bdaejec | 0bd27066ee8499ca6a5ad00837f103a2aab76d500405107d04c7f5861a380f3d

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe
Size 32.6MB
Sample260710-qmr9mact21
SHA256 0bd27066ee8499ca6a5ad00837f103a2aab76d500405107d04c7f5861a380f3d
MD5 d4c9594294c6ec389e32d47ac59dd23e
SHA1 63b32fade97d90abf33ccc8439fc86f876c00ce2
SHA512 bafdc7d9b9cf3f0115737d918494c15fb39532a6b0963ab43abdda08ba23f9d3f040136c9d2869d756e85e8b41d28c7adb1dd77a896a1f3ed87eb171bc822b4a
SSDEEP 786432:pxSGhDSNESwjGivU44UnZjW9ACajPw0A63ib/DDo9k:2WGR44iK9ACajPBR3ib/Q
TLSH
T1C87733803A94C6B3D455033550579B82BFE69C45F918CF0E72C2B0B93EF66998A772CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor discovery bdaejec ransomware

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 2 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/700-7-0x0000000000410000-0x0000000000419000-memory.dmp	family_bdaejec_backdoor
behavioral2/memory/700-322-0x0000000000410000-0x0000000000419000-memory.dmp	family_bdaejec_backdoor

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c520-3.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/700-7-0x0000000000410000-0x0000000000419000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/700-322-0x0000000000410000-0x0000000000419000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c520-3.dat	aspack_v212_v242

Executes dropped EXE 3 IoCs

pid	Process
700	EuniKr.exe
3800	MSI6C30.tmp
2524	MSI6C60.tmp

Loads dropped DLL 12 IoCs

pid	Process
2336	MsiExec.exe
2336	MsiExec.exe
2336	MsiExec.exe
2336	MsiExec.exe
2336	MsiExec.exe
2336	MsiExec.exe
5944	MsiExec.exe
5944	MsiExec.exe
5944	MsiExec.exe
5944	MsiExec.exe
5944	MsiExec.exe
5944	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	EuniKr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	EuniKr.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.6.4\PhysXCore.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.7.1\PhysXCore.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	EuniKr.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	EuniKr.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.4.0\NxCooking.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	EuniKr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	EuniKr.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	EuniKr.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	EuniKr.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	EuniKr.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.8.3\PhysXCooking.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	EuniKr.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.5.4\PhysXCore.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	EuniKr.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.8.1\PhysXCore.dll	msiexec.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.6.0\PhysXCooking.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	EuniKr.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	EuniKr.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.7.4\PhysXCore.dll	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	EuniKr.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	EuniKr.exe
File opened for modification	C:\Program Files\Windows Defender\MpDefenderCoreService.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.6.4\PhysXCooking.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	EuniKr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	EuniKr.exe
File opened for modification	C:\Program Files (x86)\Common Files\Wise Installation Wizard\WISDEA314C409294250BC9298E4C105F28D_9_10_0129.MSI	2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	EuniKr.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.5.1\PhysXCooking.dll	msiexec.exe
File created	C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\v2.6.1\PhysXCooking.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	EuniKr.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	EuniKr.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI56D1.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DEA314C4-0929-4250-BC92-98E4C105F28D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI647F.tmp	msiexec.exe
File created	C:\Windows\Installer\{DEA314C4-0929-4250-BC92-98E4C105F28D}\A_Ball_Trans.EFBABE66_E43C_474F_A6F1_F0312317E9E1.ico	msiexec.exe
File created	C:\Windows\Installer\{DEA314C4-0929-4250-BC92-98E4C105F28D}\A_Ball_Trans.72AC20DB_37D3_1016_B346_A7FD958F5C39.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3C759494DA56D49E.TMP	msiexec.exe
File created	C:\Windows\Installer\e5953b4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4159CA8ADFB6397A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C30.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6DA9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2AA7A7262B2963FE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5953b4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{DEA314C4-0929-4250-BC92-98E4C105F28D}\A_Ball_Trans.EFBABE66_E43C_474F_A6F1_F0312317E9E1.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{DEA314C4-0929-4250-BC92-98E4C105F28D}\A_Ball_Trans.72AC20DB_37D3_1016_B346_A7FD958F5C39.ico	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5868.tmp	msiexec.exe
File opened for modification	C:\Windows\DEA314C409294250BC9298E4C105F28D.TMP\WiseData.ini	MsiExec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF144932080C57C5DA.TMP	msiexec.exe
File created	C:\Windows\Installer\e5953b6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C60.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E27.tmp	msiexec.exe
File created	C:\Windows\DEA314C409294250BC9298E4C105F28D.TMP\WiseCustomCalla.dll	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EuniKr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI6C30.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI6C60.tmp

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.0.9.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.6.4.6.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.4.0.3.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\PackageCode = "D3B28DAA86609494FB26DF3BC3FEF1C8"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\Version = "151650433"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A64_Engines	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\Media\1 = ";LABEL"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\LastUsedSource = "n;1;C:\\Program Files (x86)\\Common Files\\Wise Installation Wizard\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.8.3.30.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.6.2.6.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.3.2.5.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.8.0.37.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.2.9.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.3.3.4.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\ProductName = "NVIDIA PhysX"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\Net\1 = "C:\\Program Files (x86)\\Common Files\\Wise Installation Wizard\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Engines	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.8.1.48.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.6.28.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.5.3.2.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\Media\DiskPrompt = "[ProductName] [1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Control_Panel = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.5.35.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.6.0.5.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.4.4.4.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.3.1.2.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\61A06632C8ACCC042938A4584BF90122\4C413AED92900524CB29894E1C502FD8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A64_Eng_2.8.3.30.msm = "PhysX_A64_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.6.3.6.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.5.4.2.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.5.1.5.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.4.28.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.6.1.6.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.5.0.16.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.4.1.4.msm = "PhysX_A32_Engines"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\61A06632C8ACCC042938A4584BF90122	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\PackageName = "WISDEA314C409294250BC9298E4C105F28D_9_10_0129.MSI"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C413AED92900524CB29894E1C502FD8\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A64_Control_Panel = "PhysX_A64_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.3.48.msm = "PhysX_A32_Engines"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C413AED92900524CB29894E1C502FD8\PhysX_A32_Eng_2.7.1.38.msm = "PhysX_A32_Engines"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2408	msiexec.exe
2408	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4104	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4104	msiexec.exe
Token: SeSecurityPrivilege	2408	msiexec.exe
Token: SeCreateTokenPrivilege	4104	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4104	msiexec.exe
Token: SeLockMemoryPrivilege	4104	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4104	msiexec.exe
Token: SeMachineAccountPrivilege	4104	msiexec.exe
Token: SeTcbPrivilege	4104	msiexec.exe
Token: SeSecurityPrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeLoadDriverPrivilege	4104	msiexec.exe
Token: SeSystemProfilePrivilege	4104	msiexec.exe
Token: SeSystemtimePrivilege	4104	msiexec.exe
Token: SeProfSingleProcessPrivilege	4104	msiexec.exe
Token: SeIncBasePriorityPrivilege	4104	msiexec.exe
Token: SeCreatePagefilePrivilege	4104	msiexec.exe
Token: SeCreatePermanentPrivilege	4104	msiexec.exe
Token: SeBackupPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeShutdownPrivilege	4104	msiexec.exe
Token: SeDebugPrivilege	4104	msiexec.exe
Token: SeAuditPrivilege	4104	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4104	msiexec.exe
Token: SeChangeNotifyPrivilege	4104	msiexec.exe
Token: SeRemoteShutdownPrivilege	4104	msiexec.exe
Token: SeUndockPrivilege	4104	msiexec.exe
Token: SeSyncAgentPrivilege	4104	msiexec.exe
Token: SeEnableDelegationPrivilege	4104	msiexec.exe
Token: SeManageVolumePrivilege	4104	msiexec.exe
Token: SeImpersonatePrivilege	4104	msiexec.exe
Token: SeCreateGlobalPrivilege	4104	msiexec.exe
Token: SeCreateTokenPrivilege	4104	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4104	msiexec.exe
Token: SeLockMemoryPrivilege	4104	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4104	msiexec.exe
Token: SeMachineAccountPrivilege	4104	msiexec.exe
Token: SeTcbPrivilege	4104	msiexec.exe
Token: SeSecurityPrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeLoadDriverPrivilege	4104	msiexec.exe
Token: SeSystemProfilePrivilege	4104	msiexec.exe
Token: SeSystemtimePrivilege	4104	msiexec.exe
Token: SeProfSingleProcessPrivilege	4104	msiexec.exe
Token: SeIncBasePriorityPrivilege	4104	msiexec.exe
Token: SeCreatePagefilePrivilege	4104	msiexec.exe
Token: SeCreatePermanentPrivilege	4104	msiexec.exe
Token: SeBackupPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeShutdownPrivilege	4104	msiexec.exe
Token: SeDebugPrivilege	4104	msiexec.exe
Token: SeAuditPrivilege	4104	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4104	msiexec.exe
Token: SeChangeNotifyPrivilege	4104	msiexec.exe
Token: SeRemoteShutdownPrivilege	4104	msiexec.exe
Token: SeUndockPrivilege	4104	msiexec.exe
Token: SeSyncAgentPrivilege	4104	msiexec.exe
Token: SeEnableDelegationPrivilege	4104	msiexec.exe
Token: SeManageVolumePrivilege	4104	msiexec.exe
Token: SeImpersonatePrivilege	4104	msiexec.exe
Token: SeCreateGlobalPrivilege	4104	msiexec.exe
Token: SeCreateTokenPrivilege	4104	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4104	msiexec.exe
Token: SeLockMemoryPrivilege	4104	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4104	msiexec.exe
4104	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4104	msiexec.exe
2408	msiexec.exe
2336	MsiExec.exe
5944	MsiExec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 700	4360	2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe	87
PID 4360 wrote to memory of 4104	4360	2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe	88
PID 2408 wrote to memory of 2336	2408	msiexec.exe	90
PID 2408 wrote to memory of 5944	2408	msiexec.exe	93
PID 2408 wrote to memory of 3800	2408	msiexec.exe	94
PID 2408 wrote to memory of 2524	2408	msiexec.exe	95
PID 700 wrote to memory of 3716	700	EuniKr.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\AppData\Local\Temp\EuniKr.exe
  C:\Users\Admin\AppData\Local\Temp\EuniKr.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\62922e78.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3716
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WISDEA314C409294250BC9298E4C105F28D_9_10_0129.MSI" WISE_SETUP_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4104

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 07199070F1F1ACBBD96B7C7474789641 C
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2336
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 46FD2BCF339B22596EDD9BB829FD9382
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5944
- C:\Windows\Installer\MSI6C30.tmp
  "C:\Windows\Installer\MSI6C30.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3800
- C:\Windows\Installer\MSI6C60.tmp
  "C:\Windows\Installer\MSI6C60.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2524

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5953b5.rbs

Path C:\Config.Msi\e5953b5.rbs
Size 45KB
SHA256 c5f8767efacf6197cc2eb5dac5a7b497d207696219c1c4cfefd2f755e7dd7cae
MD5 39cb845844226afb22f9ec98243251a4
SHA1 e4f119a2ddb711eb4a8842dc19e7478e6e7be9df
SHA512 02708d49b7105138fd26a402c214ab96535857ed6d14270c35b1a7b885c690dc579aab1cfa1550a2229c69ac7a8b030da4f570a180ee444e9e277f32a20fa2af
SSDEEP 768:EotmpRYGY8soENy/Rb4My84xUkhAMhvoLm9gycOhLwnfC:VtmpRYGY8soENy/Rb4My84xUkhAMhvoc
TLSH
T1C523E0A19E1086D2FA429775FB062B453BB3C5F7C714C28B10ACFA966E8478427FD1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WISDEA314C409294250BC9298E4C105F28D_9_10_0129.MSI

Path C:\Program Files (x86)\Common Files\Wise Installation Wizard\WISDEA314C409294250BC9298E4C105F28D_9_10_0129.MSI
Size 25.8MB
SHA256 7b359d7c2f9cfb77c2377885a65a35adce9e526145820261cb9c2f3b001fb8f0
MD5 73d9ffda96faaed83d2a088ffb2534b1
SHA1 3254ac67b00853f2e003423a09d7db5be76c1fcc
SHA512 1bbd390e2fad582b0c1b72a4b1e2ad5307a8db131b0b8f02dcb24a0c2e8835db8266735c6281769f23536690f8b8cb1046900b72d4cd28756bfb307a30b604bd
SSDEEP 786432:KSNESwjGivU44UnZjW9ACajPw0A63ib/DDo9k:NWGR44iK9ACajPBR3ib/Q
TLSH
T1895733953DA1C833E622023120667B947FA66D50B948CF0B7240B8FB3FFA75749A55CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DO_NOT_MANUALLY_DELETE_ANY_SUBFOLDERS.txt

Path C:\Program Files (x86)\NVIDIA Corporation\PhysX\Engine\DO_NOT_MANUALLY_DELETE_ANY_SUBFOLDERS.txt
Size 1B
SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
MD5 7215ee9c7d9dc229d2921a40e899ec5f
SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
MD5 SHA1 SHA512

Submit Download

62922e78.bat

Path C:\Users\Admin\AppData\Local\Temp\62922e78.bat
Size 187B
SHA256 871ca4ec850b4d116351b61eb819fc6f9c68797f64bd412700ced2e7d002e5f8
MD5 94b7f129a80898c8c5b6a5827d8ca216
SHA1 01d3a28c3be7038919bfaf17f00382ff865d7424
SHA512 769f351e7c4a8bb38a2a00191c365ec13659eb1ebd1af25d3c87f7b1885085c8a44528021e598173c8523a1a39b453099bca54aa68435bc70fea4c9b035c9277
TLSH
T1D1C01201E397C6AA1454602B1AE1618DC0670C583B5D6B226B20C4ACA1A640EB5C3702
MD5 SHA1 SHA512 TLSH

Submit Download

EuniKr.exe

Path C:\Users\Admin\AppData\Local\Temp\EuniKr.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4491.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI4491.tmp
Size 22KB
SHA256 0044aac10bf23b3e27ba8c274933fad40e7418944387a745827139913ecdf095
MD5 1368fe994fce9c1ddaf3b01db45bbf79
SHA1 9debc04f4de1dea0e49844b844c5521c230eb3f8
SHA512 856f1bc5e96c7f989394b9259f6b7dad388d3d19f4ce91abd4db5d0becf1eac284a00fed067f2e6f5220db770d8baa5627c7746b8bfc1cc2a16d5d0ee8ce566c
SSDEEP 384:djfJApmLNjn2kkXl8svyPmkH5MelrLj/Qq+TM37aS+QrfCPCd3zmEfw8n:djBfLe86yPmkH5MelrLj/3+87aSFr6Pa
TLSH
T11AA2B185371380B2C58D1DB8B0B75E362FBE8972EC489957CF1EE84A34E5380A957D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI456D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI456D.tmp
Size 126KB
SHA256 871f195e12ebb609e6179756092a5821e78cbf920c5c3c7da9ceb01aca991a78
MD5 48a8123016d261e45ee807c0e238a971
SHA1 d7c8bc1e4d6437697f137cff3eca0e31e49a55cf
SHA512 a03ed081d740160f92f0f46315e3eff6aa7ac1b6ca65c28be595a802b4d32614cc778d57792b0fbc68ec2ce7382bfcee6c4009226cb2b5428c5819d3b6d5828f
SSDEEP 3072:myu9fGpWYQrLobhVxdcLHx/q3hJWp7+SlncB+JGL9zwWl55I:miQrLobTjcly3TWhHcp9zwi5I
TLSH
T112C39E53B3E580F0F99A247D14275F268777A81987748EC367242E19AF203D2BA7D3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI93937.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI93937.LOG
Size 13KB
SHA256 ade522fa76fb01bff80326a7cab7d2d813ee13ffb2cb6719f406ea15ec7c260e
MD5 c41078f2bddb2141ac3619c9d527705c
SHA1 42f9cac8fb9eef706c92e8596e167dd17c23143b
SHA512 c2182bf301be4a9d786b17a0b9880e25864af9a141dcd9240f8da367df1e34f761eb4ad2b8731136797bf8c8bf302d0f5ca4d1b8415a792ff29d824264430f71
SSDEEP 96:WaBMMhMWMZM/MKMbYMWMJMipMBMeMPMfMGM1MTMKrM4M1M1MWMlM30MyMcMSMMdf:kzwmfQ2bCLt+VLdnCdZYKH86BKPKm
TLSH
T1E5528D2B77E82688F6F3DB439B7B09250A777DD69839DA1C26E0800D05B6A01F550BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiseCustomCalla.dll

Path C:\Windows\DEA314C409294250BC9298E4C105F28D.TMP\WiseCustomCalla.dll
Size 196KB
SHA256 1691bd3ed63e2f076c324263cb4f9a8e1abc0f57716d8b70e6115e95c9b0128b
MD5 154e3e1be8a54020ad36c4c0c7f3d126
SHA1 336d77566688eea6b14f45d5f43bc5db94fd63af
SHA512 7d14f6c4b55aef1c4fc2a2f0d8cf7d2df8d68dd9a4ac46049364ab372d6059bd8ff9363b41381142991602c429a872773b7118d656447c4dad56731e9e3e77ec
SSDEEP 3072:bGjus8exg3bsNMel1VfVLK48Fpl4IiDplrNafUw47t+/NDKTCMQ:bGmqg3gMel1VfVLPaAIiDDq/5
TLSH
T1C7147D1132D1C072E2BF127E4866CB6967BB7C609BB6C24B2F90BF9E6D705418F25352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiseData.ini

Path C:\Windows\DEA314C409294250BC9298E4C105F28D.TMP\WiseData.ini
Size 4KB
SHA256 15954bbc12f707402c3d288d4d2e5617b57969124cf3ef7cb0aa864a1d737a89
MD5 f8b61e7e57b449d7c12fc3810e453699
SHA1 27ebfc74a023f8c0c7260e67edbce84fa5ac3a06
SHA512 bf4d30e9f13014c8b60a89f6755156d0bc4efa5ce401dfb91e297fe47026ce4893f1143e030070ca91a7c278561b71f53659da4eeeab38a35aa4a7fa86525006
SSDEEP 48:PL2zShbfnsZn0LfnVZnKnj7vnKYnKkynKHnKcnKh9mNG7ZKvxh7xe2SYTXr7Aitk:PLTIOLNwLg9mNsWxe7YTXvA+JxBNhu
TLSH
T1A89157784445D8E73B22B1CE3B960FC362B5DDC06738339693765541A5EEA3C53C6CA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6C30.tmp

Path C:\Windows\Installer\MSI6C30.tmp
Size 61KB
SHA256 f18a5ab55e7c505cd09dfedca61a22a9281639fe2ae2766a96469ae9977346b5
MD5 ab04eb816c8a3fb76ac88692b23b5117
SHA1 48ac4f4746e3e7a3b7f597ead537fea8505d51ff
SHA512 51da4583f5dae5a28b1f157db2443ace9ff3ecc69bf6d5dd326064ae34461ca2b312af808e56b5ff264f6cea5249c9d53447eaaefe02a3cc585851f962ba8bfd
SSDEEP 768:nD/jqy/1HAdaq6ZDM3yBZhOk+lVhl6PkmEtAf9DeLFbz1:nHrAEq6K6OkBwtWeBZ
TLSH
T15C534A1A3D5FC033E401C67196A1C2C15FBF68033AD62C6FEF940D895DB16A8166AEBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A_Ball_Trans.72AC20DB_37D3_1016_B346_A7FD958F5C39.ico

Path C:\Windows\Installer\{DEA314C4-0929-4250-BC92-98E4C105F28D}\A_Ball_Trans.72AC20DB_37D3_1016_B346_A7FD958F5C39.ico
Size 24KB
SHA256 812dfa2b5e7c1a1f87a5c56d78092d2ab1c520cf3f9a63565497c3b160645d09
MD5 424dcdf91371ab8d0e78f33ec812ed55
SHA1 766b729ee6510ae9788b7d94934b35be9fd69752
SHA512 20a573f344a6e8cad0b648a5368691030cbfee18c541893590d198a692d582b850c72e18e322ac9de24c39e000ea0716b16a82747f1d41b7a8eeb164759d5376
SSDEEP 192:GX/PXJLQcU1asUTlaS3W2fQcJsHfKiI6b0sgEfyIFvf2:KdQA1BhJIcS90shfyIF2
TLSH
T1ECB22E877E09C053F45838B58CD68BB9D7866D858F024A4B3294BB1FFDB79A07F22049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-322-0x0000000000410000-0x0000000000419000-memory.dmp

Download

memory/700-7-0x0000000000410000-0x0000000000419000-memory.dmp

Download

memory/2336-32-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Download

memory/4360-8-0x0000000000407000-0x0000000000408000-memory.dmp

Download

memory/4360-817-0x0000000000400000-0x00000000024B5000-memory.dmp

Download

memory/4360-6-0x0000000000400000-0x00000000024B5000-memory.dmp

Download

memory/5944-47-0x00000000032B0000-0x00000000032E5000-memory.dmp

Download