dcrat | 13d0f338e9aa2fef9f0ffb320d1304fe1e9a0a3d2b12ba31adab4f6bd721dfc6

Analysis

max time kernel
149s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 2.0MB
Sample260604-byfbwagv3v
SHA256 13d0f338e9aa2fef9f0ffb320d1304fe1e9a0a3d2b12ba31adab4f6bd721dfc6
MD5 4fb2acb7cf1145d6f23fd36ed06e6653
SHA1 e989848a35de784cdad303d4569750017d98665b
SHA512 0e7711b246945b1cc70a3d6a85415db729001bff8cc05b4e3e481f9596879109c0eb80b9c767b5e77e9a40cf7e33f2c4bd1f0c6095b07b1cf1384b72b985f4d9
SSDEEP 49152:ykQTA1YS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQp4:ya15CbhZcT2lvnDFpFW/twU7+4
TLSH
T144A5337470D1C1B2E5A6103584CACB32A6367062877EC1CBBADD76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 32 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		5384	schtasks.exe
		4856	schtasks.exe
File created	C:\Windows\Media\Landscape\56085415360792		2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		4876	schtasks.exe
		564	schtasks.exe
		5812	schtasks.exe
		4484	schtasks.exe
		3020	schtasks.exe
		2752	schtasks.exe
		736	schtasks.exe
		5192	schtasks.exe
		2504	schtasks.exe
		4020	schtasks.exe
		4784	schtasks.exe
		2592	schtasks.exe
		4780	schtasks.exe
		3220	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		2704	schtasks.exe
		2008	schtasks.exe
		3892	schtasks.exe
		3684	schtasks.exe
		4764	schtasks.exe
		2104	schtasks.exe
		5320	schtasks.exe
		5508	schtasks.exe
		3268	schtasks.exe
		2364	schtasks.exe
		2560	schtasks.exe
		4884	schtasks.exe
		5232	schtasks.exe
		5096	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Media\\Landscape\\wininit.exe\""	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Media\\Landscape\\wininit.exe\", \"C:\\Windows\\RemotePackages\\RemoteApps\\taskhostw.exe\""	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5812	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5232	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3220	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5508	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5384	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5192	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5320	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	392	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	392	schtasks.exe	80

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 7 IoCs

resource	yara_rule
behavioral2/memory/6028-5232-0x00000000066C0000-0x00000000066D0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/6028-5238-0x0000000006AA0000-0x0000000006AAA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/6028-5246-0x00000000081A0000-0x00000000081AC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/6028-5247-0x00000000081C0000-0x00000000081CC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/6028-5249-0x00000000081F0000-0x00000000081FC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/6028-5255-0x0000000008600000-0x000000000860A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/6028-5251-0x00000000085A0000-0x00000000085AA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5936	powershell.exe
3144	powershell.exe
4548	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Executes dropped EXE 2 IoCs

pid	Process
3456	wininit.exe
3028	taskhostw.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Media\\Landscape\\wininit.exe\""	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Media\\Landscape\\wininit.exe\""	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\RemotePackages\\RemoteApps\\taskhostw.exe\""	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\RemotePackages\\RemoteApps\\taskhostw.exe\""	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe

SmartAssembly .NET packer 7 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/6028-5232-0x00000000066C0000-0x00000000066D0000-memory.dmp	SmartAssembly
behavioral2/memory/6028-5238-0x0000000006AA0000-0x0000000006AAA000-memory.dmp	SmartAssembly
behavioral2/memory/6028-5246-0x00000000081A0000-0x00000000081AC000-memory.dmp	SmartAssembly
behavioral2/memory/6028-5247-0x00000000081C0000-0x00000000081CC000-memory.dmp	SmartAssembly
behavioral2/memory/6028-5249-0x00000000081F0000-0x00000000081FC000-memory.dmp	SmartAssembly
behavioral2/memory/6028-5255-0x0000000008600000-0x000000000860A000-memory.dmp	SmartAssembly
behavioral2/memory/6028-5251-0x00000000085A0000-0x00000000085AA000-memory.dmp	SmartAssembly

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Media\Landscape\wininit.exe	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\Media\Landscape\RCX951A.tmp	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\RCX98E5.tmp	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\taskhostw.exe	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Windows\Media\Landscape\56085415360792	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Windows\RemotePackages\RemoteApps\taskhostw.exe	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Windows\RemotePackages\RemoteApps\ea9f0e6c9e2dcd	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\Media\Landscape\RCX9519.tmp	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\RCX98E4.tmp	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Windows\Media\Landscape\wininit.exe	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w32tm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5192	schtasks.exe
4876	schtasks.exe
3220	schtasks.exe
4884	schtasks.exe
4764	schtasks.exe
2364	schtasks.exe
4780	schtasks.exe
4020	schtasks.exe
736	schtasks.exe
564	schtasks.exe
5384	schtasks.exe
5812	schtasks.exe
5232	schtasks.exe
2752	schtasks.exe
3268	schtasks.exe
5320	schtasks.exe
3892	schtasks.exe
3684	schtasks.exe
5508	schtasks.exe
4784	schtasks.exe
5096	schtasks.exe
4856	schtasks.exe
2008	schtasks.exe
4484	schtasks.exe
2704	schtasks.exe
3020	schtasks.exe
2504	schtasks.exe
2104	schtasks.exe
2592	schtasks.exe
2560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5936	powershell.exe
5936	powershell.exe
3144	powershell.exe
3144	powershell.exe
4548	powershell.exe
4548	powershell.exe
5936	powershell.exe
3144	powershell.exe
4548	powershell.exe
3028	taskhostw.exe
3028	taskhostw.exe
3028	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	3456	wininit.exe
Token: SeDebugPrivilege	3028	taskhostw.exe
Token: SeDebugPrivilege	5936	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	4548	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6028 wrote to memory of 3144	6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	93
PID 6028 wrote to memory of 5936	6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	94
PID 6028 wrote to memory of 4548	6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	95
PID 6028 wrote to memory of 2816	6028	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	99
PID 2816 wrote to memory of 6128	2816	cmd.exe	101
PID 6128 wrote to memory of 5336	6128	w32tm.exe	102

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:6028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\Landscape\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VXDoKEq81l.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6128
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
    3⤵
    PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\Media\Landscape\wininit.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Media\Landscape\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\Media\Landscape\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\RemotePackages\RemoteApps\taskhostw.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Windows\RemotePackages\RemoteApps\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220

C:\Windows\Media\Landscape\wininit.exe
"C:\Windows\Media\Landscape\wininit.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Windows\RemotePackages\RemoteApps\taskhostw.exe
"C:\Windows\RemotePackages\RemoteApps\taskhostw.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3028
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e517b17a-e056-4130-9e4b-9c4df2d08a4b.vbs"
  2⤵
  PID:4876
- - C:\Windows\RemotePackages\RemoteApps\taskhostw.exe
    C:\Windows\RemotePackages\RemoteApps\taskhostw.exe
    3⤵
    PID:5668
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e8f2581-68fe-4ce1-aa7d-d54b46400870.vbs"
  2⤵
  PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\SearchHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\microsoft shared\VGX\wininit.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\VGX\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4020

C:\Program Files (x86)\Windows Defender\ja-JP\SearchHost.exe
"C:\Program Files (x86)\Windows Defender\ja-JP\SearchHost.exe"
1⤵
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\microsoft shared\VGX\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\USOShared\Logs\System.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\USOShared\Logs\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\USOShared\Logs\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Containers\serviced\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Users\Default User\dllhost.exe
"C:\Users\Default User\dllhost.exe"
1⤵
PID:6132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\Containers\serviced\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\Accessories\fr-FR\smss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\fr-FR\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Program Files\Common Files\microsoft shared\VGX\wininit.exe
"C:\Program Files\Common Files\microsoft shared\VGX\wininit.exe"
1⤵
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\fr-FR\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Links\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\Links\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Links\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\wscript.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Users\All Users\wscript.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\wscript.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2026-06-04_4fb2acb7cf1145d6f23fd36ed06e6653_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe.log
Size 1KB
SHA256 e8a0a0a992d27f9ad983614c0ab7f0a4b0130f82b1ec07ee918e8953dd425269
MD5 eec12fd42d0831f714b2b8aa213b1529
SHA1 2a52c43cb866ad9ee65cd46ff5d7f2772768d7d5
SHA512 8143f19b704e510db8318ab3a079dd049b35d88c22fc63d06a9b0b0ca84825452f7662a427a7d182784e83491827a20d66ebe7a30af72c52b34d7daf6cce80ff
TLSH
T17D317A303261B5D80D022F570818AAC412FF4749BAB4EF5CB595325EED2A04B9B221F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
TLSH
T10B415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

taskhostw.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\taskhostw.exe.log
Size 1KB
SHA256 7d35187161fac62044c0082d0a5cfd0ff4ea8ad03daf0a6d0646c08d40dbc230
MD5 300e26d9c757ea70dd6cc7922c7fccdf
SHA1 bed00d488893de4e4b9b7e9fb793df3e689a50d5
SHA512 601f35f7bf2ca0486b6574527f50295cbd2ef4ec0ddb3d178b1b0e1c75ca8d3ac5ba200524c799369849a31db013f25a5eeb33de8b25534756a0ea18f3842f57
TLSH
T113216D303231B5D80D522F5708586AC916FF0745BAA8DF6CB699325EDD2A04BAB221E3
MD5 SHA1 SHA512 TLSH

Submit Download

wininit.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wininit.exe.log
Size 942B
SHA256 54ed88aec6eae20f57d6e9ad59b96959b326557d30b20609c021194706240493
MD5 49c71e2e40f98f6ac4eeb0cac2577ac0
SHA1 fbc92dd6f00413b6b3108ba2fdcc31633e983300
SHA512 185598c417b36f1d069b4d34e4f01a844989a20d9fd8d1420cc5577df797f6a2338e83dbf6d949bc71007029ee9d806d0903d606672a04a05103dc8f8114c07b
TLSH
T17B1159702231B1D94C533F930C5D66841AFF0755B6A8EE2C7599325EDC2A0176F222E3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 1b7050da5a285baa4bafb1bad35cf701b89e3110e4fe657cf3dc6624e35d0e99
MD5 bcde985c10381ae6ff0a684f50f05a42
SHA1 fca3eec2eab5e604e012334dd50a067388f05ecd
SHA512 da625deaf3c61d93e7c9019fa2471ffe1f759cbf579b02d4b7610d5b777bae6d743fe26f8c8b41d15f18a8818b669f3772da12448a80baa730dd467df408330f
SSDEEP 384:1OTHhc1SS1UQHJXJFRHEMEeVPnNfjs2xtgmNih2L949J0X0iFBX:vSSCQNHRPEkfj7xtguihe49J0X0s
TLSH
T1A992D5AE711F22C3C89553B8E10B050FE8F2DE8D431912D9B72E9F7B8AAC55E813D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 93d55221c4fc319f5f5e0bf4ca2871a3c3abd915d9976698619ae696e9325321
MD5 0ffed80d564e19a82f5ef0528a2511b9
SHA1 89b05125aacf86cd2bda8283d661fae1e7a4f8c8
SHA512 235da3744a873c06f264fee5a98add4f3d6ae1caf931c9d7f7ad659061fd2939917ea5b4a99214dffc08b08fbd7949f64d6925e051a54772d7a0964097c3b733
SSDEEP 384:HL3HhY1SS1yB6xmfKiltEMEQEZnNvjs2xtgyNry2L9d9JAu0iFFX:rWSStxmfFNEv3vj7xtgCryed9JAu0Y
TLSH
T15692C6AE711F22C3C89553B8E107050FE8F2DE8D431922D8BB2E9F7B89AC95E517D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e8f2581-68fe-4ce1-aa7d-d54b46400870.vbs

Path C:\Users\Admin\AppData\Local\Temp\2e8f2581-68fe-4ce1-aa7d-d54b46400870.vbs
Size 502B
SHA256 29ac0d383a78b042c84df47f3cec4d6898f423b29cb9302c4bf7fad09a0f28d0
MD5 9e14704f10a4fa71c3fb010e023f7dbb
SHA1 9afddf94021cbab1f8f6eb6243c0acc8de2e37f9
SHA512 6dc623a30dd3ab1542fd8be71d6f73da70ed74a471e5fc95d7b7822774c4f40e94af3111d0bfa1c207a6dc51fbb0dc477146d518ec491ac59d8ee9281041675e
TLSH
T184F09E1DBF05CB74DD11174302FA95CF4ABCA40D3574D59D6548E89D32501394EEE5CD
MD5 SHA1 SHA512 TLSH

Submit Download

VXDoKEq81l.bat

Path C:\Users\Admin\AppData\Local\Temp\VXDoKEq81l.bat
Size 303B
SHA256 ecd0c09e00ba8f4b203153afebff1fde7eb3385c69bce4a2819e4edb89cc7481
MD5 8a2b3223903d3f85d9a9df984793718f
SHA1 15153c408be2109ba89bd99bb2fbd83a85c01cdc
SHA512 7318bb934d2d2dcd7db269dadf86057336754731b80d8643fc3cfa27d1a3f4f46fe0e24842b7cd28b5f645d51c8042ef19d996b872449a9393084ff2267c3456
TLSH
T157E0E7434003CB190046400714A7658CB5651C1C35C53F311750955C16FF4F9B5A3142
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yunrocyl.qty.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yunrocyl.qty.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e517b17a-e056-4130-9e4b-9c4df2d08a4b.vbs

Path C:\Users\Admin\AppData\Local\Temp\e517b17a-e056-4130-9e4b-9c4df2d08a4b.vbs
Size 726B
SHA256 41aec6631396cd2f4519037bb36134e8f0767462ffb5a7eaac8aee8a96de4964
MD5 0d276516e6a0bed23e998a2de9dfa778
SHA1 a72198f71056da46962a047f520f0db69f05e877
SHA512 c1413dfff575eaa7cb9c61a865f0af52ed78efe3d26643bc319b9659cde93a3e6df4d4c83ccd751892c30d1ac5b19992462191dcca6ce7b1a232edd6dd75ff7c
TLSH
T14B01C009BF0BEA7024A1334191F655BB69D8C0183176FC5BB950E46C271992504AC5EE
MD5 SHA1 SHA512 TLSH

Submit Download

wininit.exe

Path C:\Windows\Media\Landscape\wininit.exe
Size 2.0MB
SHA256 13d0f338e9aa2fef9f0ffb320d1304fe1e9a0a3d2b12ba31adab4f6bd721dfc6
MD5 4fb2acb7cf1145d6f23fd36ed06e6653
SHA1 e989848a35de784cdad303d4569750017d98665b
SHA512 0e7711b246945b1cc70a3d6a85415db729001bff8cc05b4e3e481f9596879109c0eb80b9c767b5e77e9a40cf7e33f2c4bd1f0c6095b07b1cf1384b72b985f4d9
SSDEEP 49152:ykQTA1YS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQp4:ya15CbhZcT2lvnDFpFW/twU7+4
TLSH
T144A5337470D1C1B2E5A6103584CACB32A6367062877EC1CBBADD76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3028-15766-0x0000000007CA0000-0x0000000007CB2000-memory.dmp

Download

memory/3144-6738-0x0000000005380000-0x00000000059AA000-memory.dmp

Download

memory/3144-6737-0x0000000002C10000-0x0000000002C46000-memory.dmp

Download

memory/3144-15769-0x0000000070700000-0x000000007074C000-memory.dmp

Download

memory/4548-15778-0x0000000070700000-0x000000007074C000-memory.dmp

Download

memory/5936-15765-0x0000000007780000-0x0000000007791000-memory.dmp

Download

memory/5936-15767-0x00000000077B0000-0x00000000077BE000-memory.dmp

Download

memory/5936-15693-0x00000000064D0000-0x00000000064DA000-memory.dmp

Download

memory/5936-15151-0x0000000007550000-0x000000000756A000-memory.dmp

Download

memory/5936-14729-0x0000000070700000-0x000000007074C000-memory.dmp

Download

memory/5936-14736-0x0000000007380000-0x000000000739E000-memory.dmp

Download

memory/5936-14737-0x0000000007400000-0x00000000074A4000-memory.dmp

Download

memory/5936-15140-0x0000000007B90000-0x000000000820A000-memory.dmp

Download

memory/5936-14728-0x00000000073C0000-0x00000000073F4000-memory.dmp

Download

memory/5936-15764-0x0000000007810000-0x00000000078A6000-memory.dmp

Download

memory/5936-9669-0x00000000062B0000-0x00000000062FC000-memory.dmp

Download

memory/5936-9495-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

Download

memory/5936-8028-0x0000000005B90000-0x0000000005BB2000-memory.dmp

Download

memory/5936-8037-0x0000000005C30000-0x0000000005C96000-memory.dmp

Download

memory/5936-8185-0x0000000005E10000-0x0000000006167000-memory.dmp

Download

memory/5936-15768-0x00000000077C0000-0x00000000077D5000-memory.dmp

Download

memory/5936-15776-0x00000000078D0000-0x00000000078EA000-memory.dmp

Download

memory/5936-15777-0x00000000078B0000-0x00000000078B8000-memory.dmp

Download

memory/6028-42-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-5241-0x0000000006BB0000-0x0000000006BBC000-memory.dmp

Download

memory/6028-34-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-32-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-30-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-24-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-28-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-26-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-22-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-20-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-18-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-14-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-12-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-6-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-10-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-5-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-98-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-100-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-124-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-120-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-118-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-130-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-128-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-126-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-116-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-114-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-112-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-110-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-102-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-122-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-96-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-108-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-106-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-104-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-94-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-1696-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/6028-1919-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/6028-2241-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/6028-5228-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/6028-5229-0x0000000002CF0000-0x0000000002D0C000-memory.dmp

Download

memory/6028-5230-0x0000000002D20000-0x0000000002D70000-memory.dmp

Download

memory/6028-5231-0x0000000002D80000-0x0000000002D88000-memory.dmp

Download

memory/6028-5232-0x00000000066C0000-0x00000000066D0000-memory.dmp

Download

memory/6028-5233-0x00000000066D0000-0x00000000066E6000-memory.dmp

Download

memory/6028-5234-0x0000000006910000-0x0000000006918000-memory.dmp

Download

memory/6028-5235-0x0000000006920000-0x0000000006932000-memory.dmp

Download

memory/6028-5236-0x0000000006940000-0x0000000006948000-memory.dmp

Download

memory/6028-5237-0x0000000006AC0000-0x0000000006AD0000-memory.dmp

Download

memory/6028-5239-0x0000000006AF0000-0x0000000006B82000-memory.dmp

Download

memory/6028-5238-0x0000000006AA0000-0x0000000006AAA000-memory.dmp

Download

memory/6028-5240-0x0000000006AB0000-0x0000000006AB8000-memory.dmp

Download

memory/6028-40-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-5242-0x0000000006BC0000-0x0000000006BC8000-memory.dmp

Download

memory/6028-5244-0x0000000006BD0000-0x0000000006BE2000-memory.dmp

Download

memory/6028-5245-0x0000000007C30000-0x000000000815C000-memory.dmp

Download

memory/6028-5246-0x00000000081A0000-0x00000000081AC000-memory.dmp

Download

memory/6028-5247-0x00000000081C0000-0x00000000081CC000-memory.dmp

Download

memory/6028-5248-0x00000000081D0000-0x00000000081DC000-memory.dmp

Download

memory/6028-5249-0x00000000081F0000-0x00000000081FC000-memory.dmp

Download

memory/6028-5250-0x0000000008200000-0x0000000008208000-memory.dmp

Download

memory/6028-5252-0x00000000085B0000-0x00000000085BE000-memory.dmp

Download

memory/6028-5255-0x0000000008600000-0x000000000860A000-memory.dmp

Download

memory/6028-5256-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/6028-5254-0x00000000085F0000-0x00000000085F8000-memory.dmp

Download

memory/6028-5253-0x00000000085E0000-0x00000000085E8000-memory.dmp

Download

memory/6028-5251-0x00000000085A0000-0x00000000085AA000-memory.dmp

Download

memory/6028-5257-0x0000000008630000-0x000000000863C000-memory.dmp

Download

memory/6028-5260-0x0000000008650000-0x00000000086B6000-memory.dmp

Download

memory/6028-0-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/6028-50-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-44-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-7564-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/6028-7814-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/6028-46-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-48-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-52-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-54-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-58-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-61-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-62-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-64-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-70-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-66-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-68-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-74-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-76-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-78-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-80-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-82-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-84-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-86-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-88-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-92-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-90-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-72-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-56-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-38-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-36-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-17-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-8-0x0000000005280000-0x0000000005531000-memory.dmp

Download

memory/6028-4-0x0000000005280000-0x0000000005536000-memory.dmp

Download

memory/6028-3-0x0000000005800000-0x0000000005DA6000-memory.dmp

Download

memory/6028-2-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/6028-1-0x0000000005540000-0x00000000057F8000-memory.dmp

Download