bdaejec | 0bd27066ee8499ca6a5ad00837f103a2aab76d500405107d04c7f5861a380f3d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe
Size 32.6MB
Sample260710-qmr9mact21
SHA256 0bd27066ee8499ca6a5ad00837f103a2aab76d500405107d04c7f5861a380f3d
MD5 d4c9594294c6ec389e32d47ac59dd23e
SHA1 63b32fade97d90abf33ccc8439fc86f876c00ce2
SHA512 bafdc7d9b9cf3f0115737d918494c15fb39532a6b0963ab43abdda08ba23f9d3f040136c9d2869d756e85e8b41d28c7adb1dd77a896a1f3ed87eb171bc822b4a
SSDEEP 786432:pxSGhDSNESwjGivU44UnZjW9ACajPw0A63ib/DDo9k:2WGR44iK9ACajPBR3ib/Q
TLSH
T1C87733803A94C6B3D455033550579B82BFE69C45F918CF0E72C2B0B93EF66998A772CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor discovery bdaejec ransomware

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 2 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral1/memory/3084-14-0x0000000000180000-0x0000000000189000-memory.dmp	family_bdaejec_backdoor
behavioral1/memory/3084-59-0x0000000000180000-0x0000000000189000-memory.dmp	family_bdaejec_backdoor

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral1/files/0x0004000000023208-3.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3084-14-0x0000000000180000-0x0000000000189000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3084-59-0x0000000000180000-0x0000000000189000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0004000000023208-3.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	EuniKr.exe

Executes dropped EXE 3 IoCs

pid	Process
3084	EuniKr.exe
1200	MSI2266.tmp
3512	MSI2296.tmp

Loads dropped DLL 12 IoCs

pid	Process
652	MsiExec.exe
652	MsiExec.exe
652	MsiExec.exe
652	MsiExec.exe
652	MsiExec.exe
652	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	EuniKr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.4.0\NxCooking.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	EuniKr.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	EuniKr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	EuniKr.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	EuniKr.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	EuniKr.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.5.3\PhysXCore.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	EuniKr.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.3.2\PhysXCore.dll	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.8.0\PhysXCore.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	EuniKr.exe
File opened for modification	C:\Program Files (x86)\Common Files\Wise Installation Wizard\WISDEA314C409294250BC9298E4C105F28D_9_10_0129.MSI	2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.3.3\NxCooking.dll	msiexec.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.7.2\PhysXCooking.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	EuniKr.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	EuniKr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe	EuniKr.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.7.4\PhysXCooking.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	EuniKr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe	EuniKr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	EuniKr.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.8.3\PhysXCooking.dll	msiexec.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.3.1\PhysXCore.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	EuniKr.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	EuniKr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	EuniKr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	EuniKr.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common\PhysXDevice64.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	EuniKr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	EuniKr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.4.1\NxCooking.dll	msiexec.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	EuniKr.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{DEA314C4-0929-4250-BC92-98E4C105F28D}\A_Ball_Trans.EFBABE66_E43C_474F_A6F1_F0312317E9E1.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFF9.tmp	msiexec.exe
File opened for modification	C:\Windows\DEA314C409294250BC9298E4C105F28D.TMP\WiseData.ini	MsiExec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58ef3f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2296.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2391.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23A1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF22C.tmp	msiexec.exe
File created	C:\Windows\Installer\{DEA314C4-0929-4250-BC92-98E4C105F28D}\A_Ball_Trans.EFBABE66_E43C_474F_A6F1_F0312317E9E1.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{DEA314C4-0929-4250-BC92-98E4C105F28D}\A_Ball_Trans.72AC20DB_37D3_1016_B346_A7FD958F5C39.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2266.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ef3d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{DEA314C4-0929-4250-BC92-98E4C105F28D}\A_Ball_Trans.72AC20DB_37D3_1016_B346_A7FD958F5C39.ico	msiexec.exe
File created	C:\Windows\DEA314C409294250BC9298E4C105F28D.TMP\WiseCustomCalla.dll	MsiExec.exe
File created	C:\Windows\Installer\e58ef3d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DEA314C4-0929-4250-BC92-98E4C105F28D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB53.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI2266.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI2296.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EuniKr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f94cc820840d1c590000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f94cc8200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f94cc820000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af94cc820000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df94cc820000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A64_Control_Panel = "PhysX_A64_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Engines	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.8.0.37.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.6.28.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.6.2.6.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.5.4.2.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.5.3.2.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.3.2.5.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A64_Engines	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.3.48.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.0.9.msm = "PhysX_A32_Engines"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\Version = "151650433"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\PackageName = "WISDEA314C409294250BC9298E4C105F28D_9_10_0129.MSI"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\LastUsedSource = "n;1;C:\\Program Files (x86)\\Common Files\\Wise Installation Wizard\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Control_Panel = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.6.4.6.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.3.1.2.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\ProductName = "NVIDIA PhysX"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.1.38.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.5.0.16.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.4.4.4.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.4.0.3.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\Media\1 = ";LABEL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.3.3.4.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\Media\DiskPrompt = "[ProductName] [1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.8.3.30.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.5.35.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.6.1.6.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A64_Eng_2.8.3.30.msm = "PhysX_A64_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.8.1.48.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.2.9.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.6.3.6.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.5.1.5.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.4.1.4.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\PackageCode = "D3B28DAA86609494FB26DF3BC3FEF1C8"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.4.28.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.6.0.5.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\61A06632C8ACCC042938A4584BF90122	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\61A06632C8ACCC042938A4584BF90122\4C413AED92900524CB29894E1C502FD8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\Net\1 = "C:\\Program Files (x86)\\Common Files\\Wise Installation Wizard\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4340	msiexec.exe
4340	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3804	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3804	msiexec.exe
Token: SeSecurityPrivilege	4340	msiexec.exe
Token: SeCreateTokenPrivilege	3804	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3804	msiexec.exe
Token: SeLockMemoryPrivilege	3804	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3804	msiexec.exe
Token: SeMachineAccountPrivilege	3804	msiexec.exe
Token: SeTcbPrivilege	3804	msiexec.exe
Token: SeSecurityPrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeLoadDriverPrivilege	3804	msiexec.exe
Token: SeSystemProfilePrivilege	3804	msiexec.exe
Token: SeSystemtimePrivilege	3804	msiexec.exe
Token: SeProfSingleProcessPrivilege	3804	msiexec.exe
Token: SeIncBasePriorityPrivilege	3804	msiexec.exe
Token: SeCreatePagefilePrivilege	3804	msiexec.exe
Token: SeCreatePermanentPrivilege	3804	msiexec.exe
Token: SeBackupPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeShutdownPrivilege	3804	msiexec.exe
Token: SeDebugPrivilege	3804	msiexec.exe
Token: SeAuditPrivilege	3804	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3804	msiexec.exe
Token: SeChangeNotifyPrivilege	3804	msiexec.exe
Token: SeRemoteShutdownPrivilege	3804	msiexec.exe
Token: SeUndockPrivilege	3804	msiexec.exe
Token: SeSyncAgentPrivilege	3804	msiexec.exe
Token: SeEnableDelegationPrivilege	3804	msiexec.exe
Token: SeManageVolumePrivilege	3804	msiexec.exe
Token: SeImpersonatePrivilege	3804	msiexec.exe
Token: SeCreateGlobalPrivilege	3804	msiexec.exe
Token: SeCreateTokenPrivilege	3804	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3804	msiexec.exe
Token: SeLockMemoryPrivilege	3804	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3804	msiexec.exe
Token: SeMachineAccountPrivilege	3804	msiexec.exe
Token: SeTcbPrivilege	3804	msiexec.exe
Token: SeSecurityPrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeLoadDriverPrivilege	3804	msiexec.exe
Token: SeSystemProfilePrivilege	3804	msiexec.exe
Token: SeSystemtimePrivilege	3804	msiexec.exe
Token: SeProfSingleProcessPrivilege	3804	msiexec.exe
Token: SeIncBasePriorityPrivilege	3804	msiexec.exe
Token: SeCreatePagefilePrivilege	3804	msiexec.exe
Token: SeCreatePermanentPrivilege	3804	msiexec.exe
Token: SeBackupPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeShutdownPrivilege	3804	msiexec.exe
Token: SeDebugPrivilege	3804	msiexec.exe
Token: SeAuditPrivilege	3804	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3804	msiexec.exe
Token: SeChangeNotifyPrivilege	3804	msiexec.exe
Token: SeRemoteShutdownPrivilege	3804	msiexec.exe
Token: SeUndockPrivilege	3804	msiexec.exe
Token: SeSyncAgentPrivilege	3804	msiexec.exe
Token: SeEnableDelegationPrivilege	3804	msiexec.exe
Token: SeManageVolumePrivilege	3804	msiexec.exe
Token: SeImpersonatePrivilege	3804	msiexec.exe
Token: SeCreateGlobalPrivilege	3804	msiexec.exe
Token: SeCreateTokenPrivilege	3804	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3804	msiexec.exe
Token: SeLockMemoryPrivilege	3804	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3804	msiexec.exe
3804	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 3084	5092	2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe	85
PID 5092 wrote to memory of 3804	5092	2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe	86
PID 4340 wrote to memory of 652	4340	msiexec.exe	89
PID 4340 wrote to memory of 1644	4340	msiexec.exe	97
PID 4340 wrote to memory of 2008	4340	msiexec.exe	99
PID 4340 wrote to memory of 1200	4340	msiexec.exe	104
PID 4340 wrote to memory of 3512	4340	msiexec.exe	105
PID 3084 wrote to memory of 4576	3084	EuniKr.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\Temp\EuniKr.exe
  C:\Users\Admin\AppData\Local\Temp\EuniKr.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6aa63a03.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WISDEA314C409294250BC9298E4C105F28D_9_10_0129.MSI" WISE_SETUP_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3804

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2180B638996D3B21448BEED17FE28D50 C
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:652
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 14724B5CCE30C4913FC5D3C2603A9E48
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2008
- C:\Windows\Installer\MSI2266.tmp
  "C:\Windows\Installer\MSI2266.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1200
- C:\Windows\Installer\MSI2296.tmp
  "C:\Windows\Installer\MSI2296.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ef3e.rbs

Path C:\Config.Msi\e58ef3e.rbs
Size 45KB
SHA256 9b1d8f4521a6b9b5ee1992f116f699767701033d0fb3aa348ec203119173e192
MD5 8a6f8420dd45a899ee520ce6460f7b9b
SHA1 f6a811fff0e124c763b57a2a1cb307a6ca7b6ae0
SHA512 3120e09fcb26542554dbf3784f1bd800a63b9ed0274e00c5c7b69074dab0c5861010e43a372782afdab1f80a5fcd72b8180c106f767654ce930f49b012b85100
SSDEEP 768:rotmpRYGY8soENy/Rb4My84xUkhAMhvoLm9gycOhLw+fC:8tmpRYGY8soENy/Rb4My84xUkhAMhvod
TLSH
T12D23E1A19E1086D2FA429775FB062B453BB3C5F7C714C28B10ACFA966E8478427FD1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WISDEA314C409294250BC9298E4C105F28D_9_10_0129.MSI

Path C:\Program Files (x86)\Common Files\Wise Installation Wizard\WISDEA314C409294250BC9298E4C105F28D_9_10_0129.MSI
Size 25.8MB
SHA256 7b359d7c2f9cfb77c2377885a65a35adce9e526145820261cb9c2f3b001fb8f0
MD5 73d9ffda96faaed83d2a088ffb2534b1
SHA1 3254ac67b00853f2e003423a09d7db5be76c1fcc
SHA512 1bbd390e2fad582b0c1b72a4b1e2ad5307a8db131b0b8f02dcb24a0c2e8835db8266735c6281769f23536690f8b8cb1046900b72d4cd28756bfb307a30b604bd
SSDEEP 786432:KSNESwjGivU44UnZjW9ACajPw0A63ib/DDo9k:NWGR44iK9ACajPBR3ib/Q
TLSH
T1895733953DA1C833E622023120667B947FA66D50B948CF0B7240B8FB3FFA75749A55CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DO_NOT_MANUALLY_DELETE_ANY_SUBFOLDERS.txt

Path C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\DO_NOT_MANUALLY_DELETE_ANY_SUBFOLDERS.txt
Size 1B
SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
MD5 7215ee9c7d9dc229d2921a40e899ec5f
SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
MD5 SHA1 SHA512

Submit Download

k2[1].rar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\N9IM4ZQ1\k2[1].rar
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

1F0130AC.exe

Path C:\Users\Admin\AppData\Local\Temp\1F0130AC.exe
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

6aa63a03.bat

Path C:\Users\Admin\AppData\Local\Temp\6aa63a03.bat
Size 187B
SHA256 34c97b0e526158f91e6c6609ff3ef01363f91ec35cbbee8ec04a97d4a53a1115
MD5 293bd62e7888716ffcda0ff4536ac614
SHA1 ba0efb9fb19547dc32cd860872fcab5924119593
SHA512 2b5356c829972e9fb15a276b2838c18133e766ccea0a92de6b30fa2c8a17c4aac8b8745a7cc5f82b8dd2db087a85a0062205ecb38be6c38eaa8a29ecb162691d
TLSH
T1B2C01201E186C69D1854601B0EE1618DC0670C683BAD6B126B60C4ACA1A740DF5C3702
MD5 SHA1 SHA512 TLSH

Submit Download

EuniKr.exe

Path C:\Users\Admin\AppData\Local\Temp\EuniKr.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI89630.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI89630.LOG
Size 13KB
SHA256 17cc7383326af809746f2866dccab5780eeeb44179989051842be1706ee39ec7
MD5 f8bd8bffd49916c4eed64c6df9fd9de8
SHA1 1764952f2097d4729a978226fa3e07ec240c2668
SHA512 e6a70834a23a0b90fe0f356fc23a42620da98453a01deb3d25c5843682731933b6032fa8927de0e6413fbb2977bd41d1ebb0fddb2dac9e2780b6b7a17b26a356
SSDEEP 96:WaRMMPMUMZM/MKMbYMWMJMipMBMeMPMfMGM1MTMKrM4M1M1MWMlM30MyMcMS+Mj/:EzwmPeYFC1T5r1NnddZYKaHh6KPKm
TLSH
T15F528E2B77E82688F6F3DB439B7B05250A777DDA9839DA1C26E0800D01B5A00F594BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA275.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA275.tmp
Size 22KB
SHA256 0044aac10bf23b3e27ba8c274933fad40e7418944387a745827139913ecdf095
MD5 1368fe994fce9c1ddaf3b01db45bbf79
SHA1 9debc04f4de1dea0e49844b844c5521c230eb3f8
SHA512 856f1bc5e96c7f989394b9259f6b7dad388d3d19f4ce91abd4db5d0becf1eac284a00fed067f2e6f5220db770d8baa5627c7746b8bfc1cc2a16d5d0ee8ce566c
SSDEEP 384:djfJApmLNjn2kkXl8svyPmkH5MelrLj/Qq+TM37aS+QrfCPCd3zmEfw8n:djBfLe86yPmkH5MelrLj/3+87aSFr6Pa
TLSH
T11AA2B185371380B2C58D1DB8B0B75E362FBE8972EC489957CF1EE84A34E5380A957D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA302.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA302.tmp
Size 126KB
SHA256 871f195e12ebb609e6179756092a5821e78cbf920c5c3c7da9ceb01aca991a78
MD5 48a8123016d261e45ee807c0e238a971
SHA1 d7c8bc1e4d6437697f137cff3eca0e31e49a55cf
SHA512 a03ed081d740160f92f0f46315e3eff6aa7ac1b6ca65c28be595a802b4d32614cc778d57792b0fbc68ec2ce7382bfcee6c4009226cb2b5428c5819d3b6d5828f
SSDEEP 3072:myu9fGpWYQrLobhVxdcLHx/q3hJWp7+SlncB+JGL9zwWl55I:miQrLobTjcly3TWhHcp9zwi5I
TLSH
T112C39E53B3E580F0F99A247D14275F268777A81987748EC367242E19AF203D2BA7D3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiseCustomCalla.dll

Path C:\Windows\DEA314C409294250BC9298E4C105F28D.TMP\WiseCustomCalla.dll
Size 196KB
SHA256 1691bd3ed63e2f076c324263cb4f9a8e1abc0f57716d8b70e6115e95c9b0128b
MD5 154e3e1be8a54020ad36c4c0c7f3d126
SHA1 336d77566688eea6b14f45d5f43bc5db94fd63af
SHA512 7d14f6c4b55aef1c4fc2a2f0d8cf7d2df8d68dd9a4ac46049364ab372d6059bd8ff9363b41381142991602c429a872773b7118d656447c4dad56731e9e3e77ec
SSDEEP 3072:bGjus8exg3bsNMel1VfVLK48Fpl4IiDplrNafUw47t+/NDKTCMQ:bGmqg3gMel1VfVLPaAIiDDq/5
TLSH
T1C7147D1132D1C072E2BF127E4866CB6967BB7C609BB6C24B2F90BF9E6D705418F25352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiseData.ini

Path C:\Windows\DEA314C409294250BC9298E4C105F28D.TMP\WiseData.ini
Size 4KB
SHA256 a1663c41b26deffe3e4896e83ce1707be4800db1a8f1378285fc76c9667ba7be
MD5 3ab4a1df350302021f99f2a9aabbdae3
SHA1 76a7de0989dd78bc950d700de38983850d360bab
SHA512 ad014b5eb1cb4e90d0a8af1f17bb243dd35d9b4c3c440b820e69d0a60ff101101432af4575851b7cf78cbeb74d07e1abbe46f0fbfcb801bd9d20e07dc85d258d
SSDEEP 48:PL2zShbfnsZn0LfnVZnKnj7vnKYnKkynKHnKcnKh9mNG7ZKvxh7xe2SYTXr7AitO:PLTIOLNwLg9mNsWxe7YTXvA+JxBNhs
TLSH
T1389156784445D8E73B22B1CE3B960EC362B5DDC06738339693B6654169EEA3C53C6CA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2266.tmp

Path C:\Windows\Installer\MSI2266.tmp
Size 61KB
SHA256 f18a5ab55e7c505cd09dfedca61a22a9281639fe2ae2766a96469ae9977346b5
MD5 ab04eb816c8a3fb76ac88692b23b5117
SHA1 48ac4f4746e3e7a3b7f597ead537fea8505d51ff
SHA512 51da4583f5dae5a28b1f157db2443ace9ff3ecc69bf6d5dd326064ae34461ca2b312af808e56b5ff264f6cea5249c9d53447eaaefe02a3cc585851f962ba8bfd
SSDEEP 768:nD/jqy/1HAdaq6ZDM3yBZhOk+lVhl6PkmEtAf9DeLFbz1:nHrAEq6K6OkBwtWeBZ
TLSH
T15C534A1A3D5FC033E401C67196A1C2C15FBF68033AD62C6FEF940D895DB16A8166AEBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A_Ball_Trans.72AC20DB_37D3_1016_B346_A7FD958F5C39.ico

Path C:\Windows\Installer\{DEA314C4-0929-4250-BC92-98E4C105F28D}\A_Ball_Trans.72AC20DB_37D3_1016_B346_A7FD958F5C39.ico
Size 24KB
SHA256 812dfa2b5e7c1a1f87a5c56d78092d2ab1c520cf3f9a63565497c3b160645d09
MD5 424dcdf91371ab8d0e78f33ec812ed55
SHA1 766b729ee6510ae9788b7d94934b35be9fd69752
SHA512 20a573f344a6e8cad0b648a5368691030cbfee18c541893590d198a692d582b850c72e18e322ac9de24c39e000ea0716b16a82747f1d41b7a8eeb164759d5376
SSDEEP 192:GX/PXJLQcU1asUTlaS3W2fQcJsHfKiI6b0sgEfyIFvf2:KdQA1BhJIcS90shfyIF2
TLSH
T1ECB22E877E09C053F45838B58CD68BB9D7866D858F024A4B3294BB1FFDB79A07F22049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 a475b9846caff4727b24bc25d86cfb2095ef4efad56dae5e9bd2a78abff75b1a
MD5 8d8d749ffaccdd0714bad717b85dfe63
SHA1 73211346f3586bc7673f7fb3fcb946aad30ad6b6
SHA512 eec22bdf011c423b078aa5108b47c9623dfcdd521bb365fdf784a21672776f13186b96ede799ab4bc128ba2bbf410e7341ffa4a475ab6c0f09aebffa8fc4a413
SSDEEP 24576:1u8m+1z1doO/vvTLrWceJG64dl0zEVMiwKmNeTtlU06tuLlBovVFk6XRp:P
TLSH
T17147E42436F92110E7F79E3CA8F16A234D3A7D5B8C159E8D05411B4E0962FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9acb73f8-4a2f-490f-8f50-04dab6ded57d}_OnDiskSnapshotProp

Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9acb73f8-4a2f-490f-8f50-04dab6ded57d}_OnDiskSnapshotProp
Size 6KB
SHA256 4113a359ed08a4f5ca2af28189c9f3e5580ee5535233f867f20093cc85bdae3c
MD5 7c769c9f78ebda16cc604aa674355f01
SHA1 529a94706c75de34d2bc9bbd3b2560aee1840c9d
SHA512 0ae7a9e6fcb56886fa02adf2b691faadf2b6e0f224ff1fce2a004654cb42e995d8555747ed6608c2d423cc46f2c060c79567e1b1ff741325471654041393d1b4
SSDEEP 96:F33RcAhvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:J3rb++ZVmN
TLSH
T154D18A0C5AF54711E2B3AB3129F18557A877B911EF33CB8E0298638E2670910F935F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-52-0x0000000002D00000-0x0000000002D35000-memory.dmp

Download

memory/2008-73-0x0000000002B70000-0x0000000002BA5000-memory.dmp

Download

memory/3084-59-0x0000000000180000-0x0000000000189000-memory.dmp

Download

memory/3084-14-0x0000000000180000-0x0000000000189000-memory.dmp

Download

memory/5092-13-0x0000000000407000-0x0000000000408000-memory.dmp

Download

memory/5092-5-0x0000000000400000-0x00000000024B5000-memory.dmp

Download

memory/5092-845-0x0000000000400000-0x00000000024B5000-memory.dmp

Download