ec0fffe2972959072c17aedfb71b921c9f50dc5fa617963942d68166ae0ff8ba

Analysis

max time kernel
42s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_bacc2d6ebab77d8553942032bd6c886f_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 2.0MB
Sample260708-crd1xaas9m
SHA256 ec0fffe2972959072c17aedfb71b921c9f50dc5fa617963942d68166ae0ff8ba
MD5 bacc2d6ebab77d8553942032bd6c886f
SHA1 67cbea8be108d14c60cf2432d274e94a3298ed3b
SHA512 20c23c0399c592443ca86592912d43d490e035b62a476ba1752837bf323f7d9ff38745fb687e5e318195c5d7bda84a0c53f9623f0411f1b0da0faf93c61ee3f1
SSDEEP 49152:OkQTAOYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpx:OaO5CbhZcT2lvnDFpFW/twU7+x
TLSH
T1C3A5337470C1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1627A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Signatures

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5736	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5508	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5688	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6012	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5428	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5436	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3284	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5748	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	612	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6136	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5228	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5264	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5728	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5236	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5712	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5180	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5412	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	1276	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	1276	schtasks.exe	100

Detects executables packed with SmartAssembly 7 IoCs

resource	yara_rule
behavioral2/memory/5980-5420-0x00000000063C0000-0x00000000063D0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5980-5427-0x0000000006490000-0x000000000649A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5980-5434-0x0000000006B40000-0x0000000006B4C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5980-5435-0x0000000007B60000-0x0000000007B6C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5980-5437-0x0000000008220000-0x000000000822C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5980-5439-0x0000000008230000-0x000000000823A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5980-5443-0x0000000008630000-0x000000000863A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2804	powershell.exe
5776	powershell.exe
5716	powershell.exe
5736	powershell.exe
3024	powershell.exe
3428	powershell.exe
4460	powershell.exe
6012	powershell.exe
1772	powershell.exe
4648	powershell.exe
5508	powershell.exe
1008	powershell.exe
4272	powershell.exe
5688	powershell.exe
5956	powershell.exe
4632	powershell.exe
3356	powershell.exe
4884	powershell.exe
5900	powershell.exe
5420	powershell.exe

SmartAssembly .NET packer 7 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5980-5420-0x00000000063C0000-0x00000000063D0000-memory.dmp	SmartAssembly
behavioral2/memory/5980-5427-0x0000000006490000-0x000000000649A000-memory.dmp	SmartAssembly
behavioral2/memory/5980-5434-0x0000000006B40000-0x0000000006B4C000-memory.dmp	SmartAssembly
behavioral2/memory/5980-5435-0x0000000007B60000-0x0000000007B6C000-memory.dmp	SmartAssembly
behavioral2/memory/5980-5437-0x0000000008220000-0x000000000822C000-memory.dmp	SmartAssembly
behavioral2/memory/5980-5439-0x0000000008230000-0x000000000823A000-memory.dmp	SmartAssembly
behavioral2/memory/5980-5443-0x0000000008630000-0x000000000863A000-memory.dmp	SmartAssembly

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_bacc2d6ebab77d8553942032bd6c886f_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{EE434DC7-39DB-4C73-BA1D-96C1D53EBBBC}	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1456	schtasks.exe
1360	schtasks.exe
2700	schtasks.exe
4932	schtasks.exe
292	schtasks.exe
5264	schtasks.exe
2180	schtasks.exe
5748	schtasks.exe
5736	schtasks.exe
4216	schtasks.exe
3512	schtasks.exe
2932	schtasks.exe
5428	schtasks.exe
2168	schtasks.exe
5236	schtasks.exe
5012	schtasks.exe
4616	schtasks.exe
5728	schtasks.exe
5180	schtasks.exe
5436	schtasks.exe
3284	schtasks.exe
4232	schtasks.exe
6136	schtasks.exe
5412	schtasks.exe
3272	schtasks.exe
1280	schtasks.exe
1952	schtasks.exe
5688	schtasks.exe
1484	schtasks.exe
3528	schtasks.exe
5088	schtasks.exe
2768	schtasks.exe
6012	schtasks.exe
4584	schtasks.exe
612	schtasks.exe
5228	schtasks.exe
3616	schtasks.exe
4576	schtasks.exe
4528	schtasks.exe
4800	schtasks.exe
4820	schtasks.exe
752	schtasks.exe
1088	schtasks.exe
824	schtasks.exe
5712	schtasks.exe
3324	schtasks.exe
2492	schtasks.exe
2804	schtasks.exe
4916	schtasks.exe
3292	schtasks.exe
2812	schtasks.exe
3756	schtasks.exe
5508	schtasks.exe
4792	schtasks.exe
5072	schtasks.exe
4552	schtasks.exe
2540	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5980	2026-07-08_bacc2d6ebab77d8553942032bd6c886f_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeShutdownPrivilege	4144	explorer.exe
Token: SeCreatePagefilePrivilege	4144	explorer.exe
Token: SeShutdownPrivilege	4144	explorer.exe
Token: SeCreatePagefilePrivilege	4144	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	sihost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4144	2372	sihost.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-08_bacc2d6ebab77d8553942032bd6c886f_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_bacc2d6ebab77d8553942032bd6c886f_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5980
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-08_bacc2d6ebab77d8553942032bd6c886f_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4272
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3428
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5420
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\en-US\SearchHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1008
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\microsoft shared\SecurityHealthService.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3024
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows.old\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\de-DE\ShellHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3356
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5508
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\de-DE\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4648
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WUDFHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4460
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\StartMenuExperienceHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5716
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5776
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\InboxApps\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2804
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Music\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows.old\SecurityHealthSystray.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\InputMethod\SHARED\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GZY0G2hIKs.bat"
  2⤵
  PID:2436
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1308
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:4236
- - C:\Windows\InputMethod\SHARED\RuntimeBroker.exe
    "C:\Windows\InputMethod\SHARED\RuntimeBroker.exe"
    3⤵
    PID:6040

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4144

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2296

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Templates\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Templates\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Templates\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\en-US\SearchHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Windows\Help\en-US\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 6 /tr "'C:\Windows\Help\en-US\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\microsoft shared\SecurityHealthService.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthService" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\SecurityHealthService.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\microsoft shared\SecurityHealthService.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows.old\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows.old\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows.old\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\ShellHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\SysWOW64\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\SysWOW64\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\SysWOW64\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\L2Schemas\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\assembly\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\assembly\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\assembly\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Users\Default\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Users\Default\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\InboxApps\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\InboxApps\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Windows\InboxApps\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Music\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 9 /tr "'C:\Windows.old\SecurityHealthSystray.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystray" /sc ONLOGON /tr "'C:\Windows.old\SecurityHealthSystray.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 10 /tr "'C:\Windows.old\SecurityHealthSystray.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\InputMethod\SHARED\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\InputMethod\SHARED\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\InputMethod\SHARED\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwm.exe

Path C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe
Size 2.0MB
SHA256 b6a0e9128bc3e54891839c622884af927c8d340b03a68698fb568865861b2ad0
MD5 231d7b1692ab500c38a8158c103aee44
SHA1 7b46f3db074fe47979ce0a4599e4ff0dd62fac6c
SHA512 fa198ef5762599115f8879e7e333b07975c094c1bda8eb3983d9ed285c4a43724008d3fe5115e970520d2517a5fca5dc4eff78f87252641f45e86065f6b2cc70
SSDEEP 49152:ikQTAJYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpn:iaJ5CbhZcT2lvnDFpFW/twU7+n
TLSH
T1D1A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellHost.exe

Path C:\Program Files (x86)\Windows Defender\de-DE\ShellHost.exe
Size 2.0MB
SHA256 2b3de1afe5edd2db3fc8fe5f088c2d354f607d4bb03dcb9372d886b52b415103
MD5 1766bc675f345092649020b5ceaab024
SHA1 f9eee79f71811c64d097f571978db96827a6f498
SHA512 121f425c0f85eb79512eb6dcc4409b8c1043530432ae7610687e3381cc2a92c45c86024640ff18c8fd3370e4c873f260cd56d238d339c30b54169727a9a927c2
SSDEEP 49152:OkQTAOYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpg:OaO5CbhZcT2lvnDFpFW/twU7+g
TLSH
T195A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wininit.exe

Path C:\Program Files (x86)\Windows Mail\wininit.exe
Size 2.0MB
SHA256 1ea70e48d036a43fccc0709bebb49a8d6ecf6fd94b13b8119788b1732974ff38
MD5 1939062fb03ea170c547fed997325000
SHA1 990358eeabf08e5d666d3221d9e8f7f42bc622bd
SHA512 271f01f94cd55c130fb7964186a69e0d79f862b4f55dae6c7bcdbc8798a0e0e601fd3da4be462441898f50c0d2468f7148c921ec1ce29bd9e9c2e12c696a9208
SSDEEP 49152:ikQTApYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQp8:iap5CbhZcT2lvnDFpFW/twU7+8
TLSH
T1F9A5337470D1C1B2E5A6103584CACB32A6367062877EC1CB7ADD76F56F603F1623AAC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthService.exe

Path C:\Program Files\Common Files\microsoft shared\SecurityHealthService.exe
Size 2.0MB
SHA256 1e4d35977c67ba3ad103f0df4e4e6d6bdf895887801e2746e4edb7c92b001f45
MD5 a0c0be21f65f417082708428a4343f6b
SHA1 2d8a0c6d521aa1ffde77f836e3c7d41bf10c8cdf
SHA512 ef4e77664c8280d8a18e0b919d444a5545403700c819938e32dc6036e02f17ca6a1a8616d6b288a1e161b23f5429bbfd53b2318b6d79465cfb28ec7bb6bf55e4
SSDEEP 49152:SkQTAtYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpb:Sat5CbhZcT2lvnDFpFW/twU7+b
TLSH
T173A5337470D1C1B2E5A6103584CACB32A6367062877EC1CB7A9D76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB1AB.tmp

Path C:\Program Files\Internet Explorer\RCXB1AB.tmp
Size 2.0MB
SHA256 5a04283ad43ba503bc1c8202b56e25e0bd1076fca81ced04bb41bf527a0cc94d
MD5 fd861cc102bce8a152f21977aed60f24
SHA1 ced58caa51416d3b13d0164c785084e28b859aac
SHA512 69198a7bb080c9438fbf26ea3ea98d1cf22dadbdc6485b51574ab4f981e9559fd65edbd1b1c721eb424c46ae75d948843825ccd0a88c37cb504b7f2a71d9fd51
SSDEEP 49152:SkQTAtYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpJ:Sat5CbhZcT2lvnDFpFW/twU7+J
TLSH
T1F3A5337470D1C1B2E5A6103584CACB32A6357062877EC1CBBADD76F56F603F1623AAC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Idle.exe

Path C:\ProgramData\Microsoft\Windows\Templates\Idle.exe
Size 2.0MB
SHA256 738ff12c721d22cbde638fe37cd537359da11c9a8f44c2d0fc0f3459fafbc592
MD5 f28e3c56574d1e1ba85c477b71f19542
SHA1 558b224c04c8c62fe5f437281f4f36a42daeb39d
SHA512 d94677e8d778b6492fbcdf154016e9e276c3bd9a01adb4dc0e600e8e2427b825ffbaf1a513bf23ebbae5d6f8e2d3c2869607599d54bafb462f7d5f4a0d50a063
SSDEEP 49152:ukQTAKYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpd:uaK5CbhZcT2lvnDFpFW/twU7+d
TLSH
T1C3A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUDFHost.exe

Path C:\Recovery\WindowsRE\WUDFHost.exe
Size 2.0MB
SHA256 0ab2c759cd3b170f5ff7b275af3cbefece7189a9d23aecc73b9281123b1efc19
MD5 60fc8ab731f82421f57a1b133aec088c
SHA1 a36b65932d857fe40bf00ea0f2732ba3cacf7d53
SHA512 8b2f5431479aa1dded74c67cb204a4cc86082573df870e66eade1409f07e4c8033455f21d5c19b4c211e1f0276022663a4402661f82cb178771118ca8f35ae68
SSDEEP 49152:ukQTA+YS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpO:ua+5CbhZcT2lvnDFpFW/twU7+O
TLSH
T15DA5337470C1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1627A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

GZY0G2hIKs.bat

Path C:\Users\Admin\AppData\Local\Temp\GZY0G2hIKs.bat
Size 212B
SHA256 cd550e9b3fbf680fe3dc48a8f330808a4ecde8d831c8124540dc86956221ed25
MD5 579df97d7587eec0430bdc269ce1f537
SHA1 f9ea1c522f484d7a0fa50e643c9f7e6b2a4225fc
SHA512 462a6c0dc9f66c1fd66db2c4295f1beda2805d910b487f33dc9995743d61699c362a27d6e3523a56078cd6ef9897438016a998a5d14d9e6715cbb14796351cd7
TLSH
T15DD023129542D75504420813086611DD5137145431CD3B5006D58C546947067766F7C1
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3sqt44rd.ri4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3sqt44rd.ri4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dwm.exe

Path C:\Users\Default\Music\dwm.exe
Size 2.0MB
SHA256 021b75de5b4348fd6849d6e89f75141e0acabfba091592f915ddffd12a6c61b5
MD5 7b99af00ddbdd6a33cac577a3859c453
SHA1 b4d09dc9c1d635f781b7d43f369c0d584a66b482
SHA512 23e2e6aeecd4d1a726cf1f7f34867217bff61dcdc88ad1d609a627a0c0198dbcf38d5619df13820e90740a920e653115ac2a46ffd7ac0901f39932264af1229a
SSDEEP 49152:ekQTA2YS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpo:ea25CbhZcT2lvnDFpFW/twU7+o
TLSH
T1E8A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAF29.tmp

Path C:\Users\Default\RCXAF29.tmp
Size 2.0MB
SHA256 fbd1c19078cd2ca41de7796feb76dce57193e240467878497d5df3b13e4de815
MD5 497c5f6d64e5327face3e1e9e013cfc8
SHA1 325dbfbcc5026d8e58ee0a441e36619e1c5455bc
SHA512 4649099df835e66004b9bdf154fdbcbfeb9153d585a37622ff4f5b4864873353e7cd9dc4990e187cd406c7ceaa38e4f633856d8410912a62651ed9cad3aa830d
SSDEEP 49152:SkQTANYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQp8:SaN5CbhZcT2lvnDFpFW/twU7+8
TLSH
T1ACA5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Windows.old\SecurityHealthSystray.exe
Size 2.0MB
SHA256 39b452a5fa1a0e0d95679b98a2f4b1a993775dcecb4511418dc2b903cc2f895d
MD5 e60e485e82045188232510f7afac4f24
SHA1 008e737f88544220542c0dc3b7c123c53ebf4b07
SHA512 3223568c67694eca806c2d126e6f87665a009dc88dadc967b698c071a232facd358c52350c8314868f5d65fd8282c62ac7910204d54b763c4e4df9069a927b48
SSDEEP 49152:ykQTAdYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpL:yad5CbhZcT2lvnDFpFW/twU7+L
TLSH
T13BA5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smss.exe

Path C:\Windows.old\smss.exe
Size 2.0MB
SHA256 830a65dcb9b2cb3dc84bf31e579588e8a4a06a87a23b8cbd3db36e67b93db009
MD5 93d1cadaf3cef608cf5d68b9e649b817
SHA1 fe9f2cf2b07b0554d0b9942e00c5f78136a73246
SHA512 49d12c7bd060924371c1d22e0fa4131463298f7f4cccb6f7b0ade75fe8d4c7fbe05ea698413600651deebaa74c8d01ce40c19e2c52b5ec3a1b5dcfee4f279e11
SSDEEP 49152:CkQTAxYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpF:Cax5CbhZcT2lvnDFpFW/twU7+F
TLSH
T152A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker.exe

Path C:\Windows\InputMethod\SHARED\RuntimeBroker.exe
Size 2.0MB
SHA256 3aae521b565bf4cd1ce1137bd6e35f9be1b8b774dd57bafe68da55ce52573f68
MD5 ebbb19ae95871829b1af342275ea971c
SHA1 bf55bba9b392410bddf2e87aa0d0e97947dc68d0
SHA512 0b7aa49904e155f7b22f6c83cd8c64b9c4fafb01a6b0872faf596c451d65fa3eccc0e8d857cc8cf7ff6bf8324ac7b1abd147fd9cb171707f5c3a99f434913022
SSDEEP 49152:SkQTAtYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpZ:Sat5CbhZcT2lvnDFpFW/twU7+Z
TLSH
T1C7A5337470C1C1B2E5A6103584CACB32A6367062877EC1CBBADD76F56F603F1627A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3024-5610-0x0000000005D80000-0x0000000005DA2000-memory.dmp

Download

memory/3024-5611-0x0000000005E20000-0x0000000005E86000-memory.dmp

Download

memory/3356-5606-0x0000000002980000-0x00000000029B6000-memory.dmp

Download

memory/5688-5607-0x0000000005C70000-0x00000000062BA000-memory.dmp

Download

memory/5980-25-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-6-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-113-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-111-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-109-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-108-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-105-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-103-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-101-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-126-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-118-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-99-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-95-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-91-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-90-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-88-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-86-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-81-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-80-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-75-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-73-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-67-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-65-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-64-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-59-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-94-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-83-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-77-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-71-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-69-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-57-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-62-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-53-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-51-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-49-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-47-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-43-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-42-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-39-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-38-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-33-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-31-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-27-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-120-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-46-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-35-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-23-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-29-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-21-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-19-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-16-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-9-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-7-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-115-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-18-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-14-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-1634-0x00000000740E2000-0x00000000740E3000-memory.dmp

Download

memory/5980-1638-0x00000000740D0000-0x000000007488C000-memory.dmp

Download

memory/5980-5415-0x00000000740D0000-0x000000007488C000-memory.dmp

Download

memory/5980-5417-0x0000000002B10000-0x0000000002B2C000-memory.dmp

Download

memory/5980-5418-0x0000000002B40000-0x0000000002B90000-memory.dmp

Download

memory/5980-5419-0x0000000002BA0000-0x0000000002BA8000-memory.dmp

Download

memory/5980-5420-0x00000000063C0000-0x00000000063D0000-memory.dmp

Download

memory/5980-5421-0x00000000063D0000-0x00000000063E6000-memory.dmp

Download

memory/5980-5422-0x0000000006460000-0x0000000006468000-memory.dmp

Download

memory/5980-5423-0x0000000006470000-0x0000000006482000-memory.dmp

Download

memory/5980-5424-0x0000000006630000-0x0000000006638000-memory.dmp

Download

memory/5980-5425-0x0000000006AE0000-0x0000000006AF0000-memory.dmp

Download

memory/5980-5426-0x00000000069A0000-0x0000000006A32000-memory.dmp

Download

memory/5980-5427-0x0000000006490000-0x000000000649A000-memory.dmp

Download

memory/5980-5428-0x0000000006640000-0x0000000006648000-memory.dmp

Download

memory/5980-5429-0x0000000006A50000-0x0000000006A5C000-memory.dmp

Download

memory/5980-5430-0x0000000006A60000-0x0000000006A68000-memory.dmp

Download

memory/5980-5432-0x0000000006A70000-0x0000000006A82000-memory.dmp

Download

memory/5980-5433-0x0000000007CD0000-0x00000000081FC000-memory.dmp

Download

memory/5980-5434-0x0000000006B40000-0x0000000006B4C000-memory.dmp

Download

memory/5980-5435-0x0000000007B60000-0x0000000007B6C000-memory.dmp

Download

memory/5980-5436-0x0000000008200000-0x000000000820C000-memory.dmp

Download

memory/5980-5437-0x0000000008220000-0x000000000822C000-memory.dmp

Download

memory/5980-5439-0x0000000008230000-0x000000000823A000-memory.dmp

Download

memory/5980-5438-0x00000000084D0000-0x00000000084D8000-memory.dmp

Download

memory/5980-5440-0x00000000084E0000-0x00000000084EE000-memory.dmp

Download

memory/5980-5441-0x0000000008610000-0x0000000008618000-memory.dmp

Download

memory/5980-5442-0x0000000008620000-0x0000000008628000-memory.dmp

Download

memory/5980-122-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-123-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-129-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-131-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-127-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-97-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-55-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-11-0x00000000052A0000-0x0000000005551000-memory.dmp

Download

memory/5980-5-0x00000000052A0000-0x0000000005556000-memory.dmp

Download

memory/5980-4-0x0000000005820000-0x0000000005DDA000-memory.dmp

Download

memory/5980-3-0x00000000740D0000-0x000000007488C000-memory.dmp

Download

memory/5980-2-0x00000000740D0000-0x000000007488C000-memory.dmp

Download

memory/5980-5443-0x0000000008630000-0x000000000863A000-memory.dmp

Download

memory/5980-5444-0x0000000008640000-0x000000000864C000-memory.dmp

Download

memory/5980-5446-0x00000000088E0000-0x0000000008946000-memory.dmp

Download

memory/5980-5471-0x00000000740D0000-0x000000007488C000-memory.dmp

Download

memory/5980-0-0x00000000740E2000-0x00000000740E3000-memory.dmp

Download

memory/5980-1-0x0000000005560000-0x0000000005818000-memory.dmp

Download

memory/5980-5658-0x00000000740D0000-0x000000007488C000-memory.dmp

Download

memory/6012-5656-0x0000000006820000-0x000000000686C000-memory.dmp

Download

memory/6012-5655-0x0000000006750000-0x000000000676E000-memory.dmp

Download

memory/6012-5644-0x0000000006330000-0x000000000668B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads