3f063eff823d07a9f5ea740aa5975b92b6e4a238f7bc0eb222de244b0d4516d2

Analysis

max time kernel
145s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30/03/2025, 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe
Size

6.1MB
MD5

1e7736c45ca86406b14dc22de70d8300
SHA1

76dea3dab0663a74a20dd319daecdfcbd9f2865b
SHA256

3f063eff823d07a9f5ea740aa5975b92b6e4a238f7bc0eb222de244b0d4516d2
SHA512

ce9450b461e63e754e21947ea5b7ab9b2c617bc2332745008d2f19dc7f9c2f5072f2d66a2d8378e4e9669e210dc7ac21e2fc5d3b8ff8e6133f49c16e876393cb
SSDEEP

98304:2oqTB3hkFfGMTPQLco1gufrVqV26hgDFrteSdvggzmRLIo6Eg0:6hkFfGMkASVqV26hgDneS1FyRUo6Eg0

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
580	xwgzdtlvzl.exe
2872	favplredvy.exe
2748	SearchUserHost.exe
1284	Explorer.EXE
1308	bindsvc.exe

Loads dropped DLL 17 IoCs

pid	Process
2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe
2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe
580	xwgzdtlvzl.exe
580	xwgzdtlvzl.exe
580	xwgzdtlvzl.exe
2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe
2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe
2872	favplredvy.exe
2872	favplredvy.exe
2872	favplredvy.exe
2920	SearchIndexer.exe
2920	SearchIndexer.exe
2920	SearchIndexer.exe
2748	SearchUserHost.exe
2592	SearchProtocolHost.exe
2872	favplredvy.exe
2872	favplredvy.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1820	cmd.exe
2728	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	favplredvy.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	favplredvy.exe
File created	C:\Windows\system32\SearchUserHost.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\SearchUserHost.exe	SearchIndexer.exe
File created	C:\Windows\system32\oci.dll	favplredvy.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	favplredvy.exe
File created	C:\Windows\SysWOW64\racfg.exe	favplredvy.exe
File created	C:\Windows\system32\msfte.dll	favplredvy.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	SearchProtocolHost.exe
File created	C:\Windows\System32\bindsvc.exe	favplredvy.exe
File created	C:\Windows\SysWOW64\wideshut.exe	favplredvy.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1704	tasklist.exe
2080	tasklist.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000016ae9-14.dat	upx
behavioral1/memory/2144-20-0x00000000032D0000-0x000000000344A000-memory.dmp	upx
behavioral1/memory/2872-26-0x0000000001370000-0x00000000014EA000-memory.dmp	upx
behavioral1/memory/2872-286-0x0000000001370000-0x00000000014EA000-memory.dmp	upx
behavioral1/memory/2872-316-0x0000000001370000-0x00000000014EA000-memory.dmp	upx

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2472	sc.exe
920	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xwgzdtlvzl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	favplredvy.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2072	PING.EXE
2992	cmd.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2940	cmd.exe
2688	NETSTAT.EXE

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2820	ipconfig.exe
2688	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2624	systeminfo.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wucltux.dll,-1 = "Windows Update"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%CommonProgramFiles%\Microsoft Shared\Ink\ShapeCollector.exe,-299 = "Provide writing samples to help improve the recognition of your handwriting."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000060be338ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Defragments your disks so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200017 = "GobiernoUSA.gov"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10308 = "Mahjong Titans is a form of solitaire played with tiles instead of cards. Match pairs of tiles until all have been removed from the board in this classic game."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@"%systemroot%\system32\windowspowershell\v1.0\powershell.exe",-111 = "Performs object-based (command-line) functions"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\sud.dll,-1 = "Default Programs"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10101 = "Internet Checkers"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\Explorer.exe,-312 = "Play and manage games on your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Journal\Journal.exe,-3074 = "Windows Journal"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\sud.dll,-10 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\recdisc.exe,-2000 = "Create a System Repair Disc"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10103 = "Internet Spades"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-4 = "Windows Media Player"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\displayswitch.exe,-321 = "Connect your computer to a projector by display cable."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114 = "Windows Fax and Scan"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-312 = "Sample Media"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-106 = "Tulips"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecCount = "32"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\migwiz\wet.dll,-601 = "View reports from transfers you've performed"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\XpsRchVw.exe,-103 = "View, digitally sign, and set permissions for XPS documents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a0599e328ea1db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-142 = "Wildlife"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-117 = "Maid with the Flaxen Hair"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10102 = "Internet Backgammon"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-107 = "Lighthouse"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10057 = "Minesweeper"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10056 = "Hearts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\Speech\SpeechUX\sapi.cpl,-5555 = "Windows Speech Recognition"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-113 = "Windows PowerShell Integrated Scripting Environment. Performs object-based (command-line) functions"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\ShadowFileMaxClients = "32"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\OobeFldr.dll,-33056 = "Getting Started"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-591 = "Windows Easy Transfer Reports"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-104 = "Jellyfish"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10309 = "Solitaire is the classic, single-player card game. The aim is to collect all the cards in runs of alternating red and black suit colors, from ace through king."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200016 = "USA.gov"	SearchProtocolHost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2072	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2920	SearchIndexer.exe
2920	SearchIndexer.exe
2748	SearchUserHost.exe
1704	tasklist.exe
1704	tasklist.exe
2872	favplredvy.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1284	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2920	SearchIndexer.exe
Token: 33	2920	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2920	SearchIndexer.exe
Token: SeDebugPrivilege	1704	tasklist.exe
Token: SeDebugPrivilege	2688	NETSTAT.EXE
Token: SeDebugPrivilege	2080	tasklist.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe
Token: SeDebugPrivilege	2748	SearchUserHost.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2592	SearchProtocolHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe
2748	SearchUserHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 580	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	29
PID 2144 wrote to memory of 580	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	29
PID 2144 wrote to memory of 580	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	29
PID 2144 wrote to memory of 580	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	29
PID 2144 wrote to memory of 580	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	29
PID 2144 wrote to memory of 580	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	29
PID 2144 wrote to memory of 580	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	29
PID 2144 wrote to memory of 2872	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	30
PID 2144 wrote to memory of 2872	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	30
PID 2144 wrote to memory of 2872	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	30
PID 2144 wrote to memory of 2872	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	30
PID 2144 wrote to memory of 2872	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	30
PID 2144 wrote to memory of 2872	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	30
PID 2144 wrote to memory of 2872	2144	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	30
PID 2920 wrote to memory of 2748	2920	SearchIndexer.exe	32
PID 2920 wrote to memory of 2748	2920	SearchIndexer.exe	32
PID 2920 wrote to memory of 2748	2920	SearchIndexer.exe	32
PID 2748 wrote to memory of 1284	2748	SearchUserHost.exe	20
PID 2920 wrote to memory of 2592	2920	SearchIndexer.exe	33
PID 2920 wrote to memory of 2592	2920	SearchIndexer.exe	33
PID 2920 wrote to memory of 2592	2920	SearchIndexer.exe	33
PID 2920 wrote to memory of 1112	2920	SearchIndexer.exe	34
PID 2920 wrote to memory of 1112	2920	SearchIndexer.exe	34
PID 2920 wrote to memory of 1112	2920	SearchIndexer.exe	34
PID 1284 wrote to memory of 1904	1284	Explorer.EXE	35
PID 1284 wrote to memory of 1904	1284	Explorer.EXE	35
PID 1284 wrote to memory of 1904	1284	Explorer.EXE	35
PID 2748 wrote to memory of 2076	2748	SearchUserHost.exe	36
PID 2748 wrote to memory of 2076	2748	SearchUserHost.exe	36
PID 2748 wrote to memory of 2076	2748	SearchUserHost.exe	36
PID 2076 wrote to memory of 2624	2076	cmd.exe	38
PID 2076 wrote to memory of 2624	2076	cmd.exe	38
PID 2076 wrote to memory of 2624	2076	cmd.exe	38
PID 1284 wrote to memory of 828	1284	Explorer.EXE	40
PID 1284 wrote to memory of 828	1284	Explorer.EXE	40
PID 1284 wrote to memory of 828	1284	Explorer.EXE	40
PID 2748 wrote to memory of 2804	2748	SearchUserHost.exe	42
PID 2748 wrote to memory of 2804	2748	SearchUserHost.exe	42
PID 2748 wrote to memory of 2804	2748	SearchUserHost.exe	42
PID 2804 wrote to memory of 1704	2804	cmd.exe	44
PID 2804 wrote to memory of 1704	2804	cmd.exe	44
PID 2804 wrote to memory of 1704	2804	cmd.exe	44
PID 2748 wrote to memory of 2940	2748	SearchUserHost.exe	45
PID 2748 wrote to memory of 2940	2748	SearchUserHost.exe	45
PID 2748 wrote to memory of 2940	2748	SearchUserHost.exe	45
PID 2940 wrote to memory of 2688	2940	cmd.exe	47
PID 2940 wrote to memory of 2688	2940	cmd.exe	47
PID 2940 wrote to memory of 2688	2940	cmd.exe	47
PID 2748 wrote to memory of 2916	2748	SearchUserHost.exe	48
PID 2748 wrote to memory of 2916	2748	SearchUserHost.exe	48
PID 2748 wrote to memory of 2916	2748	SearchUserHost.exe	48
PID 2916 wrote to memory of 2820	2916	cmd.exe	50
PID 2916 wrote to memory of 2820	2916	cmd.exe	50
PID 2916 wrote to memory of 2820	2916	cmd.exe	50
PID 2748 wrote to memory of 2636	2748	SearchUserHost.exe	51
PID 2748 wrote to memory of 2636	2748	SearchUserHost.exe	51
PID 2748 wrote to memory of 2636	2748	SearchUserHost.exe	51
PID 2636 wrote to memory of 2200	2636	cmd.exe	53
PID 2636 wrote to memory of 2200	2636	cmd.exe	53
PID 2636 wrote to memory of 2200	2636	cmd.exe	53
PID 2748 wrote to memory of 1820	2748	SearchUserHost.exe	54
PID 2748 wrote to memory of 1820	2748	SearchUserHost.exe	54
PID 2748 wrote to memory of 1820	2748	SearchUserHost.exe	54
PID 1820 wrote to memory of 2728	1820	cmd.exe	56

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\xwgzdtlvzl.exe
    "C:\Users\Admin\AppData\Local\Temp\xwgzdtlvzl.exe" "C:\Users\Admin\AppData\Local\Temp\fsbneqzuga.exe" "C:\Users\Admin\AppData\Local\Temp\2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\favplredvy.exe
    C:\Users\Admin\AppData\Local\Temp\favplredvy.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2872
  - - C:\Windows\System32\cmd.exe
      /c sc config msdtc obj= LocalSystem
      4⤵
      PID:2520
    - - C:\Windows\system32\sc.exe
        
        sc config msdtc obj= LocalSystem
        5⤵
        Launches sc.exe
        
        PID:2472
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\Qaz7n9N0.bat"
      4⤵
      PID:768
  - - C:\Windows\System32\bindsvc.exe
      "C:\Windows\System32\bindsvc.exe"
      4⤵
      Executes dropped EXE
      PID:1308
- C:\Windows\System32\wscript.exe
  C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Word\winword.vbs C:\Users\Admin\AppData\Roaming\Microsoft\Word
  2⤵
  PID:1904
- C:\Windows\System32\wscript.exe
  C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Word\winword.vbs C:\Users\Admin\AppData\Roaming\Microsoft\Word
  2⤵
  PID:828

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\SearchUserHost.exe
  C:\Windows\system32\SearchUserHost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\system32\cmd.exe
    /c systeminfo
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2624
- - C:\Windows\system32\cmd.exe
    /c "tasklist /v"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\tasklist.exe
      tasklist /v
      4⤵
      Enumerates processes with tasklist
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1704
- - C:\Windows\system32\cmd.exe
    /c "netstat -ano"
    3⤵
    - System Network Connections Discovery
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:2688
- - C:\Windows\system32\cmd.exe
    /c "ipconfig /all"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2820
- - C:\Windows\system32\cmd.exe
    /c "route print"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:2200
- - C:\Windows\system32\cmd.exe
    /c "arp -a"
    3⤵
    - Network Service Discovery
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:2728
- - C:\Windows\system32\cmd.exe
    /c "tasklist /m msfte.dll"
    3⤵
    PID:2448
  - - C:\Windows\system32\tasklist.exe
      tasklist /m msfte.dll
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2080
- - C:\Windows\system32\cmd.exe
    /c "net share"
    3⤵
    PID:2612
  - - C:\Windows\system32\net.exe
      net share
      4⤵
      PID:372
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:608
- - C:\Windows\system32\cmd.exe
    /c "ping server"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2992
  - - C:\Windows\system32\PING.EXE
      ping server
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2072
- - C:\Windows\system32\cmd.exe
    /c "sc query hfile.sys"
    3⤵
    PID:2132
  - - C:\Windows\system32\sc.exe
      sc query hfile.sys
      4⤵
      Launches sc.exe
      PID:920
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:2592
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 548 552 560 65536 556
  2⤵
  - Modifies data under HKEY_USERS
  PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
1024KB

MD5
cf9c2f860937ef409d320b78111a6590

SHA1
0572e7a11c9e818e9626e3e5438abf1728c3e0fa

SHA256
c15a955992021f4640e40f8aa18b459521458b904c2e0153d944f40118b5c660

SHA512
6e50d2894588f79d33ffd93e069d848ef9fe64b5dfbcbc1ed5379768555d5dfed4bc8d9e5cf9a58e56b14e73d80c49363a23966b0fe0ccd8c9e2ff08720618b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ASSERT~1.ZIP

Filesize
17KB

MD5
b6059cac820365a2120f8b041be0b579

SHA1
009a6beb10a1dd11ea0be4970c9805673411c3e4

SHA256
45990fd5ffca247ad39550d8cacb5487575c3891522a09abd60a12a98d16936e

SHA512
ddbe35e1f586ff0daa15665c003a203dd6c28fd621b13f0a289c863c0d325d906a4780cf8621bbd9915b0872a0b9b8e69fe403b48eb82264c95b0a30e5f315d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qaz7n9N0.bat

Filesize
196B

MD5
e5e0d60c0250439f49ad6656c3f5422c

SHA1
3751594794c3b738b1d379461c8d1753bfaf81ce

SHA256
4fae3cf59f200bb289285720c87a0b4a33cb1e46b29621bec5fd199a82fc950a

SHA512
5623a75d24eded618f50786d30c732373cf5ce1388050b0c67b20936b1eec877d95c7c75d271aa30d5faf5d57e70e3855ae4ab71abc8040e1d273cb592ad4d8b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\MediaCache\ramdisk.sdb

Filesize
878B

MD5
00e1ddc163b58b9e93e4f45de35e477d

SHA1
164fb3598ce2529ef017f66e5116bec4c05cd705

SHA256
f1d14cac5826a6f6f65fde5d4811376f2c3a75b02363540cd8f031feb19865e8

SHA512
ff69091985f5a811b02328b710c32e94ad0ecd06168ae5b765f37fafdb78c4a6135ac74005d269d9b17226610095c0fe2c83bc8f81d0c2d0b2c5b4fc5a1a37f7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\MediaCache\ramdisk.sdb

Filesize
2KB

MD5
9fab1ef4ecb819bd5aaae5ccb458eaf8

SHA1
0c0256c1d272a0069b8670da0517605cb2554c92

SHA256
d1dc5ad5613d7c874bc3674b3b838cac20f09272fd114d9ece2c389a08a63ba2

SHA512
17a872988603391f20bbda29456f29bb939ccd549aa9af1ce51780abb7f06811a4bf0e6d0ff76efdfb707c20e40fe6aeef0cf29cdc9681a08d03821b4074a7fa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb

Filesize
1KB

MD5
8a508230811b3c39fee95227f476cb6a

SHA1
cb9eb41d95a98d08f9bda6e7ffd9e1dd5865fc23

SHA256
ad0d8d80e8820860988b5f12951ec462f0c9bfbf0833147ac3ea4671d8bd1fa2

SHA512
b71748bde50324dc8d041e8c84ffcc2bb169706ed64d287557d13055b6d1e143ab20b09a025981aee0fc39b734b03a10e1a7e4b446ef43f798b09a877123bd3c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Word\AssertUnblock.txt

Filesize
7KB

MD5
fe69433b1567c1069986438d30c55421

SHA1
dd1b837ef6681000104694d383b146288476724a

SHA256
0247d8bfd75820849006746ee747c78ac8a115498a1bb5f55b7954d516b607e4

SHA512
5eefb838ebc8b36b2ed756d4083eaf67444e4509ea1331548dabb12d59512e067daac6f7663acecbc6b082369ec0253f97ec1a691215d883e094475216265531

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Word\ResolveDisconnect.docx

Filesize
15KB

MD5
e132b349801f03f8d74d481429bd9155

SHA1
7082a55da84bc76cc8af75c0da4ed6b929696fee

SHA256
301353ba8f0bd28155510cdab6883bc4ec23848f6352ce296c458344094c065b

SHA512
a2652364a136379f426dc4748081241a1527cc056b6596f7c7ecd5e17fb5e810a312bce2c7258abb16dba38567146e0fac4bab11d2c8ce2e40386a5af8c2884c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Word\ResolveDisconnect.txt

Filesize
4KB

MD5
2fa8a53fd78d70193b0ab7141df65aa3

SHA1
0cd0cf43cfd91e9d81e3e81e75410300b146f166

SHA256
98f20982bace16d3279a7e1e0ff68f99380ae787215819105e4d32295f531b06

SHA512
9e4260df494d2d70bfc4ba4da9184f2cdf085da328ad243f12e77a69c1016bd6a4668cedaa3a9bbc9a690af34f66adc6a878cf6a851d41ca8bda2de0930823ac

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Word\winword.vbs

Filesize
1KB

MD5
3439318cedcf37c1bf5fe6d49ddbb2cb

SHA1
e075965bb3b38abdd80668fb6101a0d10b30f080

SHA256
6484a02c2db6c9afb5659ede4047cad10b7102c2bbc4c94bf8482f88d8fd83a8

SHA512
3dffcf24b052a7fffd50ab6c76d081b1c47ba64c20f21650e4bdcf19106518e8b342691711230ba9eea5489994b8ccec8ad11f54b1509b1cd518616254176b61

Download Submit
C:\Windows\System32\SearchUserHost.exe

Filesize
244KB

MD5
42ec9065d9bf266ade924b066c783a56

SHA1
a8dcf7d63a8bb5abef8787775957a5bb6c0f3f77

SHA256
4ac002e90a52cb0998da78f2995294ee77b89fb2be709b0e3c8e1627212bccdc

SHA512
e49af43aef3f02397098821b81e034ee1f07f8c2f49a9a1768d1522bbc009103a2c88f436f488333f57c7d56b34acbee84588040f56382cc75eaddbb9db19980

Download Submit
C:\Windows\System32\bindsvc.exe

Filesize
291KB

MD5
7c5b397fb54d5aa06bd2a6fb99c62fee

SHA1
a9e0bf7bbabf6ab9e294156985537ae972ebd743

SHA256
d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee

SHA512
daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c

Download Submit
\Users\Admin\AppData\Local\Temp\favplredvy.exe

Filesize
580KB

MD5
2c2029588ad8b86759c17b7ae885ee03

SHA1
91653b5344d4c210201218e2f215dd5228d76799

SHA256
3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290

SHA512
88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f

Download Submit
\Users\Admin\AppData\Local\Temp\xwgzdtlvzl.exe

Filesize
51KB

MD5
e48b89715bf5e4c55eb5a1fed67865d9

SHA1
89a287da39e14b02cdc284eb287549462346d724

SHA256
c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e

SHA512
4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c

Download Submit
\Windows\System32\msfte.dll

Filesize
217KB

MD5
d7ddfd90c55ad42200b2a7e51110ad87

SHA1
0c9429f0b51a73423de4cb0ecf10fd3b3bacd84d

SHA256
4fdc7aacb3981434e797106944f27a507201d11cdf194b3fab79747ce98f2446

SHA512
8ba6cd56ce6aeae9481154e93b75d8712e854a19c60f6279abf721c2550a09d9f22cb410a5cc3062d59f17cde35e728d250129abe60f29321a16df7d2fb9c179

Download Submit
memory/1284-43-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/2144-20-0x00000000032D0000-0x000000000344A000-memory.dmp

Filesize
1.5MB

Download
memory/2872-32-0x0000000000B90000-0x0000000000D0A000-memory.dmp

Filesize
1.5MB

Download
memory/2872-26-0x0000000001370000-0x00000000014EA000-memory.dmp

Filesize
1.5MB

Download
memory/2872-316-0x0000000001370000-0x00000000014EA000-memory.dmp

Filesize
1.5MB

Download
memory/2872-286-0x0000000001370000-0x00000000014EA000-memory.dmp

Filesize
1.5MB

Download
memory/2920-102-0x0000000002F80000-0x0000000002F81000-memory.dmp

Filesize
4KB

Download
memory/2920-279-0x0000000003430000-0x0000000003438000-memory.dmp

Filesize
32KB

Download
memory/2920-100-0x0000000002FD0000-0x0000000002FD8000-memory.dmp

Filesize
32KB

Download
memory/2920-94-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/2920-47-0x0000000001B70000-0x0000000001B80000-memory.dmp

Filesize
64KB

Download
memory/2920-63-0x0000000001C70000-0x0000000001C80000-memory.dmp

Filesize
64KB

Download
memory/2920-93-0x0000000003010000-0x0000000003018000-memory.dmp

Filesize
32KB

Download
memory/2920-111-0x0000000003020000-0x0000000003028000-memory.dmp

Filesize
32KB

Download
memory/2920-351-0x0000000003900000-0x0000000003908000-memory.dmp

Filesize
32KB

Download
memory/2920-352-0x0000000005220000-0x0000000005228000-memory.dmp

Filesize
32KB

Download
memory/2920-353-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/2920-360-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/2920-363-0x0000000005210000-0x0000000005218000-memory.dmp

Filesize
32KB

Download