dcrat | 8a135c7dcef870d0d3abc022a7e4042ca1e8214d462602015bec1edb6b7bbc24

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample260814-ec72jstycs
SHA256 8a135c7dcef870d0d3abc022a7e4042ca1e8214d462602015bec1edb6b7bbc24
MD5 90adade2bb5879d7a1cf3941e0560e54
SHA1 1b5ed13bdaa0e2f844cb65a617a56f092cbaa30e
SHA512 d4399d6a1ca72bbc3f1f37c42370748acd7bfd023eebaf74ff461503d8a63995550f78c1d7d3e6a4bda3f7ab8352236e63c48a5781cea48b452e5ff51e7ec54b
SSDEEP 49152:ckQTAQIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scj:caIuRD9JdOR4m+lmY/4rx8cj
TLSH
T1198523197181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 43 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2384	schtasks.exe
		2304	schtasks.exe
		2808	schtasks.exe
		1284	schtasks.exe
		2288	schtasks.exe
		3596	schtasks.exe
		2828	schtasks.exe
		4992	schtasks.exe
		3692	schtasks.exe
		2844	schtasks.exe
		4208	schtasks.exe
		4784	schtasks.exe
		1152	schtasks.exe
		1080	schtasks.exe
		3552	schtasks.exe
		4372	schtasks.exe
		4836	schtasks.exe
		4976	schtasks.exe
		872	schtasks.exe
		1216	schtasks.exe
		4156	schtasks.exe
		2704	schtasks.exe
		2156	schtasks.exe
		4348	schtasks.exe
		3396	schtasks.exe
		1468	schtasks.exe
		1904	schtasks.exe
		2328	schtasks.exe
		4360	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		1800	schtasks.exe
		4592	schtasks.exe
		1480	schtasks.exe
		3996	schtasks.exe
		4384	schtasks.exe
		3632	schtasks.exe
		2308	schtasks.exe
		772	schtasks.exe
		4412	schtasks.exe
		1148	schtasks.exe
		1200	schtasks.exe
		388	schtasks.exe
		2276	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\smss.exe\""	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Registration\\SIHClient.exe\""	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\Registration\\SIHClient.exe\", \"C:\\Users\\Default User\\wininit.exe\""	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	4780	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	4780	schtasks.exe	85

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral1/memory/2112-5232-0x0000000006220000-0x0000000006230000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2112-5236-0x0000000006720000-0x000000000672A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2112-5241-0x0000000006800000-0x000000000680C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2112-5244-0x0000000007120000-0x000000000712C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2112-5242-0x0000000006830000-0x000000000683A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4524	powershell.exe
6916	powershell.exe
5864	powershell.exe
1276	powershell.exe
6240	powershell.exe
7124	powershell.exe
5856	powershell.exe
5232	powershell.exe
2328	powershell.exe
5364	powershell.exe
4180	powershell.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIHClient = "\"C:\\Program Files\\WindowsPowerShell\\Configuration\\Registration\\SIHClient.exe\""	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SIHClient = "\"C:\\Program Files\\WindowsPowerShell\\Configuration\\Registration\\SIHClient.exe\""	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default User\\wininit.exe\""	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default User\\wininit.exe\""	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/2112-5232-0x0000000006220000-0x0000000006230000-memory.dmp	SmartAssembly
behavioral1/memory/2112-5236-0x0000000006720000-0x000000000672A000-memory.dmp	SmartAssembly
behavioral1/memory/2112-5241-0x0000000006800000-0x000000000680C000-memory.dmp	SmartAssembly
behavioral1/memory/2112-5244-0x0000000007120000-0x000000000712C000-memory.dmp	SmartAssembly
behavioral1/memory/2112-5242-0x0000000006830000-0x000000000683A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Multimedia Platform\eddb19405b7ce1	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\SIHClient.exe	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\7b3bf1de107bcf	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Windows Multimedia Platform\backgroundTaskHost.exe	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
11440	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4976	schtasks.exe
1148	schtasks.exe
1080	schtasks.exe
2828	schtasks.exe
2844	schtasks.exe
388	schtasks.exe
4208	schtasks.exe
3552	schtasks.exe
3632	schtasks.exe
2288	schtasks.exe
3396	schtasks.exe
1468	schtasks.exe
4592	schtasks.exe
4372	schtasks.exe
2276	schtasks.exe
2384	schtasks.exe
1480	schtasks.exe
1800	schtasks.exe
4836	schtasks.exe
1200	schtasks.exe
872	schtasks.exe
2808	schtasks.exe
4384	schtasks.exe
2328	schtasks.exe
3596	schtasks.exe
2704	schtasks.exe
4992	schtasks.exe
1904	schtasks.exe
3996	schtasks.exe
4348	schtasks.exe
4360	schtasks.exe
3692	schtasks.exe
1284	schtasks.exe
2308	schtasks.exe
4784	schtasks.exe
1152	schtasks.exe
2304	schtasks.exe
1216	schtasks.exe
4156	schtasks.exe
2156	schtasks.exe
4412	schtasks.exe
772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2112	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2112	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2112	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2112	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_90adade2bb5879d7a1cf3941e0560e54_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1276
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5856
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5864
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4524
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4180
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2328
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5232
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9hYFnRH7ET.bat"
  2⤵
  - Executes a command shell one-liner
  PID:11440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\SIHClient.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClient" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\backgroundTaskHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Registry.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\uk-UA\StartMenuExperienceHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\uk-UA\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\uk-UA\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\Registry.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\3D Objects\taskhostw.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Admin\3D Objects\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\3D Objects\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\backgroundTaskHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Program Files (x86)\Windows NT\TableTextService\en-US\csrss.exe
"C:\Program Files (x86)\Windows NT\TableTextService\en-US\csrss.exe"
1⤵
PID:4292

C:\Users\Admin\3D Objects\taskhostw.exe
"C:\Users\Admin\3D Objects\taskhostw.exe"
1⤵
PID:4992

C:\Program Files\WindowsPowerShell\Configuration\Registration\SIHClient.exe
"C:\Program Files\WindowsPowerShell\Configuration\Registration\SIHClient.exe"
1⤵
PID:3928

C:\Recovery\WindowsRE\smss.exe
"C:\Recovery\WindowsRE\smss.exe"
1⤵
PID:2044

C:\Program Files (x86)\Windows Mail\backgroundTaskHost.exe
"C:\Program Files (x86)\Windows Mail\backgroundTaskHost.exe"
1⤵
PID:7080

C:\Program Files (x86)\Windows Mail\TextInputHost.exe
"C:\Program Files (x86)\Windows Mail\TextInputHost.exe"
1⤵
PID:5568

C:\Program Files\Internet Explorer\uk-UA\StartMenuExperienceHost.exe
"C:\Program Files\Internet Explorer\uk-UA\StartMenuExperienceHost.exe"
1⤵
PID:6136

C:\Recovery\WindowsRE\explorer.exe
"C:\Recovery\WindowsRE\explorer.exe"
1⤵
PID:7608

C:\Users\Default User\wininit.exe
"C:\Users\Default User\wininit.exe"
1⤵
PID:7560

C:\Users\Public\AccountPictures\RuntimeBroker.exe
"C:\Users\Public\AccountPictures\RuntimeBroker.exe"
1⤵
PID:7528

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\Registry.exe
"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\Registry.exe"
1⤵
PID:10424

C:\Users\Default User\Registry.exe
"C:\Users\Default User\Registry.exe"
1⤵
PID:10904

C:\Users\Default User\fontdrvhost.exe
"C:\Users\Default User\fontdrvhost.exe"
1⤵
PID:11408

C:\Program Files\Windows Multimedia Platform\backgroundTaskHost.exe
"C:\Program Files\Windows Multimedia Platform\backgroundTaskHost.exe"
1⤵
PID:11432

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:6616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Registry.exe

Path C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\Registry.exe
Size 1.6MB
SHA256 f325e0a848d19039e61b03cbd68a87f8e4a0497954dfed2e423ec3679780be71
MD5 4662e2e2f27bf56bab2a4f587b92b074
SHA1 b2272e65580f04551cd9acc3467ea1fc6070cd99
SHA512 f129b0f945fe6e31f285f461fdef725ddde73456f3b69146855a749c1842ab96a86dbfbfea76cae31451435e93d20bab07ee57590e356c196a3d6224b08aa2f7
SSDEEP 49152:ckQTAQIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsxa:caIuRD9JdOR4m+lmY/4rxa
TLSH
T12B7523157181D333C2BB103185C18FB59A2576260F7666DFFBE89B662F202F4BB261C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backgroundTaskHost.exe

Path C:\Program Files\Windows Multimedia Platform\backgroundTaskHost.exe
Size 1.2MB
SHA256 2e76a8ab48f22aa16f3877bbcfebaa5b648f022efc63c659620aa98c3fd29bbc
MD5 a0d870e1b8fcd0464d70bdc1f9a2acf3
SHA1 979dc9231e704ca3ddcb97ca7159d3bfea341d71
SHA512 742c5dfecfecae3a587aa6102148d4fb9b448fa0234752c6b995d1d92c23efc298cdc158dbccd6c3b3634e54565ed3e88becf699328b738c1b4285f48b22f41e
SSDEEP 24576:ck70TrcXgBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJ4sytPX8:ckQTAQIwMtuvMDVPG4JdXeR4aT6LQ+dE
TLSH
T1C15523197080D373C6B701318AD5CB615A2671710B7AA6DFF7ACABA62F102F4B7271C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_sdksvd1e.txs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sdksvd1e.txs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Registry.exe

Path C:\Users\Default User\Registry.exe
Size 1.5MB
SHA256 ce90f8625493e1648323a66544ce11eba7c6c65faf1d443f89dd7647832e1360
MD5 efd8f5f644f1753f0af0d2e850333917
SHA1 568f09d62771cc0dac473244ca86c7dfcf404596
SHA512 6817d67d7a024fb0e97c5ee00f7f32ab32417933c1019a3342d3a0315a9d9fcaa004f89f496ecc5e9ae5dcc4b60b05c48eba3cbd2e501f58c6bc614d5e35cdb7
SSDEEP 24576:ck70TrcXgBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJ4sytPXic8B:ckQTAQIwMtuvMDVPG4JdXeR4aT6LQ+de
TLSH
T15C7523157181D373C2BB103086D18F75AA2671320F7666DFFB989B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontdrvhost.exe

Path C:\Users\Default User\fontdrvhost.exe
Size 1.1MB
SHA256 9552382ff3c54d3d7979c5b92007c26cc6892a1c67c46cbbacd0cbcb68d1bf31
MD5 db893df9cff93c955350319315fb881c
SHA1 94ceeeb59f3daf23f1c90fdeee0730e2e7a027ab
SHA512 95a41c6344555973ab6710a456d842d3b82ef7ae90caf6b33b9ff80472f852b87ed67763c3d3bcb651289c76fc4d42b1027f84d4cf6b9e40299aca2e622b693e
SSDEEP 24576:ck70TrcXgBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJo:ckQTAQIwMtuvMDVPG4JdXeR4aT6LQ+D
TLSH
T1614523157180D3B3C5F7013189D1CB746B2675B20B76A5EFB6AC6BA62F202F0B7261C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Registry.exe

Path C:\Users\Default\Registry.exe
Size 1.7MB
SHA256 8a135c7dcef870d0d3abc022a7e4042ca1e8214d462602015bec1edb6b7bbc24
MD5 90adade2bb5879d7a1cf3941e0560e54
SHA1 1b5ed13bdaa0e2f844cb65a617a56f092cbaa30e
SHA512 d4399d6a1ca72bbc3f1f37c42370748acd7bfd023eebaf74ff461503d8a63995550f78c1d7d3e6a4bda3f7ab8352236e63c48a5781cea48b452e5ff51e7ec54b
SSDEEP 49152:ckQTAQIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scj:caIuRD9JdOR4m+lmY/4rx8cj
TLSH
T1198523197181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontdrvhost.exe

Path C:\Users\Default\fontdrvhost.exe
Size 1.2MB
SHA256 aae174f19154632dbeba78fb035187e47698b35ea900890061c0e677515da043
MD5 ff4caab6fc13ca33999c19bb2a132071
SHA1 425509e093c16214d05723507ff051b68ddb733b
SHA512 1cfadea5e320421f314c81608f4aac8e786608dcec9899025f1973e9e69a33ffa5ada0c562b0d8ed0a3ca362f132993f2fd47c2cf7640efcfb924170a60430d7
SSDEEP 24576:ck70TrcXgBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJ4sytw:ckQTAQIwMtuvMDVPG4JdXeR4aT6LQ+dA
TLSH
T1FA4523157180D3B3C6F7113185D18B615B2671B10B7AA6DFF79CABA62F202F0BB261C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-13011-0x0000000004D10000-0x0000000004D46000-memory.dmp

Download

memory/2112-68-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-8-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-14-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-34-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-36-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-32-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-30-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-28-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-24-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-22-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-18-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-26-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-20-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-16-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-12-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-10-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-5-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-6-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-58-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-38-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-70-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-82-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-94-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-104-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-116-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-114-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-112-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-110-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-108-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-106-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-102-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-100-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-98-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-96-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-60-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-90-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-88-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-86-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-84-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-80-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-78-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-76-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-74-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-72-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-3-0x0000000005580000-0x0000000005B24000-memory.dmp

Download

memory/2112-66-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-64-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-62-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-92-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-4-0x0000000005080000-0x00000000052FA000-memory.dmp

Download

memory/2112-5233-0x00000000062E0000-0x00000000062F6000-memory.dmp

Download

memory/2112-54-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-52-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-50-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-48-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-47-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-42-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-40-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-44-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-118-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-126-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-130-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-124-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-122-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-120-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-128-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-1669-0x0000000002AF0000-0x0000000002B00000-memory.dmp

Download

memory/2112-1946-0x0000000002AF0000-0x0000000002B00000-memory.dmp

Download

memory/2112-2186-0x0000000002AF0000-0x0000000002B00000-memory.dmp

Download

memory/2112-5228-0x0000000002AF0000-0x0000000002B00000-memory.dmp

Download

memory/2112-5229-0x00000000029A0000-0x00000000029BC000-memory.dmp

Download

memory/2112-5230-0x00000000029D0000-0x0000000002A20000-memory.dmp

Download

memory/2112-5232-0x0000000006220000-0x0000000006230000-memory.dmp

Download

memory/2112-5231-0x0000000002A30000-0x0000000002A38000-memory.dmp

Download

memory/2112-56-0x0000000005080000-0x00000000052F4000-memory.dmp

Download

memory/2112-5234-0x0000000006260000-0x0000000006268000-memory.dmp

Download

memory/2112-5235-0x0000000006300000-0x0000000006310000-memory.dmp

Download

memory/2112-5236-0x0000000006720000-0x000000000672A000-memory.dmp

Download

memory/2112-5237-0x0000000006750000-0x000000000675C000-memory.dmp

Download

memory/2112-5238-0x0000000006760000-0x0000000006772000-memory.dmp

Download

memory/2112-5239-0x0000000006870000-0x0000000006D9C000-memory.dmp

Download

memory/2112-5240-0x00000000067F0000-0x00000000067FC000-memory.dmp

Download

memory/2112-5241-0x0000000006800000-0x000000000680C000-memory.dmp

Download

memory/2112-5244-0x0000000007120000-0x000000000712C000-memory.dmp

Download

memory/2112-5243-0x0000000006850000-0x0000000006858000-memory.dmp

Download

memory/2112-5242-0x0000000006830000-0x000000000683A000-memory.dmp

Download

memory/2112-5245-0x0000000007130000-0x00000000071C2000-memory.dmp

Download

memory/2112-5246-0x00000000071F0000-0x00000000071FC000-memory.dmp

Download

memory/2112-5249-0x0000000007210000-0x0000000007276000-memory.dmp

Download

memory/2112-5250-0x0000000002AF0000-0x0000000002B00000-memory.dmp

Download

memory/2112-6963-0x0000000002AF0000-0x0000000002B00000-memory.dmp

Download

memory/2112-7758-0x0000000002AF0000-0x0000000002B00000-memory.dmp

Download

memory/2112-0-0x0000000002AF0000-0x0000000002B00000-memory.dmp

Download

memory/2112-2-0x0000000002AF0000-0x0000000002B00000-memory.dmp

Download

memory/2112-1-0x0000000005300000-0x000000000557C000-memory.dmp

Download

memory/2328-60834-0x0000000005580000-0x00000000055E6000-memory.dmp

Download

memory/5232-61590-0x00000000062C0000-0x0000000006614000-memory.dmp

Download

memory/7124-13274-0x0000000005A10000-0x0000000006038000-memory.dmp

Download