Download

memory/4172-5253-0x0000000007400000-0x0000000007466000-memory.dmp

Download

memory/4172-8794-0x0000000005230000-0x0000000005240000-memory.dmp

Download

memory/4172-8290-0x0000000005230000-0x0000000005240000-memory.dmp

Download