dcrat | 75bceeb7380ab269e61da5b429ed794131f986ec40bbc3f065bcfd71833638c8

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 07:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
108b0072f439f8b8e423d814e215645c.exe
Size 828KB
Sample260810-h7db7syscs
SHA256 75bceeb7380ab269e61da5b429ed794131f986ec40bbc3f065bcfd71833638c8
MD5 108b0072f439f8b8e423d814e215645c
SHA1 fbcf24564eb72125a095d4c4c20dd6e13f1d676d
SHA512 1d5a78e75d5f360b1e678fa33c604e365afaa7d01e0663f565d98193d3e61f2a6784ca5322416ff8a0b36650e4ca0a637e051ca70c9f9f2f96e2914258a60dbf
SSDEEP 12288:Sjzr4mg5shusXKaRpu+FOTcW1n5n4oJK6UG4jU:Sj3hgKhumRptFtW1p42K6N4Y
TLSH
T1AE0507027E48CE82F4091277C3EF45484FB0A85166A6E31B7DBA376E56163A73C0D9DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3980-1-0x0000000000370000-0x0000000000446000-memory.dmp	dcrat
behavioral2/files/0x000b000000019cb8-21.dat	dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	124	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5720	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5608	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	300	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	52	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5756	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	5860	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	5860	schtasks.exe	88

Executes dropped EXE 11 IoCs

pid	Process
2784	fontdrvhost.exe
5504	SecurityHealthSystray.exe
768	lsass.exe
2644	SecurityHealthSystray.exe
6116	sihost.exe
3052	RuntimeBroker.exe
3928	SecurityHealthSystray.exe
3976	Idle.exe
2096	fontdrvhost.exe
500	SecurityHealthSystray.exe
4196	RuntimeBroker.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\TableTextService\en-US\SecurityHealthSystray.exe	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\27b434ba3dcee9	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\sihost.exe	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\66fc9ff0ee96c2	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Program Files (x86)\Common Files\lsass.exe	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Program Files (x86)\Common Files\6203df4a6bafc7	108b0072f439f8b8e423d814e215645c.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logs\NetSetup\5b884080fd4f94	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Windows\IME\it-IT\RuntimeBroker.exe	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Windows\IME\it-IT\9e8d7a4ca61bd9	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Windows\Logs\NetSetup\fontdrvhost.exe	108b0072f439f8b8e423d814e215645c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2608	schtasks.exe
4252	schtasks.exe
5040	schtasks.exe
3352	schtasks.exe
3724	schtasks.exe
4016	schtasks.exe
3248	schtasks.exe
2064	schtasks.exe
2632	schtasks.exe
1896	schtasks.exe
4080	schtasks.exe
3260	schtasks.exe
1472	schtasks.exe
5756	schtasks.exe
4500	schtasks.exe
1180	schtasks.exe
5608	schtasks.exe
52	schtasks.exe
4852	schtasks.exe
4780	schtasks.exe
3060	schtasks.exe
124	schtasks.exe
5720	schtasks.exe
4508	schtasks.exe
4528	schtasks.exe
3416	schtasks.exe
3472	schtasks.exe
2164	schtasks.exe
300	schtasks.exe
708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe
3980	108b0072f439f8b8e423d814e215645c.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3980	108b0072f439f8b8e423d814e215645c.exe
Token: SeDebugPrivilege	2784	fontdrvhost.exe
Token: SeDebugPrivilege	5504	SecurityHealthSystray.exe
Token: SeDebugPrivilege	768	lsass.exe
Token: SeDebugPrivilege	2644	SecurityHealthSystray.exe
Token: SeDebugPrivilege	6116	sihost.exe
Token: SeDebugPrivilege	3052	RuntimeBroker.exe
Token: SeDebugPrivilege	3928	SecurityHealthSystray.exe
Token: SeDebugPrivilege	3976	Idle.exe
Token: SeDebugPrivilege	2096	fontdrvhost.exe
Token: SeDebugPrivilege	500	SecurityHealthSystray.exe
Token: SeDebugPrivilege	4196	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 500	3980	108b0072f439f8b8e423d814e215645c.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\108b0072f439f8b8e423d814e215645c.exe
"C:\Users\Admin\AppData\Local\Temp\108b0072f439f8b8e423d814e215645c.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows.old\SecurityHealthSystray.exe
  "C:\Windows.old\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\SecurityHealthSystray.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystray" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\SecurityHealthSystray.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\SecurityHealthSystray.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\IME\it-IT\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\IME\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SecurityHealthSystray.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystray" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SecurityHealthSystray.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SecurityHealthSystray.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\Logs\NetSetup\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:52

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Logs\NetSetup\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\Logs\NetSetup\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 14 /tr "'C:\Windows.old\SecurityHealthSystray.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystray" /sc ONLOGON /tr "'C:\Windows.old\SecurityHealthSystray.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 7 /tr "'C:\Windows.old\SecurityHealthSystray.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows.old\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows.old\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows.old\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260

C:\Windows\Logs\NetSetup\fontdrvhost.exe
"C:\Windows\Logs\NetSetup\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Program Files\Windows NT\TableTextService\en-US\SecurityHealthSystray.exe
"C:\Program Files\Windows NT\TableTextService\en-US\SecurityHealthSystray.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Downloads\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Recovery\WindowsRE\SecurityHealthSystray.exe
"C:\Recovery\WindowsRE\SecurityHealthSystray.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Program Files (x86)\Common Files\lsass.exe
"C:\Program Files (x86)\Common Files\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\sihost.exe
"C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6116

C:\Windows\IME\it-IT\RuntimeBroker.exe
"C:\Windows\IME\it-IT\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows.old\SecurityHealthSystray.exe
"C:\Windows.old\SecurityHealthSystray.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Windows.old\Idle.exe
"C:\Windows.old\Idle.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Users\All Users\fontdrvhost.exe
"C:\Users\All Users\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Users\Default\Downloads\RuntimeBroker.exe
"C:\Users\Default\Downloads\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthSystray.exe

Path C:\Program Files\Windows NT\TableTextService\en-US\SecurityHealthSystray.exe
Size 828KB
SHA256 75bceeb7380ab269e61da5b429ed794131f986ec40bbc3f065bcfd71833638c8
MD5 108b0072f439f8b8e423d814e215645c
SHA1 fbcf24564eb72125a095d4c4c20dd6e13f1d676d
SHA512 1d5a78e75d5f360b1e678fa33c604e365afaa7d01e0663f565d98193d3e61f2a6784ca5322416ff8a0b36650e4ca0a637e051ca70c9f9f2f96e2914258a60dbf
SSDEEP 12288:Sjzr4mg5shusXKaRpu+FOTcW1n5n4oJK6UG4jU:Sj3hgKhumRptFtW1p42K6N4Y
TLSH
T1AE0507027E48CE82F4091277C3EF45484FB0A85166A6E31B7DBA376E56163A73C0D9DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3980-0-0x00007FFB528AF000-0x00007FFB528B0000-memory.dmp

Download

memory/3980-1-0x0000000000370000-0x0000000000446000-memory.dmp

Download

memory/3980-2-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/3980-3-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/3980-4-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/3980-5-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/3980-7-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/3980-8-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/3980-9-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/3980-10-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/3980-31-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download