4d2f5cfcc9a1517201242ccf7958dcf8a5c6ca94b19699e1f2ef7a3d52c8f90b

Analysis

max time kernel
37s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample260629-relmjsfs4v
SHA256 4d2f5cfcc9a1517201242ccf7958dcf8a5c6ca94b19699e1f2ef7a3d52c8f90b
MD5 8e5bf8f424e094846e93361ed432735a
SHA1 68f67e637c39377c435c74e7674766c59b8e6ace
SHA512 e8fa5c5176a50682dd4334a90f31ded50b01143484e39330e8d6d529455e7a8bbdf3d99e40eacb472e0f069c1c059279a14a0c53ac55b7a09d27f76a5167c3c6
SSDEEP 49152:ckQzA4IwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scS:c6QuRD9JdOR4m+lmY/4rx8cS
TLSH
T1EC8523197181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5812	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5136	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5180	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5492	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6172	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6604	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5628	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7044	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5936	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5164	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6740	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8992	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8104	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7180	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8552	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5496	3464	schtasks.exe	83

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral1/memory/4456-5232-0x0000000006230000-0x0000000006240000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/4456-5236-0x0000000006730000-0x000000000673A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/4456-5241-0x0000000006810000-0x000000000681C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/4456-5242-0x0000000006840000-0x000000000684A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/4456-5244-0x0000000007130000-0x000000000713C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/4456-5232-0x0000000006230000-0x0000000006240000-memory.dmp	SmartAssembly
behavioral1/memory/4456-5236-0x0000000006730000-0x000000000673A000-memory.dmp	SmartAssembly
behavioral1/memory/4456-5241-0x0000000006810000-0x000000000681C000-memory.dmp	SmartAssembly
behavioral1/memory/4456-5242-0x0000000006840000-0x000000000684A000-memory.dmp	SmartAssembly
behavioral1/memory/4456-5244-0x0000000007130000-0x000000000713C000-memory.dmp	SmartAssembly

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2640	schtasks.exe
2660	schtasks.exe
3172	schtasks.exe
5812	schtasks.exe
5136	schtasks.exe
5164	schtasks.exe
1100	schtasks.exe
1204	schtasks.exe
4448	schtasks.exe
4996	schtasks.exe
2548	schtasks.exe
3920	schtasks.exe
5492	schtasks.exe
5936	schtasks.exe
2380	schtasks.exe
6740	schtasks.exe
7180	schtasks.exe
8552	schtasks.exe
5080	schtasks.exe
3472	schtasks.exe
4428	schtasks.exe
2436	schtasks.exe
7044	schtasks.exe
8104	schtasks.exe
4412	schtasks.exe
3928	schtasks.exe
4624	schtasks.exe
4404	schtasks.exe
4592	schtasks.exe
6172	schtasks.exe
3144	schtasks.exe
568	schtasks.exe
3444	schtasks.exe
3264	schtasks.exe
784	schtasks.exe
5180	schtasks.exe
5628	schtasks.exe
8992	schtasks.exe
4696	schtasks.exe
3376	schtasks.exe
2352	schtasks.exe
4820	schtasks.exe
2440	schtasks.exe
592	schtasks.exe
4904	schtasks.exe
6604	schtasks.exe
3748	schtasks.exe
3712	schtasks.exe
3336	schtasks.exe
3872	schtasks.exe
3800	schtasks.exe
5496	schtasks.exe
3704	schtasks.exe
4808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4456	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4456	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4456	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4456	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\My Pictures\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Pictures\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\My Pictures\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee2" /sc MINUTE /mo 13 /tr "'C:\Windows\security\2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee" /sc ONLOGON /tr "'C:\Windows\security\2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee2" /sc MINUTE /mo 11 /tr "'C:\Windows\security\2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Saved Games\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Saved Games\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\AppReadiness\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\AppReadiness\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\AppReadiness\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'C:\Windows\Containers\serviced\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 14 /tr "'C:\Windows\Containers\serviced\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Default\NetHood\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\NetHood\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Default\NetHood\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Videos\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:592

C:\Users\Public\Documents\My Pictures\fontdrvhost.exe
"C:\Users\Public\Documents\My Pictures\fontdrvhost.exe"
1⤵
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\security\2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Windows\security\2026-06-26_8e5bf8f424e094846e93361ed432735a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3920

C:\Program Files\Windows Photo Viewer\fontdrvhost.exe
"C:\Program Files\Windows Photo Viewer\fontdrvhost.exe"
1⤵
PID:2488

C:\Users\Default\Saved Games\StartMenuExperienceHost.exe
"C:\Users\Default\Saved Games\StartMenuExperienceHost.exe"
1⤵
PID:3264

C:\Recovery\WindowsRE\taskhostw.exe
"C:\Recovery\WindowsRE\taskhostw.exe"
1⤵
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5136

C:\Recovery\WindowsRE\System.exe
"C:\Recovery\WindowsRE\System.exe"
1⤵
PID:5656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre-1.8\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jre-1.8\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6172

C:\Windows\AppReadiness\smss.exe
"C:\Windows\AppReadiness\smss.exe"
1⤵
PID:5896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5936

C:\Windows\Containers\serviced\WUDFHost.exe
"C:\Windows\Containers\serviced\WUDFHost.exe"
1⤵
PID:7512

C:\Users\Default\NetHood\Idle.exe
"C:\Users\Default\NetHood\Idle.exe"
1⤵
PID:6048

C:\Program Files\Windows Sidebar\SppExtComObj.exe
"C:\Program Files\Windows Sidebar\SppExtComObj.exe"
1⤵
PID:7764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6740

C:\Users\Public\Videos\csrss.exe
"C:\Users\Public\Videos\csrss.exe"
1⤵
PID:7308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5496

C:\Program Files\Windows Mail\SearchApp.exe
"C:\Program Files\Windows Mail\SearchApp.exe"
1⤵
PID:11044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SearchApp.exe

Path C:\Program Files\Windows Mail\SearchApp.exe
Size 384KB
SHA256 06326c4f9855ec8de50c6158da3bb07d7df9bed14ccdac18dc75cf117f4c91c2
MD5 7830c33413d8d3bc138a65d887d75a08
SHA1 02d6cfaf7b124d3f156d1fc266e6ddb4dfbcd7e7
SHA512 16ecd81bbbf2a674853db19c5fe9d42a261784d40f3fa3e2c886ec14928ecf41f90da2f89ce8437c0be1736375f712ae500864efb2f487842e97cb27abe85f50
SSDEEP 6144:GDKW1Lgbdl0zBBvjc/UUSsSAgutvhQcw0tSIXf20vhe/ShQxFVVglgBUpoeR1:gh1Lk70znvjc8UgAgux61IP20vhe/ShX
TLSH
T16684F1217181C2B3C5B7013144EACB35AE3A7035076A95D7B7E96BBA5F213E0A7351CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskhostw.exe

Path C:\Recovery\WindowsRE\taskhostw.exe
Size 1.7MB
SHA256 4d2f5cfcc9a1517201242ccf7958dcf8a5c6ca94b19699e1f2ef7a3d52c8f90b
MD5 8e5bf8f424e094846e93361ed432735a
SHA1 68f67e637c39377c435c74e7674766c59b8e6ace
SHA512 e8fa5c5176a50682dd4334a90f31ded50b01143484e39330e8d6d529455e7a8bbdf3d99e40eacb472e0f069c1c059279a14a0c53ac55b7a09d27f76a5167c3c6
SSDEEP 49152:ckQzA4IwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scS:c6QuRD9JdOR4m+lmY/4rx8cS
TLSH
T1EC8523197181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4456-0-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/4456-1-0x00000000053B0000-0x000000000562C000-memory.dmp

Download

memory/4456-2-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/4456-3-0x0000000005630000-0x0000000005BD4000-memory.dmp

Download

memory/4456-4-0x0000000005120000-0x000000000539A000-memory.dmp

Download

memory/4456-14-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-12-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-22-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-24-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-36-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-42-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-40-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-38-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-32-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-30-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-28-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-27-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-34-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-20-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-18-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-16-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-10-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-8-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-6-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-5-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-50-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-54-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-52-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-64-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-76-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-74-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-88-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-104-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-116-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-114-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-113-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-110-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-108-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-106-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-102-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-100-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-98-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-96-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-95-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-92-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-91-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-86-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-84-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-82-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-80-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-78-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-72-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-68-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-66-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-62-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-70-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-60-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-58-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-48-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-46-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-56-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-44-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-122-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-118-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-130-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-126-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-128-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-125-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-120-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/4456-1397-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/4456-1637-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/4456-1853-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/4456-5228-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/4456-5229-0x00000000029F0000-0x0000000002A0C000-memory.dmp

Download

memory/4456-5231-0x0000000002A80000-0x0000000002A88000-memory.dmp

Download

memory/4456-5232-0x0000000006230000-0x0000000006240000-memory.dmp

Download

memory/4456-5230-0x0000000002A20000-0x0000000002A70000-memory.dmp

Download

memory/4456-5233-0x00000000062F0000-0x0000000006306000-memory.dmp

Download

memory/4456-5235-0x0000000006310000-0x0000000006320000-memory.dmp

Download

memory/4456-5234-0x0000000006270000-0x0000000006278000-memory.dmp

Download

memory/4456-5236-0x0000000006730000-0x000000000673A000-memory.dmp

Download

memory/4456-5237-0x0000000006760000-0x000000000676C000-memory.dmp

Download

memory/4456-5238-0x0000000006770000-0x0000000006782000-memory.dmp

Download

memory/4456-5240-0x0000000006800000-0x000000000680C000-memory.dmp

Download

memory/4456-5239-0x0000000006880000-0x0000000006DAC000-memory.dmp

Download

memory/4456-5241-0x0000000006810000-0x000000000681C000-memory.dmp

Download

memory/4456-5242-0x0000000006840000-0x000000000684A000-memory.dmp

Download

memory/4456-5244-0x0000000007130000-0x000000000713C000-memory.dmp

Download

memory/4456-5243-0x0000000006860000-0x0000000006868000-memory.dmp

Download

memory/4456-5246-0x0000000007200000-0x000000000720C000-memory.dmp

Download

memory/4456-5250-0x0000000007240000-0x00000000072A6000-memory.dmp

Download

memory/4456-5247-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/4456-5245-0x0000000007140000-0x00000000071D2000-memory.dmp

Download

memory/4456-5950-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/4456-6290-0x0000000005110000-0x0000000005120000-memory.dmp

Download