Analysis
- max time kernel
122s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 03:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
29 signatures
150 seconds
General
- Target 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe
- Size 472KB
- Sample260730-d8bsjsbc37
- SHA256 36f6b04de2e49f348f7922e2484c2dd275d5895845d6758761099983c3a76771
- MD5 38e4c77d4b7887ca08cd2666ef42634a
- SHA1 1ce4cfc2183981603aad44320bcdaed9411dfb90
- SHA512 653cd388d98ca986a8b0ecfc7f905e48380d815170c3502b584f7522374b48f9ae95ab77a443725f878c1fec86241891dbc1ced45d3a21e2466c5e967291e4ca
- SSDEEP 6144:PgyLEbWaR5Cch2gg649gxaNWcUkvDDDDoVmkjx2Xym/Raw:YUaWaR5v0ggh9gsWrkgVYi1w
- TLSH T155A4F110FB50D43CF5C681FABBF6DBFE64299F24039421C7A3C8955B17384D26A3668A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Extracted
Family
-
gh0strat
C2
-
127.0.0.1
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Signatures
- Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/4312-48-0x0000000000B30000-0x0000000000B39000-memory.dmp family_bdaejec_backdoor - Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/5864-34-0x0000000010000000-0x0000000010015000-memory.dmp family_gh0strat behavioral2/memory/5864-45-0x0000000000400000-0x0000000000478000-memory.dmp family_gh0strat behavioral2/memory/4380-70-0x0000000000400000-0x0000000000478000-memory.dmp family_gh0strat - Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Detects executables packed with ASPack 3 IoCs
resource yara_rule behavioral2/files/0x000b00000001b834-21.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4312-20-0x0000000000B30000-0x0000000000B39000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4312-48-0x0000000000B30000-0x0000000000B39000-memory.dmp INDICATOR_EXE_Packed_ASPack - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 39 IoCs
resource yara_rule behavioral2/memory/5864-6-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-5-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-7-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-10-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-11-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-13-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-12-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-9-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-8-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-24-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-23-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-25-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-33-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-37-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-40-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-42-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-47-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-50-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-59-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-72-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-73-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-80-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-90-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-94-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-92-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-95-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-97-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-100-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-102-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-105-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-111-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-116-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-120-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-121-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-123-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-124-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-126-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5864-127-0x0000000000920000-0x00000000019AE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/files/0x000100000000002e-136.dat INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 40 IoCs
resource yara_rule behavioral2/memory/5864-6-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-5-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-7-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-10-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-11-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-13-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-12-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-9-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-8-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-24-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-23-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-25-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-33-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-37-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-40-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-42-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-45-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral2/memory/5864-47-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-50-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-59-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/4380-70-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral2/memory/5864-72-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-73-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-80-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-90-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-94-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-92-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-95-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-97-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-100-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-102-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-105-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-111-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-116-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-120-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-121-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-123-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-124-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-126-0x0000000000920000-0x00000000019AE000-memory.dmp UPX behavioral2/memory/5864-127-0x0000000000920000-0x00000000019AE000-memory.dmp UPX -
resource yara_rule behavioral2/files/0x000b00000001b834-21.dat aspack_v212_v242 - Executes dropped EXE 2 IoCs
pid Process 4312 wEVxmJ.exe 4380 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\G: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\J: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\Q: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\T: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\U: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\H: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\I: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\M: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\O: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\R: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\K: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\N: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\P: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\W: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\X: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\Z: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\L: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\S: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\V: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened for modification C:\autorun.inf 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe -
resource yara_rule behavioral2/memory/5864-6-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-5-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-7-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-10-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-11-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-13-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-12-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-9-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-8-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-24-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-23-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-25-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-33-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-37-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-40-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-42-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-47-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-50-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-59-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-72-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-73-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-80-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-90-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-94-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-92-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-95-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-97-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-100-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-102-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-105-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-111-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-116-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-120-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-121-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-123-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-124-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-126-0x0000000000920000-0x00000000019AE000-memory.dmp upx behavioral2/memory/5864-127-0x0000000000920000-0x00000000019AE000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE wEVxmJ.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe wEVxmJ.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe wEVxmJ.exe File opened for modification C:\Program Files\7-Zip\7zG.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE wEVxmJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Windows Defender\MpCmdRun.exe wEVxmJ.exe File opened for modification C:\Program Files\7-Zip\7z.exe wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE wEVxmJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe wEVxmJ.exe File opened for modification C:\Program Files\dotnet\dotnet.exe wEVxmJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE wEVxmJ.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe wEVxmJ.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE wEVxmJ.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe wEVxmJ.exe File opened for modification C:\Program Files\Windows Mail\wab.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE wEVxmJ.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe wEVxmJ.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe wEVxmJ.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe wEVxmJ.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE wEVxmJ.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe wEVxmJ.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1764 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wEVxmJ.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5864 wrote to memory of 1220 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 16 PID 5864 wrote to memory of 3128 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 46 PID 5864 wrote to memory of 3208 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 47 PID 5864 wrote to memory of 3460 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 48 PID 5864 wrote to memory of 4344 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 57 PID 5864 wrote to memory of 4412 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 58 PID 5864 wrote to memory of 4460 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 59 PID 5864 wrote to memory of 4740 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 61 PID 5864 wrote to memory of 5068 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 62 PID 5864 wrote to memory of 5124 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 63 PID 5864 wrote to memory of 5192 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 64 PID 5864 wrote to memory of 5236 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 65 PID 5864 wrote to memory of 3688 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 78 PID 5864 wrote to memory of 5664 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 80 PID 5864 wrote to memory of 5400 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 81 PID 5864 wrote to memory of 1012 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 82 PID 5864 wrote to memory of 4312 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 88 PID 5864 wrote to memory of 1220 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 16 PID 5864 wrote to memory of 3128 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 46 PID 5864 wrote to memory of 3208 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 47 PID 5864 wrote to memory of 3460 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 48 PID 5864 wrote to memory of 4344 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 57 PID 5864 wrote to memory of 4412 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 58 PID 5864 wrote to memory of 4460 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 59 PID 5864 wrote to memory of 4740 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 61 PID 5864 wrote to memory of 5068 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 62 PID 5864 wrote to memory of 5124 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 63 PID 5864 wrote to memory of 5192 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 64 PID 5864 wrote to memory of 5236 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 65 PID 5864 wrote to memory of 3688 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 78 PID 5864 wrote to memory of 5664 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 80 PID 5864 wrote to memory of 5400 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 81 PID 5864 wrote to memory of 1012 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 82 PID 5864 wrote to memory of 4312 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 88 PID 5864 wrote to memory of 4312 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 88 PID 5864 wrote to memory of 4436 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe PID 5864 wrote to memory of 4404 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 89 PID 5864 wrote to memory of 4380 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 90 PID 5864 wrote to memory of 4380 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 90 PID 5864 wrote to memory of 1220 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 16 PID 5864 wrote to memory of 3128 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 46 PID 5864 wrote to memory of 3208 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 47 PID 5864 wrote to memory of 3460 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 48 PID 5864 wrote to memory of 4344 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 57 PID 5864 wrote to memory of 4412 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 58 PID 5864 wrote to memory of 4460 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 59 PID 5864 wrote to memory of 4740 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 61 PID 5864 wrote to memory of 5068 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 62 PID 5864 wrote to memory of 5124 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 63 PID 5864 wrote to memory of 5192 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 64 PID 5864 wrote to memory of 5236 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 65 PID 5864 wrote to memory of 3688 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 78 PID 5864 wrote to memory of 5664 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 80 PID 5864 wrote to memory of 5400 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 81 PID 5864 wrote to memory of 1012 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 82 PID 5864 wrote to memory of 1220 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 16 PID 5864 wrote to memory of 3128 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 46 PID 5864 wrote to memory of 3208 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 47 PID 5864 wrote to memory of 3460 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 48 PID 5864 wrote to memory of 4344 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 57 PID 5864 wrote to memory of 4412 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 58 PID 5864 wrote to memory of 4460 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 59 PID 5864 wrote to memory of 4740 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 61 PID 5864 wrote to memory of 5068 5864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 62 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1220
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3128
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3208
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3460
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4344
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4460
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4740
-
C:\Windows\system32\ctfmon.exe/QuitInfo:000000000000024C;000000000000026C;1⤵PID:5068
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5124
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:5192
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5236
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3688
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\wEVxmJ.exeC:\Users\Admin\AppData\Local\Temp\wEVxmJ.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5b8871d3.bat" "5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1764
-
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:5400
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1012
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exeC:\Users\Admin\AppData\Local\Temp\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4380
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRAM FILES\7-ZIP\Uninstall.exe
- Size 110KB
- SHA256 b4a28c7fdbd4ae815c06b494298e9769cc8a2097de278a748d7fc1b4466a4b2a
- MD5 e7aa2c53a09ee93a6a345d96ec03b165
- SHA1 b447dd447795483dfae1ccecfaa0dcc7a126bc6e
- SHA512 b5f1a18a1fcd084881924bbf505f70bbb6c580883876ac04302b1d8127dc152673d903efd6cc3f70a3aff71320d8a3b59c9933257cd0f6ab65c74644caad6e94
- SSDEEP 3072:aaNVH6GCHK1sYPZeRT3LIOV5LFmu/BERC:aa7Lf1PPZyT7Vzj/BEE
- TLSH T106B301664BA04CE2EFED2236B0FA36E35EFBEC300570B69B87F565CC1471180D56661A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\A4AL14AO\k2[1].rar
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe
- Size 472KB
- SHA256 36f6b04de2e49f348f7922e2484c2dd275d5895845d6758761099983c3a76771
- MD5 38e4c77d4b7887ca08cd2666ef42634a
- SHA1 1ce4cfc2183981603aad44320bcdaed9411dfb90
- SHA512 653cd388d98ca986a8b0ecfc7f905e48380d815170c3502b584f7522374b48f9ae95ab77a443725f878c1fec86241891dbc1ced45d3a21e2466c5e967291e4ca
- SSDEEP 6144:PgyLEbWaR5Cch2gg649gxaNWcUkvDDDDoVmkjx2Xym/Raw:YUaWaR5v0ggh9gsWrkgVYi1w
- TLSH T155A4F110FB50D43CF5C681FABBF6DBFE64299F24039421C7A3C8955B17384D26A3668A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\5b8871d3.bat
- Size 187B
- SHA256 33992ae64143530fb106ef3cf065fa03bdc046cd72fc0d6fdc95199367972413
- MD5 2a680d2b4e0970bc132fbfca83cc4298
- SHA1 11ab580c15f1c79eb87b759c684c994fb5680614
- SHA512 9f134dfdc8eaf3be7d731f3445ad49f369e086ccb0ab63e65af9d59c6929b3a6ad9e17edc889f1158e9f4368201ed4ab3c8bbfd22b398b5e148196d5f411e827
- TLSH T1A5C01242C18AC6991494605716E5718CC0671C593B692B116B31C45C629640EF6C7302
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\6E8B1F71.exe
- Size 1B
- SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
- MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
- SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
- SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\wEVxmJ.exe
- Size 15KB
- SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
- MD5 56b2c3810dba2e939a8bb9fa36d3cf96
- SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
- SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
- SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
- TLSH T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\pyqjsh.exe
- Size 100KB
- SHA256 dcc4890a57b0d807d15b825532f87c0efec4f3efd174f295a9f776e42aeb4544
- MD5 4f599cd354036cff3827c23cc6d4ad49
- SHA1 2a16f2f7e88a3c37e9347a3e89cb4bc8d4068449
- SHA512 5f51750b171d079ca45a40856340b93b456337b3a03b2e36022f609ff2fa8c7c94d8bababc56cad8e396f4974c29454b2277283b852e5f975da64b238e985321
- SSDEEP 1536:HX5g7qqF6W/8wTaqxC4qvhQqCxgqDTpnWAqezQhBa3OGpd:35O6Y8wWqxC4S+XWAqQyaeGp
- TLSH T16AA302D1B77B9A00D752F33F1C9D427893F021A10E94D8B2ADB152DECA289C1C957EB2
- MD5 SHA1 SHA512 SSDEEP TLSH