Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/06/2026, 16:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 252KB
- Sample260603-vb6ebsc13l
- SHA256 e20e3b16de2ba32684fe9ab72ed187126753376c342db7e4a973cc818d9be549
- MD5 c351d3f13b94ca22a6c7033a5c4d31c2
- SHA1 d3f615b847e4c38ca6604db02ef560d09a75b406
- SHA512 9b148cd150872a89d76a0623c0cb10c72a143eb39ca8a823cb1213808301409db59a05a826c7c3eda4d28cca30257b3a4c8a239e3a987e040195ebab774a718e
- SSDEEP 3072:gCSjGoLpWM6VsBEjxeZdb53EAi8RYZrEguStu505aYwKa8YzWP1myXC:WXqoEutE5kZgBuiaYwKaTFyS
- TLSH T17B448D2632CCF332D0E605345E6DF2B1AD7ABC310E25591FB7E91B2D5E716C29A28346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 2 IoCs
pid Process 2748 Logo1_.exe 2116 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCX9D1F.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX9C25.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX9A86.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe.Exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{5523374E-4F46-45CA-876C-1902469AB301}\MicrosoftEdge_X64_139.0.3405.125.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCX8EF0.tmp Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX8E60.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\Logo1_.exe 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe 2748 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2612 wrote to memory of 772 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 83 PID 772 wrote to memory of 3816 772 net.exe 85 PID 2612 wrote to memory of 1028 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 86 PID 2612 wrote to memory of 2748 2612 2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 87 PID 2748 wrote to memory of 2236 2748 Logo1_.exe 89 PID 2236 wrote to memory of 1256 2236 net.exe 91 PID 2748 wrote to memory of 2040 2748 Logo1_.exe 94 PID 2040 wrote to memory of 2084 2040 net.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3816
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD2C.bat2⤵
- System Location Discovery: System Language Discovery
PID:1028
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1256
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2084
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2116
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX9711.tmp
- Size 156KB
- SHA256 60ee42c63ff04bd4edef5797bc1928b6efc41416607b68df927869152266ea71
- MD5 8b2e955c7a83bf0bb8bcf8327d5c936d
- SHA1 37bb2804dda2b7c40c9c34980fb5275d15260006
- SHA512 6a9906982116f408e99b6b4673639aba652ae0018d1066eefc23e5dfccb9af0913bc8846221193a775f5ae24f9a0aaa8217fe55947b1d4709056110e5238b4d6
- SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6kNz:hCSjGoLpWM6VsBEjx5ZdJZ
- TLSH T19EF3B32EB18FB3F6D3E1597C8D1DF2A5ED28FE20CE19285B75993B0E9A760C31508191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX99B4.tmp
- Size 94KB
- SHA256 f4c2d252ef6b144e93225ed54b3c3d69e9e710b8e43112408b1634a1154ccf61
- MD5 2eccc0405793c12eafdee8faf90576e8
- SHA1 9502b18bf5f9484a30e6f9f3be12d712a18d78bc
- SHA512 d16ab6ed92fc0728df599aeb0cc115a4822b37c344f7e6ceb0f3c07d2fcb91efe26d4798362034380800c840e32fa220eea3b0e3c5314acf621ffff27612ad49
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6fND:gCSjGoLpWM6VsBEjx+ZdGp
- TLSH T147933A5AB18CB3B2D0E159BC8E0FF2E5BD297E200E1D589F759A2F0DEE761C1190C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX9C36.tmp
- Size 103KB
- SHA256 9bdaae122d13993cf58f0262a3a97fb21fd6e1f273627274dc3f862ca3812125
- MD5 8d300f2375c6e79ba42e47f67ea3a5b4
- SHA1 0a9eae31c9c79caaa75ae2de63fda3f0fa305f7e
- SHA512 2537170dc8cc224039685057802ef1818d4c8320520c10f513f7011611a25b7edd0b1adfb563afd053fb9b8241f2b85837de5e3c05bfb42439a4f05db10d102f
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHihNQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqAu
- TLSH T197A36C2AB68DB372D0F149B88E0DF2E57D397E300F1A185FB69E1F0E9A765C1190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX9C87.tmp
- Size 91KB
- SHA256 1964546b73a86dbef97f3fe7f48532d7983a56ae67e905669565fe7a8fdbdb3a
- MD5 c88544778b84139ca48f24a235360eca
- SHA1 dcdc5628afe5bb1729f2480d5c9b07309fbd51c9
- SHA512 4ef195678b1a176701ce01b8f585c6f9facb06f470aa78e4744f0f3cd093bbdabb3a3790e5fb9b3aabf7b32ebb9fdfebebd9d95defb2d21f6b39ce378fa5f5b0
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6ENT:YCSjGoLpWM6VsBEjxZZdJ5
- TLSH T1B8935B6AB28DB376D0E259B88E0DF2E5BD397E300F19185FB5AE2F0DDA761C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9B25.tmp
- Size 118KB
- SHA256 d15d9c5be102ec8f6ae738c053d9d9c7c75c9a98442df37b3faf6ddb953b3df5
- MD5 f01439207587699767ffd4cb78f8e783
- SHA1 31107956420eb424e8e693e1fbcde222a00f5396
- SHA512 8738bb1d2a53520a6af311e6921b6469a1b7fd417663a43146423f3d8fb35911fbfe267809b23ab4fb8a11589bd0e39c5af06a4a2cc16ade07794d88f548de1a
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCnv:JCSjGoLpWM6VsBEjxZZdQe5BV0PH
- TLSH T166C3AE6AB68CB377C0E259B88E0DF2E57D697E300F19085FB59A2F0DDA7B5C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCX9E4C.tmp
- Size 100KB
- SHA256 faa50ea1a694036a9b688e8bd62f24982bf577abd26928812920198c9542492c
- MD5 80cbf78343115405eaf74840027dadb9
- SHA1 a562772325a9296826ec819d38294c6c79d9519a
- SHA512 4eda30007254fbadf0c5db2339cda4bb151c2f36f88e6b99659430c6753da4b61c57f15394e608b7bd66be2a71218db05151645581e61aedfb91027797b09ca4
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3cNj:oCSjGoLpWM6VsBEjxQZdJUcJ
- TLSH T16CA35B1AB69CB3B2D0F149B89E0DF3E5BD397E300F59185BB2AD3B1E9A77181190C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCX8A8A.tmp
- Size 91KB
- SHA256 f1f717a3565541a83b222ca6466eed1ab3d869e688623c51d71950a817c527d0
- MD5 52c1d5fb06ec4849915ea28bf4841993
- SHA1 8e4f6b2b522690f4f3b4a7c4e5d575c835b3fa19
- SHA512 25ddabe1a736443eedca458ada1fba1f4ddfc71cc4fa663afdf82fc6886fb294ada9734b7a27b708899d0c66bc15a4061f0d56f3582c7cb12f181b53b88d7902
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6oNb:QCSjGoLpWM6VsBEjxGZd9B
- TLSH T1B1935B6AB68DB372D0E159B88E0DF2E5BD387E301F19185FB5AE2F0DDA761C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCX8E4E.tmp
- Size 91KB
- SHA256 6ad0195bf8aa81b9a694e8099857228643744294d3f02fa4fb7082ee88b7f1c7
- MD5 35cf00dfafdce748b6282d7a7d07d9b2
- SHA1 50901c7a4486c8a5a2015cc5a9251dec50564b48
- SHA512 b9311de882fa74790a03deaee205e888b89557237097ffad8d1697f783ca3dbd474ee81dfac325c2ebf08c47924bb77ce198dbb2d61675e31b8fc07da0d63c99
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6yNL:YCSjGoLpWM6VsBEjxmZdjx
- TLSH T1B1935C6AB29CB376D0F159B88E0DF2E5BD297E300F19185BB5EE2F0DDA761C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXA2D2.tmp
- Size 92KB
- SHA256 82d388f39ca6e1663f8d094c7f9d548a07654dd50c1174ca0bb509123d8d71da
- MD5 370c58bd53c7f9324229f2e16e12d1dd
- SHA1 931f97440e34bdefa8c76e7531fa83ab8852d9a8
- SHA512 fc3766268d4e3363e67c83886c709c83cf10e7727c454fcbe8aa0c0c0606b175aecb8523618114addbcfdeedf1cdbcd09b44e469de15cf13273ee3f78aa38954
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CxND:YCSjGoLpWM6VsBEjx+ZdDxp
- TLSH T1B2935B2AF29CB376D0F199B88E0DF2E5BC297E304E19185B759E2F0EDA771C1590C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aFD2C.bat
- Size 896B
- SHA256 5c5a4265ee07b2dace07b3f48ffc9656ba4af71569514c036b330e4e4fde142c
- MD5 6c041692d48525c5a82fa99156aa9cfc
- SHA1 fbbdaf343545a306b63c42664bd73840257610e0
- SHA512 5439f13d98a777c510453fbd87d8ed449d6fee0cac391909c7deb39cc9ba6e89794d97d6f0f7d60f76fca1f4bd293991c09d386b222f0c1272b1af2dc37f0888
- TLSH T10411C249406FDD3B212ED01B90BCF94DD18022242FCA66B16315A39880E9CFDA7B2222
- MD5 SHA1 SHA512 TLSH
2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-06-03_c351d3f13b94ca22a6c7033a5c4d31c2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe.exe
- Size 159KB
- SHA256 4669046bf841068b51beb940dfc397d70067bf7340fb8f93c973496ff304a91b
- MD5 c0c9b5e43386f8b9a7f408d6f2715e51
- SHA1 2ac65941ff9f559f655a7c0845374460536380f3
- SHA512 67b5679434173a99b0b85713e76458fede6616074d48afe033ed39946c26053fa34819cf1fcfc7be06bf4328ab2d5417f51c6d2b2e10deb68e7add404a01c984
- SSDEEP 3072:DEAi8RYZrEguStu505aYwKa8YzWP1myXC:DE5kZgBuiaYwKaTFyS
- TLSH T124F37C2236D0C032D1A311315AB9E7B19ABAF8725E31991FB7E8172D1E717D2EA34347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 d3b68e0babdffe5f6077300cb43ec88dd339dae7f5999a90a6a3aeae351becba
- MD5 322eafa476335beba12d70535a5dfe89
- SHA1 c28c1e8a6faf3d7db01ad1f6670a53704dc4da19
- SHA512 2b796c695a400391b30fd8f4e27e4a171450f2c19c4e1afdacb8b3153ecc6e1be8194630a4a8165564c7f2a393c2066e4b75be98ab254ba5438e4f3018cc3433
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6WNH:gCSjGoLpWM6VsBEjxeZdb5
- TLSH T17F935C5AB28CB377D0E959B88E0DF2E5BD287E300F19186BB5AE2F0DDA771C1190C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH