dcrat | 538edd2f332ffd3f6f9623891e24a2d1fc4926d17d6afb9d366a406e0657dba7

Analysis

max time kernel
63s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample260629-mmb1vsay9x
SHA256 538edd2f332ffd3f6f9623891e24a2d1fc4926d17d6afb9d366a406e0657dba7
MD5 04016d6101360169809cc85ad2e0b0b8
SHA1 c319601566c4a4fb6a0ffb19f62a4c6486045bc0
SHA512 feee8810e2103fee9fcdbe30c74dae7b4f195a8ea4b91e4d4fead60f7bbd21aed78495efa8970e323fef210e9e3b15cbb054f063611a37947e03340cff9ef2b3
SSDEEP 49152:8kQzAbIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scI:86xuRD9JdOR4m+lmY/4rx8cI
TLSH
T1898523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\dllhost.exe\""	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\dllhost.exe\", \"C:\\Program Files\\Common Files\\System\\fr-FR\\services.exe\""	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\dllhost.exe\", \"C:\\Program Files\\Common Files\\System\\fr-FR\\services.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\Idle.exe\""	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\dllhost.exe\", \"C:\\Program Files\\Common Files\\System\\fr-FR\\services.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\ctfmon.exe\""	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6004	5736	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	5736	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	5736	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5916	5736	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	5736	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	5736	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	5736	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	5736	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	5736	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	5736	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	5736	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	5736	schtasks.exe	90

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral2/memory/3404-5233-0x00000000064B0000-0x00000000064C0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3404-5237-0x0000000006580000-0x000000000658A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3404-5242-0x0000000006E90000-0x0000000006E9C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3404-5245-0x00000000073B0000-0x00000000073BC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3404-5243-0x0000000007290000-0x000000000729A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1224	powershell.exe
1212	powershell.exe
5424	powershell.exe
6760	powershell.exe
6540	powershell.exe
5360	powershell.exe
4532	powershell.exe
5604	powershell.exe
2032	powershell.exe
2736	powershell.exe
7896	powershell.exe
6432	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1540	dllhost.exe
1172	ctfmon.exe
3432	services.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\dllhost.exe\""	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Common Files\\System\\fr-FR\\services.exe\""	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Common Files\\System\\fr-FR\\services.exe\""	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\Idle.exe\""	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\Idle.exe\""	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon = "\"C:\\Recovery\\WindowsRE\\ctfmon.exe\""	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon = "\"C:\\Recovery\\WindowsRE\\ctfmon.exe\""	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\dllhost.exe\""	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/3404-5233-0x00000000064B0000-0x00000000064C0000-memory.dmp	SmartAssembly
behavioral2/memory/3404-5237-0x0000000006580000-0x000000000658A000-memory.dmp	SmartAssembly
behavioral2/memory/3404-5242-0x0000000006E90000-0x0000000006E9C000-memory.dmp	SmartAssembly
behavioral2/memory/3404-5245-0x00000000073B0000-0x00000000073BC000-memory.dmp	SmartAssembly
behavioral2/memory/3404-5243-0x0000000007290000-0x000000000729A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX878B.tmp	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX9141.tmp	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\Idle.exe	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Common Files\System\fr-FR\services.exe	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Common Files\System\fr-FR\c5b4cb5e9653cc	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\6ccacd8608530f	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\Idle.exe	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\System\fr-FR\RCX8269.tmp	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\System\fr-FR\RCX82E7.tmp	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\System\fr-FR\services.exe	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\RCX7FB8.tmp	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\dllhost.exe	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\dllhost.exe	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\5940a34987c991	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\RCX7E31.tmp	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4304	schtasks.exe
4732	schtasks.exe
1712	schtasks.exe
4804	schtasks.exe
1348	schtasks.exe
3712	schtasks.exe
3280	schtasks.exe
6004	schtasks.exe
1524	schtasks.exe
5916	schtasks.exe
2540	schtasks.exe
2980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	1540	dllhost.exe
Token: SeDebugPrivilege	1172	ctfmon.exe
Token: SeDebugPrivilege	3432	services.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 5604	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	114
PID 3404 wrote to memory of 6760	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	115
PID 3404 wrote to memory of 5424	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	116
PID 3404 wrote to memory of 4532	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	117
PID 3404 wrote to memory of 5360	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	118
PID 3404 wrote to memory of 1212	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	119
PID 3404 wrote to memory of 1224	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	120
PID 3404 wrote to memory of 6432	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	121
PID 3404 wrote to memory of 6540	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	122
PID 3404 wrote to memory of 7896	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	123
PID 3404 wrote to memory of 2736	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	124
PID 3404 wrote to memory of 2032	3404	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	125

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_04016d6101360169809cc85ad2e0b0b8_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3404
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5604
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5424
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4532
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5360
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1224
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6432
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6540
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows.old/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2032
- C:\Recovery\WindowsRE\ctfmon.exe
  "C:\Recovery\WindowsRE\ctfmon.exe"
  2⤵
  PID:7388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\ServiceProfiles\NetworkService\AppData\Local\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\AppData\Local\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\ServiceProfiles\NetworkService\AppData\Local\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\System\fr-FR\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\fr-FR\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\System\fr-FR\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\ctfmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3280

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\dllhost.exe
"C:\Windows\ServiceProfiles\NetworkService\AppData\Local\dllhost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Recovery\WindowsRE\ctfmon.exe
"C:\Recovery\WindowsRE\ctfmon.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Program Files\Common Files\System\fr-FR\services.exe
"C:\Program Files\Common Files\System\fr-FR\services.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX878B.tmp

Path C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX878B.tmp
Size 1.7MB
SHA256 6d2413ea1b99e321f42fb5f9a68c193139d178154eba6cea0acbffaf2158b386
MD5 b5b37b2835b38cb51f7772bb18dac664
SHA1 f153538a968a06de151d4f0f0dcfd2a332e39ec1
SHA512 4ed0cfde7c7152e9f50e75eda9c444a9be679311999eab7c5ff541805447ce62b6506ec5b77c6c23f2ed97639afee8f479944d7366e58f79619220fcc24d17a3
SSDEEP 49152:8kQzAbIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scn:86xuRD9JdOR4m+lmY/4rx8cn
TLSH
T17D8523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ctfmon.exe

Path C:\Recovery\WindowsRE\ctfmon.exe
Size 1.7MB
SHA256 538edd2f332ffd3f6f9623891e24a2d1fc4926d17d6afb9d366a406e0657dba7
MD5 04016d6101360169809cc85ad2e0b0b8
SHA1 c319601566c4a4fb6a0ffb19f62a4c6486045bc0
SHA512 feee8810e2103fee9fcdbe30c74dae7b4f195a8ea4b91e4d4fead60f7bbd21aed78495efa8970e323fef210e9e3b15cbb054f063611a37947e03340cff9ef2b3
SSDEEP 49152:8kQzAbIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scI:86xuRD9JdOR4m+lmY/4rx8cI
TLSH
T1898523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 24KB
SHA256 8260910ade91ed065c23e6f2594cccb87c51201d827fe8a6afb42e943de8f115
MD5 38df7641fa2e8c6b2c48afac41980967
SHA1 4148546cc64151c3960e2266cceb50c8ab68bc9b
SHA512 a9e87a10f1f76d054e9879d89fb6f48d7996a1fe022b49ba51543278c8a8458aa7dd92bd8b9e9772a31d7458e32b3934d1dde75eea1c911ad5e6afac7f0f74c5
SSDEEP 384:HYQu2Tu/qiUtib4rdsib4BYo2Thq3OoahYflkipVOoWTfrRJPFCD:HYQ3yiiU7dKYo2hq3vdfKQVOowfrRJPO
TLSH
T18EB28683BD204E71E6A66F3EF15721617C30394650E8113261DE29DFAA878970B1F5FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 bfae041b98c52e576ae6030cbc7a652a40a8dd823cf2c936cb112e4ba0079095
MD5 ce40fd9225eeacc1beb1033af84bcf3e
SHA1 62f3b230533eadddb083ece5ed902be9fbf8c630
SHA512 da6d3f153887b868d71f5e1e348f8984a962256946d99b682522c0febb4566db36bfd53b3ba69d327b611296bad21e121a89421f1e4192ae12d39c3b7ed2f1e5
SSDEEP 1536:ntdKYo2hq3vdfKQVGflJdCHYWh4iUxPR40i71YiyyPcMrxoV3CNBQkj2Ya5eDjIj:nvKYo2hq3vdfKQVGflJdwYWqiUPRCqpt
TLSH
T1E05384D2E9204E75E2A66F3EF15622627C34394690F8113212DC24AF9987D970B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 cdf4792800f18a3d3c73656937be9823b3a53f6c48937f6e293172b52389a53b
MD5 fcec94cdc5b54b4587dff1154447d0bb
SHA1 384ca0668bd509fcd0315c3f3c9ac9c806107ef0
SHA512 2d87df205913effa1cdd98e6587348647ec18172110d53142fe9c4b09171aed8b303d262f2e234a7e3953baa16a0f15264c5966b61f7af4e85b2d2568f559183
SSDEEP 1536:EtdKYo2hqHMBfKQVGflJdCHYIh4iUxPR40i71YiyyPUOdBcV3CNBQkj2Ya5eDjI2:EvKYo2hqHMBfKQVGflJdwYIqiUPRCqpA
TLSH
T18E5373D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 e5882e25564413f041dfddcc42a4e34790e3d7ed5019d4d9696d6d2fb2e80bde
MD5 0b9b2422852a02f90750d234811d80ec
SHA1 f489b24d680977d42360f3fbe3a4556f3d3697e2
SHA512 4bf57e7da833a7629a39a1cda0013e085344cfad0a4645656341216720ecbb76a8bd50551f621b56be31ee9e37f937748828853c51f08afede910a2bfa1c2929
SSDEEP 1536:EtdKYo2hqHMBfKQVGflJdCHYUh4iUxPR40i71YiyyPUOdBcV3CNBQkj2Ya5eDjI2:EvKYo2hqHMBfKQVGflJdwYUqiUPRCqpA
TLSH
T1575373D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dset31se.4ln.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dset31se.4ln.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dllhost.exe

Path C:\Windows\ServiceProfiles\NetworkService\AppData\Local\dllhost.exe
Size 1.7MB
SHA256 ff71906269b3f50d98ac5f0c8ed69c6c95c5ccfceb7ecbd5f4e60931ecb40463
MD5 a02b0c25bb3a5c7fa1e8c67bb4fb1c61
SHA1 7c810243ab461527c670aca19fec482a96724344
SHA512 57809c69f288c5a2bee7b5162f28c0fac095fa20283853aa1c26e3c26a6fd343ec8ad634a7ea80b586bda2af396154baf9e2b947f28f03bd3164a4ab55cf4d20
SSDEEP 49152:8kQzA8IwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sca:86kuRD9JdOR4m+lmY/4rx8ca
TLSH
T12E8523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-23890-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/1224-24755-0x0000000007760000-0x00000000077F6000-memory.dmp

Download

memory/1224-24504-0x0000000007560000-0x000000000756A000-memory.dmp

Download

memory/1224-24257-0x0000000006810000-0x000000000682A000-memory.dmp

Download

memory/1224-24248-0x0000000007B90000-0x000000000820C000-memory.dmp

Download

memory/1224-23913-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/2032-24085-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/2736-24192-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/3404-15-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-9-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-118-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-116-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-114-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-112-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-124-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-108-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-110-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-106-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-104-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-102-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-100-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-98-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-96-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-94-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-92-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-90-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-88-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-86-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-84-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-82-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-80-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-74-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-70-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-68-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-67-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-64-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-63-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-60-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-56-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-48-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-46-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-42-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-39-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-77-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-72-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-58-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-54-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-52-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-50-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-44-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-37-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-35-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-33-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-31-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-28-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-23-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-18-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-122-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-11-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-7-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-6-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-40-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/3404-29-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-25-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-21-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-120-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-2119-0x00000000747E2000-0x00000000747E3000-memory.dmp

Download

memory/3404-2120-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/3404-5229-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/3404-5230-0x0000000002C50000-0x0000000002C6C000-memory.dmp

Download

memory/3404-5231-0x0000000002C80000-0x0000000002CD0000-memory.dmp

Download

memory/3404-5232-0x0000000002CE0000-0x0000000002CE8000-memory.dmp

Download

memory/3404-5233-0x00000000064B0000-0x00000000064C0000-memory.dmp

Download

memory/3404-5234-0x0000000006510000-0x0000000006526000-memory.dmp

Download

memory/3404-5235-0x00000000064F0000-0x00000000064F8000-memory.dmp

Download

memory/3404-5236-0x0000000006530000-0x0000000006540000-memory.dmp

Download

memory/3404-5237-0x0000000006580000-0x000000000658A000-memory.dmp

Download

memory/3404-5238-0x00000000068B0000-0x00000000068BC000-memory.dmp

Download

memory/3404-5239-0x00000000068C0000-0x00000000068D2000-memory.dmp

Download

memory/3404-5240-0x00000000068F0000-0x0000000006E1C000-memory.dmp

Download

memory/3404-5241-0x0000000006E80000-0x0000000006E8C000-memory.dmp

Download

memory/3404-5242-0x0000000006E90000-0x0000000006E9C000-memory.dmp

Download

memory/3404-5245-0x00000000073B0000-0x00000000073BC000-memory.dmp

Download

memory/3404-5244-0x00000000073A0000-0x00000000073A8000-memory.dmp

Download

memory/3404-5243-0x0000000007290000-0x000000000729A000-memory.dmp

Download

memory/3404-5247-0x00000000073E0000-0x0000000007472000-memory.dmp

Download

memory/3404-5248-0x00000000074A0000-0x00000000074AC000-memory.dmp

Download

memory/3404-5246-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/3404-5250-0x0000000007610000-0x0000000007676000-memory.dmp

Download

memory/3404-7856-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/3404-8886-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/3404-0-0x00000000747E2000-0x00000000747E3000-memory.dmp

Download

memory/3404-1-0x0000000005400000-0x000000000567C000-memory.dmp

Download

memory/3404-2-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/3404-4-0x0000000005C40000-0x0000000005EBA000-memory.dmp

Download

memory/3404-5-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/3404-3-0x0000000005680000-0x0000000005C3A000-memory.dmp

Download

memory/3404-21375-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/3404-13-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-19-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-78-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-128-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-132-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-130-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/3404-127-0x0000000005C40000-0x0000000005EB4000-memory.dmp

Download

memory/4532-23951-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/5360-10816-0x00000000024A0000-0x00000000024D6000-memory.dmp

Download

memory/5360-23958-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/5360-12527-0x00000000050E0000-0x000000000572A000-memory.dmp

Download

memory/5424-23888-0x0000000006E80000-0x0000000006EA0000-memory.dmp

Download

memory/5424-23856-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/5604-24025-0x0000000007820000-0x00000000078C3000-memory.dmp

Download

memory/5604-23874-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/6432-23840-0x0000000006970000-0x00000000069A6000-memory.dmp

Download

memory/6432-23867-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/6432-21005-0x0000000006430000-0x000000000647C000-memory.dmp

Download

memory/6540-20726-0x0000000005DD0000-0x000000000612B000-memory.dmp

Download

memory/6540-20976-0x0000000006190000-0x00000000061AE000-memory.dmp

Download

memory/6540-18251-0x00000000053E0000-0x0000000005446000-memory.dmp

Download

memory/6540-18144-0x00000000053B0000-0x00000000053D2000-memory.dmp

Download

memory/6540-23889-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/6760-23868-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/7896-23990-0x0000000070660000-0x00000000706AC000-memory.dmp

Download