Report - 14c6e59422a2…4792c85d33

Suspicious HighFILE

Quota 44

First seen: 2026-11-08T19:46:57Z
Last seen: 2026-11-10T18:45:37Z

THREAT SIGNALLow Read alongside the verdict

CONFIDENCE50%VirusSign analysis

FAMILYdacicspyware

RELATED INDICATORS17Connections in this report

ANALYSISSuspiciousFresh

Indicator overview

INDICATOR PROFILE

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

SHA256: 14c6e59422a2bf11438d82bf88d1eb8d43f6dd72a9fece20438c644792c85d33
SHA1: 05b393e9f08b9ba01b15e8c044ac6c9584530350
MD5: bb62e6528db0bd70ae254e15c83a3ddc
Filename: RuntimeBroker.dll
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 2369432
Compile time: 2026-10-04T07:28:00Z
PE platform: x64 64-bit
PE sections: 6

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (4%).

Confidence signal

VirusSign confidence is elevated at 50%. Use it as supporting evidence together with detections, family and relationship context.

Analysis signals

OBSERVED

Engine detections4%

VirusSign confidence50%

Relationship context17 visible

Threat classificationdacic

Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.

RELATIONSHIP CONSTELLATION

SELECT A NODE TO EXPLORE

FILEDOMAINIPURL

Visible connections

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

17 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

2shown

c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e

0% sql 40960 bytes drops

Filename cdb_2808_1794145842417.db File type sql MIME application/octet-stream Size 40960 SHA1 f97489afb75bfd5ee52892f37383fbc85aa14a69

8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259

0% sql 57344 bytes drops

Filename edge_Default_lg.db File type sql MIME application/octet-stream Size 57344 SHA1 fa58ce7588513519dc8fed939b26b05dc25e53b5

Related IPs

Network IPs associated with this indicator.

5shown

52.123.250.163

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-01T07:58:00Z Last seen 2026-11-11T08:47:12Z

52.123.250.144

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-04T17:37:35Z Last seen 2026-11-11T08:36:54Z

52.123.250.141

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-04T05:58:59Z Last seen 2026-11-11T08:48:05Z

52.123.250.131

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-29T00:05:41Z Last seen 2026-11-11T08:49:18Z

208.95.112.1

5% low US communicates

CIDR 208.95.112.0/22 Network 208.95.112.0-208.95.115.255 First seen 2023-09-30T15:26:15Z Last seen 2026-11-11T08:44:02Z

Related domains

Domains associated with this indicator.

5shown

atm.teams.mira.tm.svc.cloud.microsoft

0% .microsoft communicates

Root cloud.microsoft TLD microsoft Subdomain atm.teams.mira.tm.svc First seen 2024-08-26T16:41:58Z Last seen 2026-11-11T08:49:19Z

ipify.org

5% low .org communicates

Root ipify.org TLD org First seen 2023-09-30T23:25:20Z Last seen 2026-11-11T08:05:29Z

ip-api.com

5% low .com communicates

Root ip-api.com TLD com First seen 2023-09-30T15:26:15Z Last seen 2026-11-11T08:30:48Z

api.ipify.org

0% .org communicates

Root ipify.org TLD org Subdomain api First seen 2023-10-01T04:34:19Z Last seen 2026-11-11T08:05:29Z

discord.com

0% .com communicates

Root discord.com TLD com First seen 2023-09-29T22:52:36Z Last seen 2026-11-11T08:15:40Z

Related URLs

URLs associated with this indicator.

5shown

https://discord.com/api/webhooks/1568290802583740449/XI6R8_zVISY8ROV2…

0% communicates

TLD com HTTP status 200 Content length 371 Content SHA256 69e389e574d5ee64d716b2c6f3e2d4751da1a788a74694ecf907312fe04aca07 First seen 2026-11-07T05:03:38Z

https://discord.com/api/v10/channels/1568300753418854411/messages?…

0% communicates

TLD com HTTP status 401 Content length 43 Content SHA256 774085c73d7aeecdd59894443d83d16b7e4e731c89420ca9f7356a5c9c928056 First seen 2026-11-08T13:25:28Z

http://ip-api.com/json/34.55.44.238?…

5% low communicates

TLD com HTTP status 200 Content length 190 Content SHA256 b69975b48b854ea04d4bc5b12997d1354c8b530f270b0818a3b9e25f4b1587e5 First seen 2026-11-08T13:25:28Z

https://discord.com/api/v10/channels/1568300753418854411/messages?…

0% communicates

TLD com HTTP status 401 Content length 43 Content SHA256 774085c73d7aeecdd59894443d83d16b7e4e731c89420ca9f7356a5c9c928056 First seen 2026-11-09T02:07:43Z

https://api.ipify.org/

0% communicates

TLD org HTTP status 200 Content length 13 Content SHA256 ecae028954cf254da80dce3c71bd2809d29cd0637e30052dd5c873a822b75070 First seen 2014-11-11T12:23:12Z

Analysis details

Severity: highspywarefile-overlayexe64bitwmi-activityobfuscatedsigned

Freshness: Fresh · Last seen today.

Detection rate: 4%
Threat type: spyware
Family: dacic
Confidence: 50%
detection: 4 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 14c6e59422a2bf11438d82bf88d1eb8d43f6dd72a9fece20438c644792c85d33
SHA1: 05b393e9f08b9ba01b15e8c044ac6c9584530350
MD5: bb62e6528db0bd70ae254e15c83a3ddc
Filename: RuntimeBroker.dll
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 2369432
Compile time: 2026-10-04T07:28:00Z
PE platform: x64 64-bit
PE sections: 6
Import libraries: 12
TLSH: T13AB57B0077E45603DABF47BAD0351960CBB1E597B75BEB8B2D9890BD0D637804E822E7
SSDEEP: 24576:xwXpAcdQhe6AWdRZ+cOpxIPItQSaeCI2LrbtXSnIhU/1WrO5/4oE+FutZbJcMFuT:tcdG7AWdRZ+4yL2vX6/rr8C
Imphash: bb3ac2c21e02c68abcad237dc3fa6d00
Richhash: 427380188f93008ad83801743330a155
First seen: 2026-11-08T19:46:57Z
Last seen: 2026-11-10T18:45:37Z
Filename variants: 4 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (4%).

Confidence signal

VirusSign confidence is elevated at 50%. Use it as supporting evidence together with detections, family and relationship context.

Threat context

Classification includes type spyware and family dacic.

Relationship context

17 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

18 timestamped observations are arranged from 2014-11-11 to 2026-11-09. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

Engine detections 4%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

VirusSign confidence 50%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 17 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification dacic

Classification context: type spyware, family dacic.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: RuntimeBroker.dll
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 2369432
Compile time: 2026-10-04T07:28:00Z
PE platform: x64 64-bit
Entry point: 72400
Sections: 6

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activityobfuscated

View details · 5 shown

A DLL was loaded from a suspicious directory
A file was accessed within the Public folder.
A process created a hidden window
Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Attempted to open, duplicate, or impersonate an access token from dynamically allocated (unbacked) memory, indicative of credential theft or lateral movement

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1036 · T1548 — A file was accessed within the Public folder.
Tactics: TA0004 · TA0005
T1564.003 — A process created a hidden window
Tactics: TA0005
T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Tactics: TA0004 · TA0005
T1071 · T1568 — Attempted to resolve a domain name from dynamically allocated (unbacked) memory
Tactics: TA0011

5 shown

View MBC details · 5 shown

Communication
Objectives: OC0006
C0017 — Create Process
Objectives: OC0003
Cryptography
Objectives: OC0005
B0002 — Debugger Evasion
Objectives: OB0001
Discovery
Objectives: OB0007

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCPports 443, 80

5+ outbound connections observed
3 domains, 3 IPs, 5 URLs
Common ports: 443, 80
Protocols: HTTP, TCP

View details · 5 shown

Domain: ip-api.com
URL: http://ip-api.com/json/34.55.44.238?fields=status,country,regionname,city,lat,lon,isp,timezone,query
Protocol: HTTP

IP: 208.95.112.1
Port: 80
Protocol: TCP

Domain: discord.com
URL: https://discord.com/api/webhooks/1568290802583740449/xi6r8_zvisy8rov2bvnvqzlf3av-h41ksycdpxxvuplqgv8pcntg9_drdlg5ivyc2qpd
Protocol: HTTP

Domain: discord.com
URL: https://discord.com/api/v10/channels/1568300753418854411/messages?limit=20&after=1568602816740597832
Protocol: HTTP

Domain: discord.com
URL: https://discord.com/api/v10/channels/1568300753418854411/messages?limit=20
Protocol: HTTP

5 shown

DNS request activity4

A5+ response IPs

4 DNS requests observed
4 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 4 shown

Query: ip-api.com
Type: A
Answers: 208.95.112.1
Response: NOERROR

Query: discord.com
Type: A
Answers: 162.159.137.232, 162.159.128.233, 162.159.136.232, 162.159.135.232, 162.159.138.232
Response: NOERROR

Query: atm.teams.mira.tm.svc.cloud.microsoft
Type: A
Answers: 52.123.250.131, 52.123.250.157, 52.123.250.141, 52.123.250.144, 52.123.250.165, 52.123.250.163, 52.123.250.173, 52.123.250.175
Response: NOERROR

Query: api.ipify.org
Type: A
Answers: 172.67.74.152, 104.26.12.205, 104.26.13.205
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2026-10-04T07:28:00Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 72400
Sections: 6
Compile time: 2026-10-04T07:28:00Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 90780
Raw size: 91136
Permissions: rx
Entropy: 6.35

Name: .rdata
Virtual address: 98304
Virtual size: 48414
Raw size: 48640
Permissions: r
Entropy: 4.84

Name: .data
Virtual address: 147456
Virtual size: 6200
Raw size: 2560
Permissions: rw
Entropy: 2.4

Name: .pdata
Virtual address: 155648
Virtual size: 5148
Raw size: 5632
Permissions: r
Entropy: 4.85

Name: .reloc
Virtual address: 163840
Virtual size: 824
Raw size: 1024
Permissions: r
Entropy: 4.81

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: KERNEL32.dll
Functions: ActivateActCtx, CreateActCtxW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, FindClose, FindFirstFileExW …

Library: USER32.dll
Functions: MessageBoxW

Library: SHELL32.dll
Functions: ShellExecuteW

Library: ADVAPI32.dll
Functions: DeregisterEventSource, RegCloseKey, RegGetValueW, RegisterEventSourceW, RegOpenKeyExW, ReportEventW

Library: api-ms-win-crt-runtime-l1-1-0.dll
Functions: __p___argc, __p___wargv, _c_exit, _cexit, _configure_wide_argv, _crt_atexit, _errno, _exit …

5 shown

Resources2

2 resources

2 resources
Resource types: RT_MANIFEST, RT_VERSION

View details · 2 shown

Type: RT_VERSION
Language: NEUTRAL

Type: RT_MANIFEST
Language: NEUTRAL

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

4 issuers

Example subject: Microsoft Corporation
Issued by: Microsoft Code Signing PCA 2011

View details · 5 shown

Subject: Microsoft Corporation
Issuer: Microsoft Code Signing PCA 2011
Fingerprint: 72105B6D5F370B62FD5C82F1512F7AD7DEE5F2C0

Subject: Microsoft Code Signing PCA 2011
Issuer: Microsoft Root Certificate Authority 2011
Fingerprint: F252E794FE438E35ACE6E53762C0A234A2C52135

Subject: Microsoft Time-Stamp Service
Issuer: Microsoft Time-Stamp PCA 2010
Fingerprint: 315BDBA2CC6DE1118F3DB8BDAEBBE5FE986FEB75

Subject: Microsoft Time-Stamp PCA 2010
Issuer: Microsoft Root Certificate Authority 2010
Fingerprint: 36056A5662DCADECF82CC14C8B80EC5E0BCC59A6

Subject: .NET
Issuer: Microsoft Code Signing PCA 2011
Fingerprint: 4C7642E107BA2BECEEF6A20FCD00A3CD897B1459

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check