ce36248529399dd8e642fbbce679424c2b6cae9eb5d05a8ac6f541f719b58214

Analysis

max time kernel
150s
max time network
110s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
Size 1003KB
Sample260711-tb657aev2q
SHA256 ce36248529399dd8e642fbbce679424c2b6cae9eb5d05a8ac6f541f719b58214
MD5 8c7c5a134fcbf93430d73b6b0c81390a
SHA1 e9173755d85eeae4d8070eea4ac85b863d064568
SHA512 d0e238842a0c10ad9a98451e19a8008b3680a86f78dd4b1151e39c8416ab2b0ab1eaa34e229582ca50fb998cf4273f9cdfbe483f397c2fbb720cf33393976235
SSDEEP 24576:PFOaKtW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNg:td4x8xqCGexm8FCspg0iZf1LUXl
TLSH
T1BA25F123AE54C03BD89304F049EDF67AB979AE2117A08CC773546BA969713C379B530B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 7 IoCs

pid	Process
4200	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
2060	Setup.exe
3652	icsys.icn.exe
1692	explorer.exe
1084	spoolsv.exe
5644	svchost.exe
3576	spoolsv.exe

Loads dropped DLL 5 IoCs

pid	Process
2060	Setup.exe
2060	Setup.exe
2060	Setup.exe
2060	Setup.exe
2060	Setup.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
2060	Setup.exe
2060	Setup.exe
2060	Setup.exe
2060	Setup.exe
2060	Setup.exe
2060	Setup.exe
2060	Setup.exe
2060	Setup.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
3652	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1692	explorer.exe
5644	svchost.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
2060	Setup.exe
3652	icsys.icn.exe
3652	icsys.icn.exe
1692	explorer.exe
1692	explorer.exe
1084	spoolsv.exe
1084	spoolsv.exe
5644	svchost.exe
5644	svchost.exe
3576	spoolsv.exe
3576	spoolsv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4200	4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe	88
PID 4200 wrote to memory of 2060	4200	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe	89
PID 4756 wrote to memory of 3652	4756	2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe	90
PID 3652 wrote to memory of 1692	3652	icsys.icn.exe	91
PID 1692 wrote to memory of 1084	1692	explorer.exe	92
PID 1084 wrote to memory of 5644	1084	spoolsv.exe	93
PID 5644 wrote to memory of 3576	5644	svchost.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756
- \??\c:\users\admin\appdata\local\temp\2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
  c:\users\admin\appdata\local\temp\2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\b24fe81928196b51aed72d\Setup.exe
    C:\b24fe81928196b51aed72d\\Setup.exe /x86 /x64 /ia64 /web
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2060
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3652
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1084
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5644
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HFI79BB.tmp.html

Path C:\Users\Admin\AppData\Local\Temp\HFI79BB.tmp.html
Size 16KB
SHA256 b6aa6d7758c0481018810a77ce460ca42d6c8632c801c1c1ccafbabf8838f757
MD5 a4fe019c7115bdf4be928c86ae30b817
SHA1 70d316a6eb293480164249175e151b431ae24761
SHA512 20f54c35bca5694d13ea7bad4c55ae2d3edbcfb48222168f2296222a5b5c7858dfe6ba7ad7e2f3d71c23788d0f2183676a0dbc4d74ae23dfca9b2bc400a27798
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHja:fdsOT01KcBUFJFEWUxFzvH2
TLSH
T13972685326E84248A1B6BE49AFB640750B79BD45AC3CCE7D05A0591E49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 4150a1362a60ffcaf5d198743aeea217b5932163b3cfd35bb12314d51a178095
MD5 93857ea2390fdbf65b3bba282bcc3c6c
SHA1 a2fac971ed45f2ac219d2e75a2c256fc44aabcda
SHA512 d79440c3adfe09c69892c46de4d97a7e09362812bc64eaabd560be196674fd5f4b85715e944bf45ca8cc4605da5724f3dd1fac2d7473629865a55055d02dbf56
SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalPGVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVP:UsLqdufVUNDaAVVVVVVVVVVVVVVVVVV7
TLSH
T151D3E913BE28405ED52189F06C9ADF2DBB612E262B90AD1B7357FB0469B1343B5F530B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 ede1b9bc0c3e831a57c7c542fda26ae61b3df6e5b2b356615235ae069a6ffd88
MD5 494a7fdce85e512dc9af230e3af6bdcf
SHA1 028dc1fcd5a54fda1ac856c9fe7a44daeb16bed7
SHA512 67fd08dbfb25abdaa394907d2b879a1796cd553bab85901d689af083b023d112d49ab55d791f020e3e7857aeb2dbb5034df7eb5effe74b92f178ae0aa3ab0a1f
SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalPXssssssssssssssssssssssssssssssssssssx:UsLqdufVUNDahssssssssssssssssss9
TLSH
T13AD3F823AE14503ED81285F15CEEEB6DB9112E3A2BA59D477366BF5072B620375F020F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 ecb8206ff8e5d4ea01cff60ff820ed2069eeecd93bf904ed22b81f8354711bbd
MD5 e4c03526b36c09532751394461cfcb14
SHA1 145417b083a4840ca570f84990a3ad7ead7ee1bf
SHA512 10327a726ea09b350c3fb52dc81f714bd95bb2760f0342ac08095a97fef2892e5c777c61313d371970dbcff535be29d3ccd8217d1dca6d385598e275b20168de
SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalPdaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaH:UsLqdufVUNDaPaaaaaaaaaaaaaaaaaaz
TLSH
T110D3F713BE24A06ED84185F118AADB6DB9165F392B906D0773E6FF04A971703B1F221F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 899f490810a036e31fd0cd52899e5e31dcad4581304ab54eb13f0e5baa1a52c4
MD5 7d66a4b50899493e7b36558227aef524
SHA1 ff0275a0ebc7c8c65cb535752bbd4455aaff8d70
SHA512 a9d20808c4623a5d1229cf8d8818b34f955844bc36d919e134e685122f3de0915e9b1dfd98f0cca163bc3a25c1d954bc2f63c3a84c560d63bea36d004cf9a436
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVdh:UVqoCl/YgjxEufVU0TbTyDDalPh
TLSH
T17CD30B23BD1C1469D95289F06CAAEB69B9251E2627E4EC0B3763BF1464B234371F131F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1025\LocalizedData.xml
Size 72KB
SHA256 6b67c8a77c1a637b72736595afdf77bdb3910aa9fe48d959775806a0683ffa66
MD5 c5bf74c96a711b3f7004ca6bddecc491
SHA1 4c4d42ff69455f267ce98f1db8f2c5d76a1046da
SHA512 2f2071bf9966bffe64c90263f4b9bd5efcac4f976c4e42fbdeaa5d6a6dee51c33f4902cf5e3d0897e1c841e9182e25c86d42e392887bc3ce3d9ed3d780d96ac9
SSDEEP 384:4w1hDxsSsxGMZzhKtQOsitz0SBijTJ3ejrwddv:PhDxsnxGMdAVBijTJ3eHm
TLSH
T14773F5119EFAF138B0B7EA18ED73C1864AB3795198B5D11D00691D0E4AA3FD18A17FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1028\LocalizedData.xml
Size 59KB
SHA256 0bc010947bff6ec1ce9899623ccfdffd702eee6d2976f28d9e06cc98a79cf542
MD5 967a6d769d849c5ed66d6f46b0b9c5a4
SHA1 c0ff5f094928b2fa8b61e97639c42782e95cc74f
SHA512 219b13f1beeb7d690af9d9c7d98904494c878fbe9904f8cb7501b9bb4f48762f9d07c3440efa0546600ff62636ac34cb4b32e270cf90cb47a9e08f9cb473030c
SSDEEP 384:4wCGbCWB6rFk+2jP8lxtrzh1hsPN7ODPnPgQy50sJCXnofDPiv:tbCWYFrewYTJCf
TLSH
T12953E311AEFB3154F1B6BA15BE7350984DB37E905835C11E00992D4E9BB3FC18A62FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1029\LocalizedData.xml
Size 79KB
SHA256 8a0da440261940ed89bad7cd65bbc941cc56001d9aa94515e346d57b7b0838fc
MD5 0b6ed582eb557573e959e37ebe2fca6a
SHA1 82c19c7eafb28593f453341eca225873fb011d4c
SHA512 aba3d19f408bd74f010ec49b31a2658e0884661d2efda7d999558c90a4589b500570cc80410ba1c323853ca960e7844845729fff708e3a52ea25f597fad90759
SSDEEP 384:4w9jRY/svLov/QvQovOLeyndT/jfB7eyNdT9eTiyn15byYOMbqav8qAMrZEXw/Fm:Wt/jPvoZJZ0z
TLSH
T10083B011ABFA3248F1F7AF05BDB241A54EB77D50A935C10E00592A4E5A73FC18962FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1030\LocalizedData.xml
Size 75KB
SHA256 5f370d2ccdd5fa316bce095bf22670123c09de175b7801d0a77cdb68174ac6b7
MD5 69925e463a6fedce8c8e1b68404502fb
SHA1 76341e490a432a636ed721f0c964fd9026773dd7
SHA512 5f61abec49e1f9cc44c26b83aa5b32c217ebeba63ed90d25836f51f810c59f71ec7430dc5338efba9be720f800204891e5ab9a5f5ec1ff51ef46c629482e5220
SSDEEP 384:4wvo3sGYQTjtLCpCggWuUyl+JMcf/zmSmRLAgRQJmS+e/JAu1O2Xx+v:9o8GYQTjtLCYggWuUMe+e/J8
TLSH
T10F738E11ABFA3218F1F7BB15BDB240944EB7BD91A839D11D00592D4E4AB3FC18A61F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1031\LocalizedData.xml
Size 80KB
SHA256 c48986cdb7fe3401234e0a6540eb394c1201846b5beb1f12f83dc6e14674873a
MD5 8505219c0a8d950ff07dc699d8208309
SHA1 7a557356c57f1fa6d689ea4c411e727438ac46df
SHA512 7bcdad0cb4b478068434f4ebd554474b69562dc83df9a423b54c1701ca3b43c3b92de09ee195a86c0d244aa5ef96c77b1a08e73f1f2918c8ac7019f8df27b419
SSDEEP 1536:guayUbZwf+2CzQHsjz1VbxzPGnz6solo8xKc6JT/1Sy:JayUtwf+2CzQHshPGnz6solo8xKc6JTd
TLSH
T1E1839B11ABFA2208F2F7BF59BE7251844EB37E91A835D10D01582D4E5A73F818A61F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1032\LocalizedData.xml
Size 84KB
SHA256 39efe12c689edfea041613b0e4d6ec78afec8fe38a0e4adc656591ffef8f415d
MD5 3bf8da35b14fbcc564e03f6342bb71f2
SHA1 8f9139f0bb813bf95f8c437548738d32848d8940
SHA512 31b050647ba4bd0c2762d77307e1ed2a324e9b152c06ed496b86ea063cdc18bf2bb1f08d2e9b4af3429a2bc333d7891338d7535487c83495304a5f78776dbc03
SSDEEP 384:4w+7UVysuXHXeXAehlT++sTGoheXrW4MgcyvF773/xSFVQbleaS8tOnjiJLtchH0:+3OQeHll5PunjiJr
TLSH
T12B8316095EFF3214B5F6A9E5AD7380594EBBF9814834C51E20A8384DDA6FF8189C2F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1033\LocalizedData.xml
Size 75KB
SHA256 665797c7840b86379019e5a46227f888fa1a36a593ea41f9170ef018c337b577
MD5 326518603d85acd79a6258886fc85456
SHA1 f1cef14bc4671a132225d22a1385936ad9505348
SHA512 f8a514efd70e81d0f2f983282d69040bca6e42f29aa5df554e6874922a61f112e311ad5d2b719b6ca90012f69965447fb91e8cd4103efb2453ff160a9062e5d3
SSDEEP 384:4w6JjgKW5D8U2JhrDheHQTBNgNSdfUGNatvcc7QDBuGdSJgkR6Sqzxu:gJsKKIrDPT7lSJYI
TLSH
T133738C11ABFE3258F1F7BE14BEB250944EB77D91A839C11D00592D4E4AB3F818A61F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupResources.dll

Path C:\b24fe81928196b51aed72d\1033\SetupResources.dll
Size 16KB
SHA256 36d0159ed1a7d88000737e920375868765c0a1dd6f5a5acbb79cf7d97d9e7a34
MD5 9547d24ac04b4d0d1dbf84f74f54faf7
SHA1 71af6001c931c3de7c98ddc337d89ab133fe48bb
SHA512 8b6048f4185a711567679e2de4789407077ce5bfe72102d3cb1f23051b8d3e6bfd5886c801d85b4e62f467dd12da1c79026a4bc20b17f54c693b2f24e499d40f
SSDEEP 192:byk5nUfwTW7JwWp0eW6jp8M+9HS8bC/TJs7kFkzQKPnEtObMacxc8hjeyveCXZBe:pgoTWp0eWB9ygC/TfFkzLXci2jpv8
TLSH
T17272308167FC8105F6F73F74AEB58AB21E39BD825938C71E2581A19D08A1F80DD74B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1035\LocalizedData.xml
Size 75KB
SHA256 8a68b3b6522c30502202ecb8d16ae160856947254461ac845b39451a3f2db35f
MD5 1aa252256c895b806e4e55f3ea8d5ffb
SHA1 0322ee94c3d5ea26418a2fea3f7e62ec5d04b81d
SHA512 ce57784892c0be55a00ced0adc594a534d8a40819790ca483a29b6cd544c7a75ae4e9bde9b6dc6de489ceceb7883b7c2ea0e98a38fcc96d511157d61c8aa3e63
SSDEEP 1536:wT42CX8ugmmuM92kEMeeGOCOUJPePJiWGICG+JND:wT42CX8ugmmuM92kEMeeGOCOUJPePJi/
TLSH
T1E9739811AAFE6214F1F7AE14BEB251844EB37E916C39D11D01592C4E8AB3FC1CA61F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1036\LocalizedData.xml
Size 81KB
SHA256 9605468d426bcbbe00165339d84804e5eb2547bfe437d640320b7bfef0b399b6
MD5 1dad88faed661db34eef535d36563ee2
SHA1 0525b2f97eddbd26325fddc561bf8a0cda3b0497
SHA512 ccd0bffbf0538152cccd4b081c15079716a5ff9ad04cee8679b7f721441f89eb7c6f8004cff7e1dde9188f5201f573000d0c078474edf124cfa4c619e692d6bc
SSDEEP 384:4wCFpNvOvt1jagJVzRzchryjiTIJz0kbG52bxVv:WvotpaluaIJzaIv
TLSH
T1E283C811ABFE2214F2F7BF05BDB650944EB77D929C35C11D0159288E8E73F808AA5B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1037\LocalizedData.xml
Size 70KB
SHA256 c0ee256567ea26bbd646f019a1d12f3eced20b992718976514afa757adf15dea
MD5 16e6416756c1829238ef1814ebf48ad6
SHA1 c9236906317b3d806f419b7a98598dd21e27ad64
SHA512 aa595ed0b3b1db280f94b29fa0cb9db25441a1ef54355abf760b6b837e8ce8e035537738e666d27dd2a8d295d7517c325a5684e16304887ccb17313ca4290ce6
SSDEEP 384:4wkvJlqaYsxaAzdNhXdQGKbvvGu1kZJNvSX33qLv:OHqaBxaeJN7T
TLSH
T1C36304106EEBB198B5B6FE16BE7340884EB3FE405834E10E005D285D5A6BFC18A5DF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1038\LocalizedData.xml
Size 84KB
SHA256 fcbb619deb2d57b791a78954b0342dbb2fef7ddd711066a0786c8ef669d2b385
MD5 89d4356e0f226e75ca71d48690e8ec15
SHA1 2336caa971527977f47512bc74e88cec3f770c7d
SHA512 fa03d55a4aafe94cbf5c134a65bd809fc86c042bc1b8ffbc9a2a5412eb70a468551c05c44b6ce81f638df43cca599aa1dd6f42f2df3012c8a95a3612df7c821e
SSDEEP 1536:Ji+5JLuNF70SNjPBzuXrXdJHbdi3kC4kL1:Ji+5JLyF70SNjPBzuXrXdJHbdi3kCZZ
TLSH
T1EB83C101ABEE2154F1B7EF457EB245984EB7BD909C39D11E0049294E4AB3FC1CA61FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1040\LocalizedData.xml
Size 78KB
SHA256 80faa30a7592e8278533d3380dcb212e748c190aaeef62136897e09671059b36
MD5 eda1ec689d45c7faa97da4171b1b7493
SHA1 807fe12689c232ebd8364f48744c82ca278ea9e6
SHA512 8385a5de4eb6b38169dd1eb03926bc6d4604545801f13d99cee3acede3d34ec9f9d96b828a23ae6246809dc666e67f77a163979679956297533da40f9365bf2c
SSDEEP 384:4wFACg1fPK/YBZ3tMa9eIzNZNs4fzWmJVo5HnscuRv:/ACgNKjaVLJi2
TLSH
T10C739A11ABFA3218F1F7BF18BE7651984EB77E91A835D01D0059284E4A73FC18A61F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1041\LocalizedData.xml
Size 66KB
SHA256 7570390094c0a199f37b8f83758d09dd2cecd147132c724a810f9330499e0cbf
MD5 64ffa6ff8866a15aff326f11a892bead
SHA1 378201477564507a481ba06ea1bc0620b6254900
SHA512 ea5856617b82d13c9a312cb4f10673dbc4b42d9ac5703ad871e8bdfcc6549e262e61288737ab8ebcf77219d24c0822e7dacf043d1f2d94a97c9b7ec0a5917ef2
SSDEEP 384:4wVzQOXe7GoXHoMIpYnxKJMlvWy0aO8rRnfJGnav:3QOu7GlCnkJMlvWy0aO8rRnfJ5
TLSH
T1AC630201AEFB3118F0B7BA54BE7360944EF7BE509835C05D1059694E9A63FC58B22FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1042\LocalizedData.xml
Size 63KB
SHA256 e3e3a2288ff840ab0e7c5e8f7b4cfb1f26e597fb17cfc581b7728116bd739ed1
MD5 78c16da54542c9ed8fa32fed3efaf10d
SHA1 ad8cfe972c8a418c54230d886e549e00c7e16c40
SHA512 d9d7bb82a1d752a424bf81be3d86abea484acbb63d35c90a8ee628e14cf34a7e8a02f37d2ea82aa2ce2c9aa4e8416a7a6232c632b7655f2033c4aaab208c60bf
SSDEEP 384:4wsx1QzSzXLGKgooDQA0pb5ywW4JSUQvEQzH/dv:egtqpb5yw5Jg
TLSH
T16053D111AEFB3114B1B6BE15BEB351944EB37E909835C10E10592D4E9BB3FC18A62F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1043\LocalizedData.xml
Size 77KB
SHA256 415112ae783a87427c2fadd7b010ade4f1a7c23b27e4b714b7b507c16b572a1c
MD5 6506b4e64ebf6121997fa227e762589f
SHA1 71bc1478c012d9ec57fc56a5266dd325b7801221
SHA512 39024ea9d42352f7c1bd6fefe0574054eceb4059f773cfaeb26c42faada2540ae95fb34718d30ccb6da157d2597f80d12a024461fbd0e8d510431ba6ffa81ec2
SSDEEP 384:4wCsfDNzgDbRiRVqxdYRF405vYtyVB1HaAzTGZUeJvuQFKhlQ5gwJBKQauJf1tSY:jbZKbRyVqb82IB+GlQ5gwJBzauJzkA
TLSH
T199737F11ABFA3218F1F7AF15BEB250944EB77E90A835C15D01592D8E4A73FC08A61F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1044\LocalizedData.xml
Size 77KB
SHA256 516525636b91c16a70aef8d6f6b424dc1ee7f747b8508b396ee88131b2bb0947
MD5 120104fa24709c2a9d8efc84ff0786cd
SHA1 b513fa545efae045864d8527a5ec6b6cebe31bb9
SHA512 1ea8eb2be9d5f4ef6f1f2c0d90cb228a9bb58d7143ccafe77e18ce52ec4aca25dde0ba18430fd4d3d7962d079ccbe7e2552b2c7090361e03c6fdfb7c2b9c7325
SSDEEP 384:4wn2IhI4z6T1sHCqeHveRWUw+KbGpK+9C/E6b2NJBf2OEuv:V9hI4z6T1siqeHveRhAo9CM6b2NJBuOD
TLSH
T1F1738C11ABFA3218F1F7BF14BDB640944EB77D90A835D11D0059294E8A73FC58AA2F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1045\LocalizedData.xml
Size 80KB
SHA256 611b7b7352188adffd6380b9c8a85b8ff97c09a1c293bb7ac0ef5478a0e18ac8
MD5 bdb583c7a48f811be3b0f01fcea40470
SHA1 e8453946a6b926e4f4ae5b02ba1d648daf23e133
SHA512 27b02226f8f86ca4d00789317c79e8ca0089f5b910bed14aa664eeab6be66e98de3bafd7670c895d70ab9c34ece5f05199f3556fddc1b165904e3432a51c008d
SSDEEP 768:lz2ue+xTxXUpUqTvvUOfUs6LArUpFymrqQtr8BAyfO4RkSzXunasvJH2TF0wpYl7:lz2ue+xTxXUpUOvvUOfUs6LqTavdJkUr
TLSH
T1D783C301AFFA2258F1FBAE04BEB250948EB77D51A835C15E10592D4E4A73FC1CA61F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1046\LocalizedData.xml
Size 78KB
SHA256 61d8339e89a9e48f8ae2d929900582bb8373f08d553ec72d5e38a0840b47c8a3
MD5 a03d2063d388fc7a1b4c36d85efa5a1a
SHA1 88bd5e2ff285ee421ccc523f7582e05a8c3323f8
SHA512 3a219f36e57d90ca92e9faec4dfd34841c2c9244da4fe7e1d70608dde7857aa36325bdb46652a42922919f782bb7c97f567e69a9fc51942722b8fd66cd4ecaf0
SSDEEP 384:4wl7DAQput9emRem6cvMOem6QemIAY/YEQTeQoqk7EHd9nKxXq5fKsLaG5m73Rdv:geOeqeCe1CkyJtG07g
TLSH
T197838D11ABFA2214F1F7BE19BEB650944EB37E91AC35C11D0059295E4EB3FC08A61F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1049\LocalizedData.xml
Size 79KB
SHA256 992bf5aeb06aa3701d50c23fa475b4b86d8997383c9f0e3425663cfbd6b8a2a5
MD5 349b52a81342a7afb8842459e537ecc6
SHA1 6268343e82fbbabe7618bd873335a8f9f84ed64d
SHA512 ef4cbd3f7f572a9f146a524cfbc2efbd084e6c70a65b96a42339adc088e3f0524bc202548340969481e7f3df3ac517ac34b200b56a3b9957802abd0efa951c49
SSDEEP 384:4w7iPuXsPXBUhOLGvVVA5/Fpn9zJop9TE+zkX6JS/5cGhj/6v:MP5XyZVrJF
TLSH
T1D583F20BAEFE6214B1B6EA14AE7344D609B77B405A35C18E009F2C5E4677FB16721F83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1053\LocalizedData.xml
Size 75KB
SHA256 1ef312e8be9207466fbfdecee92bfc6c6b7e2da61979b0908eaf575464e7b7a0
MD5 b3b1a89458bec6af82c5386d26639b59
SHA1 d9320b8cc862f40c65668a40670081079b63cea1
SHA512 478ce08619490ed1ecdd8751b5f60da1ee4ac0d08d9a97468c3f595ac4376feca59e9c72dd9c83b00c8d78b298be757c6f24a422b7be8c041f780524844998bf
SSDEEP 384:4w+optBSCVb5v6iMSsCtD7jjktDhHfLSGM3zD0q0Xt//Vvcinnl/06N9mGktJsIO:QqtBSCVb5v69SsuD7jwDkqmGeJsoON
TLSH
T1EE73AC11ABFA3218F1F7AF14BDB240944EB7BD90A835D11D01592D8E4A73FC58A61F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\1055\LocalizedData.xml
Size 75KB
SHA256 45e30569a756d9bcbc5f9dae78bda02751fd25e1c0aee471ce112cb4464a6ee2
MD5 65e771fed28b924942a10452bbbf5c42
SHA1 586921b92d5fb297f35effc2216342dac1ae2355
SHA512 d014a2a96f3a5c487ef1caddd69599dbec15da5ad689d68009f1ca4d5cb694105a7903f508476d6ffec9d81386cb184df6fc428d34f056190cee30715514a8f7
SSDEEP 1536:bM8DL5YHRL87mlQg5IgrbGZzwOS8Frc+iI0jJNJ7rtRpUR:bM8DL5YHRL87mlQg5IgrbGZzwOS8FrcS
TLSH
T13A739311ABEE2215F1F7AF19BEB250944EF77EA1A835C11E00592D4E4A73FC18911FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\2052\LocalizedData.xml
Size 59KB
SHA256 1842f22c6fd4caf6ad217e331b74c6240b19991a82a1a030a6e57b1b8e9fd1ec
MD5 10da125eeabcbb45e0a272688b0e2151
SHA1 6c4124ec8ca2d03b5187ba567c922b6c3e5efc93
SHA512 d968abd74206a280f74bf6947757cca8dd9091b343203e5c2269af2e008d3bb0a17ff600eb961dbf69a93de4960133ade8d606fb9a99402d33b8889f2d0da710
SSDEEP 384:4w7yHdhTgqbbT1HjWZez2jtKgst+7x0x8EM5NnqQivGXU4woZukC7FQKAuXR/4mn:dyjg2z2bXXwoZukC7FQKAuXRgcJf
TLSH
T1A053E311AEFB3154F1BABA14BEB350944EB37E505835C01E10992D4E5BB7FC18A62FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\2070\LocalizedData.xml
Size 78KB
SHA256 a25ee75c78c24c50440ad7de9929c6a6e1cc0629009dc0d01b90cbac177dd404
MD5 7fa9926a4bc678e32e5d676c39f8fb97
SHA1 bba4311dd30261a9b625046f8a6ea215516c9213
SHA512 e06423bc1ea50a566d341dc513828608e9b6611fea81d33fca471a38f6b2b61b556ea07a5dec0830f3e87194975d87f267a5e5e1a2be5e6a86b07c5bb2bddcb6
SSDEEP 384:4wdLPpRgMjLeUueUA48DYeUOqeUd/iboeuXWpFPYOAjw/BdgysR0AmhRod30J0qf:fenekeCeRuXWpFxgJMh230JMaWs
TLSH
T1C0738C11ABFA3218F5F7BE19BEB250944EB77E51AC35C10D0059294E4EB3FC18A61B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\b24fe81928196b51aed72d\3082\LocalizedData.xml
Size 78KB
SHA256 d17c5b638e2a4d43212d21a2052548c8d4909eb6410e30b8a951a292bcdbbedd
MD5 2d54fe70376db0218e8970b28c1c4518
SHA1 83ee9ac93142751f23d5bb858f7264e27ea2eab0
SHA512 20c0fb9a046911bc2d702ab321c3992262ac0f80f33ddda5ec2ccafe9ef07611774223369e0dc7cb91c9cda1cbd65c598a7e1c914d6e6ca4b00205a16411be30
SSDEEP 1536:Xo/yYrDKRqvf+ffl0VMf/mfL94T+7j2JoiZq:Xo/yYrDKRqvf+feVMf/mfL94T+7j2Jrq
TLSH
T1CA737C11ABFA2258F1F7BF15BE7650984EB77E909C39C10D01592D4E4AB3F808A61F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DHTMLHeader.html

Path C:\b24fe81928196b51aed72d\DHTMLHeader.html
Size 15KB
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
TLSH
T1B672765326E84248A1B6BE49AFB640750B79BD45A83CCE7D05A0591F49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ParameterInfo.xml

Path C:\b24fe81928196b51aed72d\ParameterInfo.xml
Size 265KB
SHA256 59e67e4fb46e5490eee63d8b725324f1372720ade7345c74c6138c4a76ea73d9
MD5 7213da83e0f0b8ae4fea44ae1cb7f62b
SHA1 f2e3fcc77a1ad4d042253bd2e0010bcb40b68ed3
SHA512 86186ab0f2cb38e520dd1284042eced157f96874846eb9061be9cf56b84a1cab5901a4879e105a8b04b336bbc43b03f4bdf198d43af868be188602347db829e0
SSDEEP 384:EYSROAGiYNVrkT+8TodTBltw11VTvcL1wCiUj78leRqmH9Hej2iXWKYP4JUaGMLi:EFROYoVQTLTQTDFdhaaot6PcbrIl
TLSH
T1DC446F436BFF1118B1B25A5CAAB684614E77BC52183DC06D51AC2C0DCBF3E52D462BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\b24fe81928196b51aed72d\Setup.exe
Size 76KB
SHA256 d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be
MD5 006f8a615020a4a17f5e63801485df46
SHA1 78c82a80ebf9c8bf0c996dd8bc26087679f77fea
SHA512 c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76
SSDEEP 1536:sYNItbBL5NWiiESc0exWZnqxMQP8ZOs0JD9rHUq:sYNAB9NWTZctc/gBJ9oq
TLSH
T141737E027294C035D859163409BBDAB25E7E7D829BB048CB339877EF5F713C26A39356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupEngine.dll

Path C:\b24fe81928196b51aed72d\SetupEngine.dll
Size 788KB
SHA256 7a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd
MD5 84c1daf5f30ff99895ecab3a55354bcf
SHA1 7e25ba36bcc7deed89f3c9568016ddb3156c9c5a
SHA512 e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3
SSDEEP 24576:GS62nlYAqK/AitUgiuVQk/oifPNJIkjbSTzR8NmsBJj:GS62nlYAltBjPNJIkHST18QsBJ
TLSH
T188053A2267E88135E2FF1372753A676957BAF9A14B30C9CF12815B9E0E356D09C3CB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUi.dll

Path C:\b24fe81928196b51aed72d\SetupUi.dll
Size 288KB
SHA256 11565d97287c01d22ad2e46c78d8a822fa3e6524561d4c02dfc87e8d346c44e7
MD5 eb881e3dddc84b20bd92abcec444455f
SHA1 e2c32b1c86d4f70e39de65e9ebc4f361b24ff4a1
SHA512 5750cec73b36a3f19bfb055f880f3b6498a7ae589017333f6272d26f1c72c6f475a3308826268a098372bbb096b43fbd1e06e93eecc0a81046668228bc179a75
SSDEEP 3072:/LTVUK59JN+C0iy4Ww8oBcPFIOrvHvr8QDZHAAKWiIHT6llN1QkvQZaiionv5y/y:HOoMFrz8ygAKWiiIyKf73w
TLSH
T1575439327BE8C574C4EF1374755EA26841AAF1E21BF0C0CB2B451BAE8E336D15D34A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUi.xsd

Path C:\b24fe81928196b51aed72d\SetupUi.xsd
Size 29KB
SHA256 222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093
MD5 2fadd9e618eff8175f2a6e8b95c0cacc
SHA1 9ab1710a217d15b192188b19467932d947b0a4f8
SHA512 a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca
SSDEEP 768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMC:1wchT+cxcDm
TLSH
T1B6D227C631D1CA0007374831AD223B0DFEE5A57382D83D61B5DCA637BB76AC62967279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplashScreen.bmp

Path C:\b24fe81928196b51aed72d\SplashScreen.bmp
Size 40KB
SHA256 31c13ecfc0eb27f34036fb65cc0e735cd444eec75376eea2642f926ac162dcb3
MD5 0966fcd5a4ab0ddf71f46c01eff3cdd5
SHA1 8f4554f079edad23bcd1096e6501a61cf1f8ec34
SHA512 a9e70a2fb5a9899acf086474d71d0e180e2234c40e68bcadb9bf4fe145774680cb55584b39fe53cc75de445c6bf5741fc9b15b18385cbbe20fc595fe0ff86fce
SSDEEP 384:G1o2kgxmJGEsU3pP28+Qq1ms68/tUqHUlHGwM7bwv3ETbFrS:kkpoapTbimsqHGI
TLSH
T12C0334D0EC3F7FF63B16C824741D855652C608A9A718C862EC25F96074BFB9041EAE7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Strings.xml

Path C:\b24fe81928196b51aed72d\Strings.xml
Size 13KB
SHA256 2a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b
MD5 8a28b474f4849bee7354ba4c74087cea
SHA1 c17514dfc33dd14f57ff8660eb7b75af9b2b37b0
SHA512 a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369
SSDEEP 384:VqZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VqB
TLSH
T1B352834376FB2018B1B23ACA6FFBC1B4CF6675D00976462F0159204B87D7C1B6AA2776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UiInfo.xml

Path C:\b24fe81928196b51aed72d\UiInfo.xml
Size 37KB
SHA256 57a9ccb84cae42e0d8d1a29cfe170ac3f27bdcae829d979cddfd5e757519b159
MD5 8b8b0a935dc591799a0c6d52fdc33460
SHA1 ce2748bd469aad6e90b06d98531084d00611fb89
SHA512 93009b3045939b65a0c1d25e30a07a772bd73dda518529462f9ce1227a311a4d6fd7595f10b4255cc0b352e09c02026e89300a641492f14df908ad256a3c9d76
SSDEEP 768:24UR0d5vssgP7ZgZ/vSguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjY:24UR0d5vsTPuZXQYQLIN/6Fmhvk71sOR
TLSH
T1C20315535BEB0118E2F6AA4C69B304705F5B7A45083AD53C04EC354DEFE7E628DA07AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

print.ico

Path C:\b24fe81928196b51aed72d\graphics\print.ico
Size 1KB
SHA256 ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed
MD5 7e55ddc6d611176e697d01c90a1212cf
SHA1 e2620da05b8e4e2360da579a7be32c1b225deb1b
SHA512 283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e
TLSH
T1CF21CC8173E10968D9898771135997616F8AFE00C1100B9330E3BA0BBC3E3B79453246
MD5 SHA1 SHA512 TLSH

Submit Download

save.ico

Path C:\b24fe81928196b51aed72d\graphics\save.ico
Size 1KB
SHA256 ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5
MD5 7d62e82d960a938c98da02b1d5201bd5
SHA1 194e96b0440bf8631887e5e9d3cc485f8e90fbf5
SHA512 ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67
TLSH
T1F521EF7A71902420D0AA08794693C56516C5FEAAC824089672D93AFF6DF9C523023786
MD5 SHA1 SHA512 TLSH

Submit Download

setup.ico

Path C:\b24fe81928196b51aed72d\graphics\setup.ico
Size 35KB
SHA256 288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f
MD5 3d25d679e0ff0b8c94273dcd8b07049d
SHA1 a517fc5e96bc68a02a44093673ee7e076ad57308
SHA512 3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255
SSDEEP 384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQcho:IMWQ2Bf8qqxMQP8pc4XessTJo
TLSH
T1BCF28D89B250D9E4C89C11318C67CEF61F947D1AED840A4733EABF5F2FB23923125894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warn.ico

Path C:\b24fe81928196b51aed72d\graphics\warn.ico
Size 9KB
SHA256 fe4d06c318701bf0842d4b87d1bad284c553baf7a40987a7451338099d840a11
MD5 b2b1d79591fca103959806a4bf27d036
SHA1 481fd13a0b58299c41b3e705cb085c533038caf5
SHA512 5fe232415a39e0055abb5250b120ccdcd565ab102aa602a3083d4a4705ac6775d45e1ef0c2b787b3252232e9d4673fc3a77aab19ec79a3ff8b13c4d7094530d2
SSDEEP 192:USAk9ODMuYKFfmiMyT4dvsZQl+g8DnPUmXtDV3EgTtc:r9wM7pyEBlcgssmXpVUgJc
TLSH
T13C22C64C3694D368C0941BB04057C7B4C76AAC5197886F425EF5BE8F3C332A919DEAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqmapi.dll

Path C:\b24fe81928196b51aed72d\sqmapi.dll
Size 141KB
SHA256 bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
MD5 3f0363b40376047eff6a9b97d633b750
SHA1 4eaf6650eca5ce931ee771181b04263c536a948b
SHA512 537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8
SSDEEP 3072:uochw/MFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9YSHlN:zDFB47UhXBh2yJ5HcOSSSHZqG
TLSH
T1BAE34C18F7B695F2C56322300E0E72BAEB7DD92C3E99BE872380F6567430580D729756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe

Path \??\c:\users\admin\appdata\local\temp\2026-07-11_8c7c5a134fcbf93430d73b6b0c81390a_amadey_elex_rhadamanthys_smoke-loader_swisyn.exe
Size 868KB
SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
MD5 53406e9988306cbd4537677c5336aba4
SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
TLSH
T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-323-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1692-296-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1692-327-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2060-295-0x00000000037A0000-0x00000000037A1000-memory.dmp

Download

memory/2060-277-0x00000000037A0000-0x00000000037A1000-memory.dmp

Download

memory/3576-322-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3652-324-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4756-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4756-325-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5644-328-0x0000000000400000-0x000000000041F000-memory.dmp

Download