b7773d2ee6e7a6deff8e5037250094ba441cc8d68fd8bd0e6136606222652aa1

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 05:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.exe
Size 4.1MB
Sample260819-gj3fraztcs
SHA256 b7773d2ee6e7a6deff8e5037250094ba441cc8d68fd8bd0e6136606222652aa1
MD5 465a488013372e885c5fa1bc106cc1c9
SHA1 5a108ddfc3e1d802bda60bc0a2c8eada46a81b18
SHA512 7162ee34a79d75ffe005594621f9db2035b374144f8f046660233492766f38b36a209c707dc1cf6f7d1935e1b293d24a2f899db1a2099789927ed297d090691f
SSDEEP 98304:E4x8xcJVfPruHHuW8eRLAlRUdscUNlT6CuKgh3yhtDe2tMb54Ly8UmK37dF7GN26:FgAVfUHu1eR0ll9Nd69Ka3UD3Ly8HK3g
TLSH
T1501633327CA0C133D863727992DDF6F5557A9AA22B2188C793400BFF5C623C1967EA1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\lsass.exe	2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.exe
File created	C:\Windows\SysWOW64\drivers\lsass.exe	lsass.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmd.pif	lsass.exe

Executes dropped EXE 3 IoCs

pid	Process
1452	lsass.exe
4164	2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.~tmp
4452	Setup.exe

Loads dropped DLL 5 IoCs

pid	Process
4452	Setup.exe
4452	Setup.exe
4452	Setup.exe
4452	Setup.exe
4452	Setup.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	lsass.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.~tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4452	Setup.exe
4452	Setup.exe
4452	Setup.exe
4452	Setup.exe
4452	Setup.exe
4452	Setup.exe
4452	Setup.exe
4452	Setup.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5760	2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.exe
5760	2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.exe
1452	lsass.exe
1452	lsass.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5760 wrote to memory of 1452	5760	2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.exe	89
PID 5760 wrote to memory of 4164	5760	2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.exe	90
PID 4164 wrote to memory of 4452	4164	2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.~tmp	91

C:\Users\Admin\AppData\Local\Temp\2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Windows\SysWOW64\drivers\lsass.exe
  "C:\Windows\system32\drivers\lsass.exe"
  2⤵
  - Drops file in Drivers directory
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1452
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.~tmp
  "C:\Users\Admin\AppData\Local\Temp\2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.~tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\9332d4944f44f572fc1b0edc\Setup.exe
    C:\9332d4944f44f572fc1b0edc\\Setup.exe /x86 /x64 /lcid 1041
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LocalizedData.xml

Path C:\9332d4944f44f572fc1b0edc\1033\LocalizedData.xml
Size 75KB
SHA256 665797c7840b86379019e5a46227f888fa1a36a593ea41f9170ef018c337b577
MD5 326518603d85acd79a6258886fc85456
SHA1 f1cef14bc4671a132225d22a1385936ad9505348
SHA512 f8a514efd70e81d0f2f983282d69040bca6e42f29aa5df554e6874922a61f112e311ad5d2b719b6ca90012f69965447fb91e8cd4103efb2453ff160a9062e5d3
SSDEEP 384:4w6JjgKW5D8U2JhrDheHQTBNgNSdfUGNatvcc7QDBuGdSJgkR6Sqzxu:gJsKKIrDPT7lSJYI
TLSH
T133738C11ABFE3258F1F7BE14BEB250944EB77D91A839C11D00592D4E4AB3F818A61F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\9332d4944f44f572fc1b0edc\1041\LocalizedData.xml
Size 66KB
SHA256 7570390094c0a199f37b8f83758d09dd2cecd147132c724a810f9330499e0cbf
MD5 64ffa6ff8866a15aff326f11a892bead
SHA1 378201477564507a481ba06ea1bc0620b6254900
SHA512 ea5856617b82d13c9a312cb4f10673dbc4b42d9ac5703ad871e8bdfcc6549e262e61288737ab8ebcf77219d24c0822e7dacf043d1f2d94a97c9b7ec0a5917ef2
SSDEEP 384:4wVzQOXe7GoXHoMIpYnxKJMlvWy0aO8rRnfJGnav:3QOu7GlCnkJMlvWy0aO8rRnfJ5
TLSH
T1AC630201AEFB3118F0B7BA54BE7360944EF7BE509835C05D1059694E9A63FC58B22FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupResources.dll

Path C:\9332d4944f44f572fc1b0edc\1041\SetupResources.dll
Size 15KB
SHA256 46b1837ab6c8ee1c064458481c77ad5012091fd7dd4d9272af2dff28cf784373
MD5 d1e36793726664f567aff1ff68735d98
SHA1 d51a3a83dadbf4e1f2f443366ad2004de3acd058
SHA512 dfa4de7004bcbad99ab8b67ead3d77218d9c597b741c6b47755cbd56c90115540c1f5ea1f8a1c31e80d04332ba890bf40c78519f82c220141332a61e72398860
SSDEEP 192:zg0rjUfwtW1+/FuZhS5CSJk/lhAW5kEW1QKPnEtObMacxc8hjeyveCXPzWv:EhC7mS53JkNSW5kEW1LXci2jpvZWv
TLSH
T16F62E9C96A698606F4B50E7082F1E6E23F7CFD4315315A1FAF80E18E1491B889B19B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DHTMLHeader.html

Path C:\9332d4944f44f572fc1b0edc\DHTMLHeader.html
Size 15KB
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
TLSH
T1B672765326E84248A1B6BE49AFB640750B79BD45A83CCE7D05A0591F49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ParameterInfo.xml

Path C:\9332d4944f44f572fc1b0edc\ParameterInfo.xml
Size 146KB
SHA256 f773dbf64a0e86c1ae8fc55598e41ee5c0ec2740662ebd85ec14a8376f60697c
MD5 b2fc6fd114c7c28a9b1bd68cb70d7176
SHA1 55632ad05854b2ed80608bae731d4cb560669c6b
SHA512 2413029091dbfe5f952a01bf75301bd22243f8d53840f4b1b575ac5ebfffa1baf3a158c380033533b0c3b398457f62bc55f132931422f9228aee9cf0abe7aff2
SSDEEP 384:KY05f+HR+4qO0qZOqORqf5VF5RqoK0Ra3wPROqzWRu8KFl:KXOQTvIl
TLSH
T16EE341035BEF1118B6F25A589A7685214E77BC52183EC06D51AC2C0EDFF3D92D422BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\9332d4944f44f572fc1b0edc\Setup.exe
Size 76KB
SHA256 d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be
MD5 006f8a615020a4a17f5e63801485df46
SHA1 78c82a80ebf9c8bf0c996dd8bc26087679f77fea
SHA512 c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76
SSDEEP 1536:sYNItbBL5NWiiESc0exWZnqxMQP8ZOs0JD9rHUq:sYNAB9NWTZctc/gBJ9oq
TLSH
T141737E027294C035D859163409BBDAB25E7E7D829BB048CB339877EF5F713C26A39356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupEngine.dll

Path C:\9332d4944f44f572fc1b0edc\SetupEngine.dll
Size 788KB
SHA256 7a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd
MD5 84c1daf5f30ff99895ecab3a55354bcf
SHA1 7e25ba36bcc7deed89f3c9568016ddb3156c9c5a
SHA512 e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3
SSDEEP 24576:GS62nlYAqK/AitUgiuVQk/oifPNJIkjbSTzR8NmsBJj:GS62nlYAltBjPNJIkHST18QsBJ
TLSH
T188053A2267E88135E2FF1372753A676957BAF9A14B30C9CF12815B9E0E356D09C3CB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUi.dll

Path C:\9332d4944f44f572fc1b0edc\SetupUi.dll
Size 288KB
SHA256 11565d97287c01d22ad2e46c78d8a822fa3e6524561d4c02dfc87e8d346c44e7
MD5 eb881e3dddc84b20bd92abcec444455f
SHA1 e2c32b1c86d4f70e39de65e9ebc4f361b24ff4a1
SHA512 5750cec73b36a3f19bfb055f880f3b6498a7ae589017333f6272d26f1c72c6f475a3308826268a098372bbb096b43fbd1e06e93eecc0a81046668228bc179a75
SSDEEP 3072:/LTVUK59JN+C0iy4Ww8oBcPFIOrvHvr8QDZHAAKWiIHT6llN1QkvQZaiionv5y/y:HOoMFrz8ygAKWiiIyKf73w
TLSH
T1575439327BE8C574C4EF1374755EA26841AAF1E21BF0C0CB2B451BAE8E336D15D34A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUi.xsd

Path C:\9332d4944f44f572fc1b0edc\SetupUi.xsd
Size 29KB
SHA256 222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093
MD5 2fadd9e618eff8175f2a6e8b95c0cacc
SHA1 9ab1710a217d15b192188b19467932d947b0a4f8
SHA512 a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca
SSDEEP 768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMC:1wchT+cxcDm
TLSH
T1B6D227C631D1CA0007374831AD223B0DFEE5A57382D83D61B5DCA637BB76AC62967279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplashScreen.bmp

Path C:\9332d4944f44f572fc1b0edc\SplashScreen.bmp
Size 40KB
SHA256 31c13ecfc0eb27f34036fb65cc0e735cd444eec75376eea2642f926ac162dcb3
MD5 0966fcd5a4ab0ddf71f46c01eff3cdd5
SHA1 8f4554f079edad23bcd1096e6501a61cf1f8ec34
SHA512 a9e70a2fb5a9899acf086474d71d0e180e2234c40e68bcadb9bf4fe145774680cb55584b39fe53cc75de445c6bf5741fc9b15b18385cbbe20fc595fe0ff86fce
SSDEEP 384:G1o2kgxmJGEsU3pP28+Qq1ms68/tUqHUlHGwM7bwv3ETbFrS:kkpoapTbimsqHGI
TLSH
T12C0334D0EC3F7FF63B16C824741D855652C608A9A718C862EC25F96074BFB9041EAE7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Strings.xml

Path C:\9332d4944f44f572fc1b0edc\Strings.xml
Size 13KB
SHA256 2a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b
MD5 8a28b474f4849bee7354ba4c74087cea
SHA1 c17514dfc33dd14f57ff8660eb7b75af9b2b37b0
SHA512 a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369
SSDEEP 384:VqZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VqB
TLSH
T1B352834376FB2018B1B23ACA6FFBC1B4CF6675D00976462F0159204B87D7C1B6AA2776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UiInfo.xml

Path C:\9332d4944f44f572fc1b0edc\UiInfo.xml
Size 38KB
SHA256 44e7de36e58052f79d6168e867c9edee5bd6632d6f7450b55e94b1c666c4789e
MD5 002b52d8a030fb5bc2e35c9d209ecd41
SHA1 c4da0554a913a7a580c724d76ba2b1e13a598970
SHA512 48a73976f797d3f83c722599e42135b550fe1f9479eede180403b2fda1c87da08e9176871f8ff017032a42046ac018eeb60c8e0b2c9fbc9e9f7a2d2f62cfb7da
SSDEEP 768:24UR0d5vssgP7ZgZ/vSguJQvFQXvDINJh6F2h/kD18O0NupnUz9Uu+dO1OUO1OL4:24UR0d5vsTPuZXQYQLIN/6F2h/kD18OJ
TLSH
T1840315535BEB0118E2F7AA4C69B304705F5B7A45083AD13C14EC354DEFE7E6289A07AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

print.ico

Path C:\9332d4944f44f572fc1b0edc\graphics\print.ico
Size 1KB
SHA256 ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed
MD5 7e55ddc6d611176e697d01c90a1212cf
SHA1 e2620da05b8e4e2360da579a7be32c1b225deb1b
SHA512 283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e
TLSH
T1CF21CC8173E10968D9898771135997616F8AFE00C1100B9330E3BA0BBC3E3B79453246
MD5 SHA1 SHA512 TLSH

Submit Download

save.ico

Path C:\9332d4944f44f572fc1b0edc\graphics\save.ico
Size 1KB
SHA256 ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5
MD5 7d62e82d960a938c98da02b1d5201bd5
SHA1 194e96b0440bf8631887e5e9d3cc485f8e90fbf5
SHA512 ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67
TLSH
T1F521EF7A71902420D0AA08794693C56516C5FEAAC824089672D93AFF6DF9C523023786
MD5 SHA1 SHA512 TLSH

Submit Download

setup.ico

Path C:\9332d4944f44f572fc1b0edc\graphics\setup.ico
Size 35KB
SHA256 288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f
MD5 3d25d679e0ff0b8c94273dcd8b07049d
SHA1 a517fc5e96bc68a02a44093673ee7e076ad57308
SHA512 3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255
SSDEEP 384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQcho:IMWQ2Bf8qqxMQP8pc4XessTJo
TLSH
T1BCF28D89B250D9E4C89C11318C67CEF61F947D1AED840A4733EABF5F2FB23923125894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warn.ico

Path C:\9332d4944f44f572fc1b0edc\graphics\warn.ico
Size 9KB
SHA256 fe4d06c318701bf0842d4b87d1bad284c553baf7a40987a7451338099d840a11
MD5 b2b1d79591fca103959806a4bf27d036
SHA1 481fd13a0b58299c41b3e705cb085c533038caf5
SHA512 5fe232415a39e0055abb5250b120ccdcd565ab102aa602a3083d4a4705ac6775d45e1ef0c2b787b3252232e9d4673fc3a77aab19ec79a3ff8b13c4d7094530d2
SSDEEP 192:USAk9ODMuYKFfmiMyT4dvsZQl+g8DnPUmXtDV3EgTtc:r9wM7pyEBlcgssmXpVUgJc
TLSH
T13C22C64C3694D368C0941BB04057C7B4C76AAC5197886F425EF5BE8F3C332A919DEAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqmapi.dll

Path C:\9332d4944f44f572fc1b0edc\sqmapi.dll
Size 141KB
SHA256 bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
MD5 3f0363b40376047eff6a9b97d633b750
SHA1 4eaf6650eca5ce931ee771181b04263c536a948b
SHA512 537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8
SSDEEP 3072:uochw/MFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9YSHlN:zDFB47UhXBh2yJ5HcOSSSHZqG
TLSH
T1BAE34C18F7B695F2C56322300E0E72BAEB7DD92C3E99BE872380F6567430580D729756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.~tmp

Path C:\Users\Admin\AppData\Local\Temp\2026-08-19_465a488013372e885c5fa1bc106cc1c9_amadey_elex_rhadamanthys_smoke-loader_strictor_wannacry.~tmp
Size 4.0MB
SHA256 79e5a22cddc2b6fb68f45196e34b3e0f776f83d764b028f2c2dfb5b3c9180053
MD5 5782dad8ff10e8c130ccd53cf40f4c8f
SHA1 de60e406c386af1e600e99f689399141d1db388d
SHA512 2ade7906af0fdf2e7f9241766e9dc581d9dcd4c1897756392346ef43558549b4229a74cc18a30c23f1cdf636d714f46db9e6eb0b3eba4b40c60960391eb26466
SSDEEP 98304:y4x8xcJVfPruHHuW8eRLAlRUdscUNlT6CuKgh3yhtDe2tMb54Ly8UmK37dF7GN26:LgAVfUHu1eR0ll9Nd69Ka3UD3Ly8HK3g
TLSH
T1EB1633327860C137C8A3727D91DDF5F5557E9AA2272288C7A3400BFF98523C1A67EA1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HFI4ACC.tmp.html

Path C:\Users\Admin\AppData\Local\Temp\HFI4ACC.tmp.html
Size 16KB
SHA256 e1e7d7384f9be1bea95540225d5ff107fbdfc5b13206bc9828125dd779722ed9
MD5 3aff7be8cba07ecfd6fb78393d13f850
SHA1 56d2550342227d147a4c742963d9d44b7996d02d
SHA512 cadb8f70ce100a5ceb62d11ecb3adae1bbd691ec006a6fdf4e2accb5e3cd0a4b7c972ffaca3b24a0ac35999ffd65f4c459e8821e332071ed2c1b527e11def898
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjK:fdsOT01KcBUFJFEWUxFzvHG
TLSH
T1E072775326E84248A1B6BE49AFB600750B79BD45AC3CCE7D01A0591E49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Windows\SysWOW64\Drivers\lsass.exe
Size 32KB
SHA256 c497ea69e53cfffbc4fe5fb47210eaa33ea0af661076449825e7d520942817a5
MD5 e281b96b27ef494ed21823a91d9e221f
SHA1 bcf847a5b4de51140849a557afa3104a8e339596
SHA512 78d4608e2f1418766ea7c3230d48998db670be31793a9331fc5a764f0d7b6dd8eb60ea7700379aeb1720f03b2342d72987d189c0d802feef060198b1c055b903
SSDEEP 384:3brYXRlCzLvoxt1VdwBZsKXMbeC5BnKLWQRF0425UD:3bgjVt17wBaKXMSmRQRC48U
TLSH
T151E2190BBD978E82F518C970871B8BB9D2B316663E6D08CB47802D5E2D375418DAD71C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download