5040b8e2116aea47eeabe9770cd7ab0df0ba6bb98f13c57c766dccd2c1c22569

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
Size 366KB
Sample260719-29dwasft5l
SHA256 5040b8e2116aea47eeabe9770cd7ab0df0ba6bb98f13c57c766dccd2c1c22569
MD5 29c77b617ef558c89a90673cbfe85cd1
SHA1 ba8e2e3c85e9a935920dff4ad1610f39e1484371
SHA512 18f193502ec23e3b0538f99e80deb30975311f2c7b5b82be349c19884b2b2425246d1d25311c9c93f478c5dd4e014ca61b3f2de84ac19a9383752e1be78ab46f
SSDEEP 6144:GXq1gXi3qK1Jb4JeVkWxhuWhI09LzFozyF6DqDz:0CqKcGkW99LzFGyk
TLSH
T1C384C2D2B64CBFF3C0D501B6881EB7B17E357C226F154383B296F71E9A722826627152
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
5672	Logo1_.exe
2212	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files\dotnet\dotnet.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXBCB8.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\RCXC064.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXB1B1.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXB340.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXC13C.tmp	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
File created	C:\Windows\Logo1_.exe	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4436	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe
5672	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 1552	2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe	89
PID 1552 wrote to memory of 3804	1552	net.exe	91
PID 2692 wrote to memory of 4436	2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe	92
PID 2692 wrote to memory of 5672	2692	2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe	94
PID 5672 wrote to memory of 1976	5672	Logo1_.exe	95
PID 1976 wrote to memory of 1108	1976	net.exe	97
PID 5672 wrote to memory of 1076	5672	Logo1_.exe	100
PID 1076 wrote to memory of 3204	1076	net.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21B7.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4436
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1108
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3204

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXBCB8.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXBCB8.tmp
Size 95KB
SHA256 b87379637ac62a7108660e7aca7f3452a97de55668ef78c30a5a2badc7f59213
MD5 ce6c6cd27c1bd10269b7a542db3f180a
SHA1 da24bf1760e937fc7fe25d814a4f84f599bc8e09
SHA512 bd972a444dffbb73f1a3d22f029d05a67867db9dd587c9ec5ec7fe250f27a3414fc9400550db27a97dead1467ed7427118390186af16bec8198297347c4dab47
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxs8m3G5QGPMLmONz:oCSjGoLpWM6VbBgjxsxi3M3Z
TLSH
T1BD933B5AB28CB376D0E295BC8E0FF2E5AD797E201E1D089FB1992F0EED761C1590C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC024.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXC024.tmp
Size 104KB
SHA256 d7c87fc6fe97e1be6def183df232fed8b23716f509374965248f0617683a78a7
MD5 b3b83eea269ef513896a0d9d3b18cab5
SHA1 349db35f77e594f38e8b6aea1ec47724e2b566c6
SHA512 3ba2b02e6a3e5f78b730dd5f75c3c2fe1423648df01c8def62f64fd1e75598dedf08a7b5517d628cad7ee31a756840649e23405a706960c1c7c440af08793c4b
SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxl8m3G5QGPMLM1XkSPsULMHiUONg:ACSjGoLpWM6VbBgjxlxi3MAdtPlLqU+
TLSH
T1F0A36C59B28DF376C0E299BC8E0DF2E5BD257D300F19186BB19E2F0E9A775C2590C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXBE08.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXBE08.tmp
Size 119KB
SHA256 e38bffd3f02fed11a8d13d60e2bd94c56bc5c69be1e643c688cc4531d230ba65
MD5 046ae5a2671377aad83f2d6d9cac9825
SHA1 34dbf3390b9f7b43bbf48a1747f41d205f3335a2
SHA512 0f48b5b084161b189c04326644257b52c543a275912dce09af5a35121549c5d8254ff2b5d15621c296fd5c361c95c27051b4ca1bade5ec51d3475837e8d2c983
SSDEEP 1536:U7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxv8m3G5QGPMLx4GZjzQwK5WW7VCT:NCSjGoLpWM6VbBgjxvxi3Mje5BV0jX
TLSH
T144C3AE59B68CF377C0E299B88E0DF2E4BD797E201E29086FB5992F0DC97B5C1590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC1FC.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXC1FC.tmp
Size 101KB
SHA256 68462fde0faa68afbfb632ecf136c01269960e487a07d454983d324ea8e4574d
MD5 5947f922b69a7b57f6e14af456a9090b
SHA1 9769d71c01f39e785c45a9a948b9036461df98ac
SHA512 9ef66e1dd106886d7f6c8b8e3dff32f75522b2b10233df40731b9ab5906bd085a70b922941b46f4cacf20e2e6957fea9af7b9197e367c7e35fd95047c1022c39
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxC8m3G5QGPMLeqkSZZZ31ONT:gCSjGoLpWM6VbBgjxCxi3M0UA5
TLSH
T16BA36C1AB68CB3B6D0E289789E0DF3E5BD397D301E59186FB29D3F0E9A77182150C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAF33.tmp

Path C:\Program Files\7-Zip\RCXAF33.tmp
Size 92KB
SHA256 42435bbcacc2470e86b9d3d6cbed980c3ca74134e80faaee578b13d3fac1b924
MD5 3420e5a03ac5ef6ef435cb316d143d5b
SHA1 639a00746ed1c60fac71abe3e2b1dc1fa15e2e2a
SHA512 4435e60ba72f9fd57d416384909cb564cd220d03a88757ab7b6400cc056837b64ecc3345cca0185ae0d200ffdde6bd012514c3dd20fb8ecfb5ff4fd99270ca7e
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxM8m3G5QGPMLKONL:wCSjGoLpWM6VbBgjxMxi3Mbx
TLSH
T1A6934C59B29CF376D0E299B88E0DF2E5BD697E301E29085BB19D3F0EDA771C1590C181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB0C1.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXB0C1.tmp
Size 93KB
SHA256 9971dacd382c864bfdc2128c78223d554099d872ba0f68d8ee9b40681d072a83
MD5 9d7c33392e122027ed23ffee4c6ce0e8
SHA1 e56a9fd2975b3d12e7dbb5b8dfa264bbbe438de3
SHA512 66999a3d15f58a040630ddfa792e662d1385e6cbc2353454ad2eb40690d371de1afbbc8303bf9a057e6842fbaea0e545fc43d5a4017d185c7f34bd9c58029313
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxc8m3G5QGPML0ON7:YCSjGoLpWM6VbBgjxcxi3MRh
TLSH
T1C0935C5AB28CB376C0E259B88E0DF2E5BD797E301F19086BB1AE3F1D99771C1590C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe.Exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
Size 4.3MB
SHA256 d9f5d917e132e914d3ca0f6746fde2160badac289e5be56a7622de3c495de7c2
MD5 12af00e68e02854b724a3dec41bed52a
SHA1 dd106ab27a5aa3a408472bf7ce633fba2d3ea294
SHA512 713e455f50aaa052c061d2606f31676862a86f2613d9a94c2aff4a0b5272f4ba6f0e71d5fcae453d61b5aba891e8418280769d802dc3a85779b6a628a8f3019c
SSDEEP 49152:wQQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tf:tQvGAdlCEL8c/bRNw5CO
TLSH
T144263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB3F2.tmp

Path C:\Program Files\Mozilla Firefox\RCXB3F2.tmp
Size 92KB
SHA256 5d7fce6492c8ac83b77ace5f18c26765e119008b7f0909e5b949b156b3c12886
MD5 2fed6356418b9ed703f006b8b8fe9a01
SHA1 96991d7d29b080620f71a4add7b38d80fe896c85
SHA512 efc142ed0cbf493f0a5ee6e96e394edf3992f0a3d72a6d19cec51141b3ab7a83733012f36486c01af01745e3cdd773a8c4df857e1bf789a70846e04e2e8e688a
SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx88m3G5QGPMLPON7:4CSjGoLpWM6VbBgjx8xi3MKh
TLSH
T198935D59B28CB376C0E2A9B88E0DF2E5BD697E301F19085BB1DE2F0DD97B1C15A0C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC682.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXC682.tmp
Size 93KB
SHA256 cc9fa544fefa1656f775be2d9b0816e93c99b1c942053da2ee633935d8855d0a
MD5 dd7fc303fd9c129dafc3c9e45c204750
SHA1 8bfa0f4d1091ecd7180f2bc25c4ab21f53cec87f
SHA512 c265e63ac6ad9b045bf74d1e1f5786ff574ac5d06a12ce3818d9fbac6b86c6c77c6284a77f761667a567fe7354e9af33da4d6497445b63804961e4b2f9872c48
SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx08m3G5QGPMLCEONz:ACSjGoLpWM6VbBgjx0xi3MW1Z
TLSH
T133935C16F28CB376C0E299B88E0DF2E5BD797E305E29186BB19D2F0D9E771C2590C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a21B7.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a21B7.bat
Size 734B
SHA256 f1de62ce1d20336b032983709c8f75c70e8eb61f4abbbd431837aa9a592a5079
MD5 5411a442e4febe0283fff285bba56d08
SHA1 c52f5378d23f64650e8ef8588653ab428b7134be
SHA512 bde49e8481876b53a477535aae4ae462874ff18e397fd48745af377e9f4bc55f55cee9679e861bd7e37bf71204146a6653d599effac07c14e51ac13053f54db5
TLSH
T1B901F71051AEEE2A084C5027C77EE9CCC6723975E6C637907770B64506EE80AFCEB231
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-19_29c77b617ef558c89a90673cbfe85cd1_elex_rhadamanthys_stop.exe.exe
Size 273KB
SHA256 f3b9e1824d7eb47b580ceec511e25447b3de9f80baf83502b57c85681ed483b3
MD5 c84048a0027184e0ef0477d2d2bcbe1f
SHA1 8c5a8b19c78a3c436c2353e05f4807c34736b4cd
SHA512 d25812f6dcbc018d94cc65642f0a74e985c50f6d4d83374d96c4b0c0b3e06496f974c3a243e7b52d2a20c906b1fb2401d574157030f9cdc89e8ce7d8ef616a12
SSDEEP 3072:lV+Ws1Jb4D9PGhVkoBNnvbmCuWhI0qLkLzFozTtIycF6I6qD1r+qv:3K1Jb4JeVkWxhuWhI09LzFozyF6DqDz
TLSH
T14A54F5D2B654CDE3C44902B3885AD7B13A35BC23AF114383B297F35E9FB13926627652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 de7dc2be50b8a854f4eed8403a3e070f374fc0fac896e63f7a31948cf71f71d1
MD5 6b06a3cdb24e1d286d9c9d2586049a55
SHA1 1f8b1b52b4cdc3fe49c49c12f908e9d2b66e6f1e
SHA512 ac9c296b7b12cde5386b4bfc3a8f8f94dfeee48b3703b54408379338cdebc89c42064115de71c5426774deec334ded0f8d8ad2692720eb1b624b709c371314c9
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxf8m3G5QGPMLwONz:wCSjGoLpWM6VbBgjxfxi3MFp
TLSH
T14F934C5AB29CB376D0E299BC8E0DF2E5BD697E301F29086BB19D2F0DDA771C1590C181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2212-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2692-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5672-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5672-1018-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5672-1259-0x0000000000400000-0x0000000000429000-memory.dmp

Download