c862fc3be8654b31593b31093a1cee32fecd07714384dec48640c34ce6d0be24

Analysis

max time kernel
36s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 403KB
Sample261002-k9v15sts2m
SHA256 c862fc3be8654b31593b31093a1cee32fecd07714384dec48640c34ce6d0be24
MD5 8cc98375e60462d4c40860a4417af53b
SHA1 507c58c140a67fa470a23a4d8e828251af8c71c7
SHA512 02bd9e1efbf6204be0e8df98b4f47f4634a3925b44de7e36c1355258219f4d390bee80f8c08f999ff99375948a9993285c3cd3f0033ea1d86756be814ba3a79d
SSDEEP 12288:N7BJKMcEZp9TOjXVHGbKaW60b7eX8vEu4yxaY/j5:NbZXTOjXMbVmy8vEwxaY/j5
TLSH
T14D941292B981F0B2CCB55879890ED29805ACFD716A77E94272813BFF3F311916D352E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 defense_evasion discovery execution persistence trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	CacheMgr.exe

Detects Reflective DLL injection artifacts 3 IoCs

resource	yara_rule
behavioral2/memory/5232-63-0x0000000004890000-0x00000000048A6000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/5232-101-0x0000000004890000-0x00000000048A6000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/3104-115-0x0000000000CC0000-0x0000000000CD6000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects executables packed with ASPack 24 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b857-21.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1036-24-0x00000000007E0000-0x0000000000829000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1036-23-0x00000000007E0000-0x0000000000829000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1036-19-0x00000000007E0000-0x0000000000829000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c55e-36.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3816-38-0x00000000753C0000-0x0000000075409000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3816-40-0x00000000753C0000-0x0000000075409000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3816-39-0x00000000753C0000-0x0000000075409000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1036-60-0x00000000007E0000-0x0000000000829000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4376-59-0x00000000753C0000-0x0000000075409000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4376-57-0x00000000753C0000-0x0000000075409000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4376-56-0x00000000753C0000-0x0000000075409000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4376-55-0x00000000753C0000-0x0000000075409000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5276-100-0x0000000000170000-0x00000000001B9000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5276-103-0x0000000000170000-0x00000000001B9000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5276-102-0x0000000000170000-0x00000000001B9000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3440-112-0x0000000075520000-0x0000000075569000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3440-111-0x0000000075520000-0x0000000075569000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3440-113-0x0000000075520000-0x0000000075569000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2036-119-0x0000000075490000-0x00000000754D9000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2036-120-0x0000000075490000-0x00000000754D9000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2036-121-0x0000000075490000-0x00000000754D9000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5276-123-0x0000000000170000-0x00000000001B9000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2036-125-0x0000000075490000-0x00000000754D9000-memory.dmp	INDICATOR_EXE_Packed_ASPack

UPX dump on OEP (original entry point) 16 IoCs

resource	yara_rule
behavioral2/memory/5232-1-0x0000000000BB0000-0x0000000001BD6000-memory.dmp	UPX
behavioral2/memory/5232-12-0x0000000000BB0000-0x0000000001BD6000-memory.dmp	UPX
behavioral2/memory/5232-6-0x0000000000BB0000-0x0000000001BD6000-memory.dmp	UPX
behavioral2/memory/5232-11-0x0000000000BB0000-0x0000000001BD6000-memory.dmp	UPX
behavioral2/memory/5232-14-0x0000000000BB0000-0x0000000001BD6000-memory.dmp	UPX
behavioral2/memory/5232-76-0x0000000000BB0000-0x0000000001BD6000-memory.dmp	UPX
behavioral2/memory/5232-96-0x0000000000400000-0x000000000046F000-memory.dmp	UPX
behavioral2/memory/3104-126-0x0000000003350000-0x0000000004376000-memory.dmp	UPX
behavioral2/memory/3104-128-0x0000000003350000-0x0000000004376000-memory.dmp	UPX
behavioral2/memory/3104-130-0x0000000003350000-0x0000000004376000-memory.dmp	UPX
behavioral2/memory/3104-138-0x0000000003350000-0x0000000004376000-memory.dmp	UPX
behavioral2/memory/3104-140-0x0000000003350000-0x0000000004376000-memory.dmp	UPX
behavioral2/memory/3104-153-0x0000000003350000-0x0000000004376000-memory.dmp	UPX
behavioral2/memory/3104-154-0x0000000003350000-0x0000000004376000-memory.dmp	UPX
behavioral2/memory/3104-174-0x0000000003350000-0x0000000004376000-memory.dmp	UPX
behavioral2/memory/3104-203-0x0000000000400000-0x000000000046F000-memory.dmp	UPX

Server Software Component: Terminal Services DLL 1 TTPs 5 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	58184835.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	58184835.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	58184835.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	58184835.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	58184835.exe

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000600000001b857-21.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c55e-36.dat	aspack_v212_v242

Executes dropped EXE 3 IoCs

pid	Process
1036	58184835.exe
3104	CacheMgr.exe
5276	58184835.exe

Loads dropped DLL 4 IoCs

pid	Process
3816	Svchost.exe
4376	Svchost.exe
3440	Svchost.exe
2036	Svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\StubPath = "\"C:\\ProgramData\\CacheMgr.exe\" -as"	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	CacheMgr.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
\??\F:\	CacheMgr.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\00ED08F0.tmp	58184835.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	58184835.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	58184835.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	58184835.exe
File opened for modification	C:\Windows\SysWOW64\768108F0.tmp	58184835.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	58184835.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	58184835.exe

UPX packed file 38 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5232-1-0x0000000000BB0000-0x0000000001BD6000-memory.dmp	upx
behavioral2/memory/5232-12-0x0000000000BB0000-0x0000000001BD6000-memory.dmp	upx
behavioral2/memory/5232-6-0x0000000000BB0000-0x0000000001BD6000-memory.dmp	upx
behavioral2/memory/5232-11-0x0000000000BB0000-0x0000000001BD6000-memory.dmp	upx
behavioral2/memory/5232-14-0x0000000000BB0000-0x0000000001BD6000-memory.dmp	upx
behavioral2/files/0x000600000001b857-21.dat	upx
behavioral2/memory/1036-24-0x00000000007E0000-0x0000000000829000-memory.dmp	upx
behavioral2/memory/1036-23-0x00000000007E0000-0x0000000000829000-memory.dmp	upx
behavioral2/memory/1036-19-0x00000000007E0000-0x0000000000829000-memory.dmp	upx
behavioral2/files/0x000d00000001c55e-36.dat	upx
behavioral2/memory/3816-38-0x00000000753C0000-0x0000000075409000-memory.dmp	upx
behavioral2/memory/3816-40-0x00000000753C0000-0x0000000075409000-memory.dmp	upx
behavioral2/memory/3816-39-0x00000000753C0000-0x0000000075409000-memory.dmp	upx
behavioral2/memory/1036-60-0x00000000007E0000-0x0000000000829000-memory.dmp	upx
behavioral2/memory/4376-59-0x00000000753C0000-0x0000000075409000-memory.dmp	upx
behavioral2/memory/4376-57-0x00000000753C0000-0x0000000075409000-memory.dmp	upx
behavioral2/memory/4376-56-0x00000000753C0000-0x0000000075409000-memory.dmp	upx
behavioral2/memory/4376-55-0x00000000753C0000-0x0000000075409000-memory.dmp	upx
behavioral2/memory/5232-76-0x0000000000BB0000-0x0000000001BD6000-memory.dmp	upx
behavioral2/memory/5276-100-0x0000000000170000-0x00000000001B9000-memory.dmp	upx
behavioral2/memory/5276-103-0x0000000000170000-0x00000000001B9000-memory.dmp	upx
behavioral2/memory/5276-102-0x0000000000170000-0x00000000001B9000-memory.dmp	upx
behavioral2/memory/3440-112-0x0000000075520000-0x0000000075569000-memory.dmp	upx
behavioral2/memory/3440-111-0x0000000075520000-0x0000000075569000-memory.dmp	upx
behavioral2/memory/3440-113-0x0000000075520000-0x0000000075569000-memory.dmp	upx
behavioral2/memory/2036-119-0x0000000075490000-0x00000000754D9000-memory.dmp	upx
behavioral2/memory/2036-120-0x0000000075490000-0x00000000754D9000-memory.dmp	upx
behavioral2/memory/2036-121-0x0000000075490000-0x00000000754D9000-memory.dmp	upx
behavioral2/memory/5276-123-0x0000000000170000-0x00000000001B9000-memory.dmp	upx
behavioral2/memory/2036-125-0x0000000075490000-0x00000000754D9000-memory.dmp	upx
behavioral2/memory/3104-126-0x0000000003350000-0x0000000004376000-memory.dmp	upx
behavioral2/memory/3104-128-0x0000000003350000-0x0000000004376000-memory.dmp	upx
behavioral2/memory/3104-130-0x0000000003350000-0x0000000004376000-memory.dmp	upx
behavioral2/memory/3104-138-0x0000000003350000-0x0000000004376000-memory.dmp	upx
behavioral2/memory/3104-140-0x0000000003350000-0x0000000004376000-memory.dmp	upx
behavioral2/memory/3104-153-0x0000000003350000-0x0000000004376000-memory.dmp	upx
behavioral2/memory/3104-154-0x0000000003350000-0x0000000004376000-memory.dmp	upx
behavioral2/memory/3104-174-0x0000000003350000-0x0000000004376000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	CacheMgr.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58184835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CacheMgr.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1036	58184835.exe
1036	58184835.exe
5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5276	58184835.exe
5276	58184835.exe
3104	CacheMgr.exe
3104	CacheMgr.exe
3104	CacheMgr.exe
3104	CacheMgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5232 wrote to memory of 1164	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	16
PID 5232 wrote to memory of 3132	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	47
PID 5232 wrote to memory of 3212	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	48
PID 5232 wrote to memory of 3484	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	50
PID 5232 wrote to memory of 3296	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	57
PID 5232 wrote to memory of 4368	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	59
PID 5232 wrote to memory of 4440	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	60
PID 5232 wrote to memory of 4484	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	61
PID 5232 wrote to memory of 4752	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	63
PID 5232 wrote to memory of 5316	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	64
PID 5232 wrote to memory of 5428	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	65
PID 5232 wrote to memory of 5852	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	69
PID 5232 wrote to memory of 2320	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	79
PID 5232 wrote to memory of 2288	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	80
PID 5232 wrote to memory of 4868	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	81
PID 5232 wrote to memory of 1036	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 5232 wrote to memory of 5860	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	82
PID 5232 wrote to memory of 4204	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	83
PID 5232 wrote to memory of 2816	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	94
PID 5232 wrote to memory of 1164	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	16
PID 5232 wrote to memory of 3132	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	47
PID 5232 wrote to memory of 3212	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	48
PID 5232 wrote to memory of 3484	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	50
PID 5232 wrote to memory of 3296	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	57
PID 5232 wrote to memory of 4368	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	59
PID 5232 wrote to memory of 4440	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	60
PID 5232 wrote to memory of 4484	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	61
PID 5232 wrote to memory of 4752	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	63
PID 5232 wrote to memory of 5316	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	64
PID 5232 wrote to memory of 5428	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	65
PID 5232 wrote to memory of 5852	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	69
PID 5232 wrote to memory of 2320	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	79
PID 5232 wrote to memory of 2288	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	80
PID 5232 wrote to memory of 4868	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	81
PID 5232 wrote to memory of 5860	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	82
PID 5232 wrote to memory of 4204	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	83
PID 5232 wrote to memory of 3104	5232	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	96
PID 3104 wrote to memory of 5276	3104	CacheMgr.exe	97
PID 3104 wrote to memory of 1164	3104	CacheMgr.exe	16
PID 3104 wrote to memory of 3132	3104	CacheMgr.exe	47
PID 3104 wrote to memory of 3212	3104	CacheMgr.exe	48
PID 3104 wrote to memory of 3484	3104	CacheMgr.exe	50
PID 3104 wrote to memory of 3296	3104	CacheMgr.exe	57
PID 3104 wrote to memory of 4368	3104	CacheMgr.exe	59
PID 3104 wrote to memory of 4440	3104	CacheMgr.exe	60
PID 3104 wrote to memory of 4484	3104	CacheMgr.exe	61
PID 3104 wrote to memory of 4752	3104	CacheMgr.exe	63
PID 3104 wrote to memory of 5316	3104	CacheMgr.exe	64
PID 3104 wrote to memory of 5428	3104	CacheMgr.exe	65
PID 3104 wrote to memory of 5852	3104	CacheMgr.exe	69
PID 3104 wrote to memory of 2320	3104	CacheMgr.exe	79
PID 3104 wrote to memory of 2288	3104	CacheMgr.exe	80
PID 3104 wrote to memory of 4868	3104	CacheMgr.exe	81
PID 3104 wrote to memory of 5860	3104	CacheMgr.exe	82
PID 3104 wrote to memory of 4204	3104	CacheMgr.exe	83
PID 3104 wrote to memory of 1164	3104	CacheMgr.exe	16
PID 3104 wrote to memory of 3132	3104	CacheMgr.exe	47
PID 3104 wrote to memory of 3212	3104	CacheMgr.exe	48
PID 3104 wrote to memory of 3484	3104	CacheMgr.exe	50
PID 3104 wrote to memory of 3296	3104	CacheMgr.exe	57
PID 3104 wrote to memory of 4368	3104	CacheMgr.exe	59
PID 3104 wrote to memory of 4440	3104	CacheMgr.exe	60
PID 3104 wrote to memory of 4484	3104	CacheMgr.exe	61
PID 3104 wrote to memory of 4752	3104	CacheMgr.exe	63

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	CacheMgr.exe

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3212

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3296

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4484

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4752

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5316

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5428

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000268;000000000000026C;
1⤵
PID:5852

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2320
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - UAC bypass
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:5232
  - - C:\58184835.exe
      C:\58184835.exe
      4⤵
      Server Software Component: Terminal Services DLL
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1036
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\2026-10-01_8cc98375e60462d4c40860a4417af53b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe" "C:\ProgramData\CacheMgr.exe"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2816
  - - C:\ProgramData\CacheMgr.exe
      "C:\ProgramData\CacheMgr.exe" -as
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Enumerates connected drives
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3104
    - - C:\58184835.exe
        
        C:\58184835.exe
        5⤵
        Server Software Component: Terminal Services DLL
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5276

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:4868

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5860

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:4204

C:\Windows\SysWOW64\Svchost.exe
C:\Windows\SysWOW64\Svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3816

C:\Windows\System32\svchost.exe
C:\Windows\System32\Svchost.exe -k netsvcs
1⤵
PID:4288

C:\Windows\SysWOW64\Svchost.exe
C:\Windows\SysWOW64\Svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4376

C:\Windows\SysWOW64\Svchost.exe
C:\Windows\SysWOW64\Svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3440

C:\Windows\SysWOW64\Svchost.exe
C:\Windows\SysWOW64\Svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

58184835.exe

Path C:\58184835.exe
Size 226KB
SHA256 7d39afce4f0c0e439cb10d7b0913032cfbbc9c461e568220722e74c1f0886455
MD5 b89a8b5b672cc9470e058f8028d70316
SHA1 3fc47d2bcdd3cd3eff279a4bd457d0c3cc58d627
SHA512 88d2c3868dfaaf71d4d78717f25b7c748bb57e6a76e48a4a2c4112e719ebd891f5dc4f07e040b67c5b3ae03a725abef3e1a8aee8e728b29715f09876535876aa
SSDEEP 6144:Xp9TOq9OrVXl7HWrE+icB8aa36OCwb7eEk8vEE+MzU3:Xp9TOjXVHGbKaW60b7eX8vE
TLSH
T1F93422EDC55DE0F7CBDE747D192EE74808B4F5BA2927891851C0ABEFF81A1207A81630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CacheMgr.exe

Path C:\ProgramData\CacheMgr.exe
Size 403KB
SHA256 c862fc3be8654b31593b31093a1cee32fecd07714384dec48640c34ce6d0be24
MD5 8cc98375e60462d4c40860a4417af53b
SHA1 507c58c140a67fa470a23a4d8e828251af8c71c7
SHA512 02bd9e1efbf6204be0e8df98b4f47f4634a3925b44de7e36c1355258219f4d390bee80f8c08f999ff99375948a9993285c3cd3f0033ea1d86756be814ba3a79d
SSDEEP 12288:N7BJKMcEZp9TOjXVHGbKaW60b7eX8vEu4yxaY/j5:NbZXTOjXMbVmy8vEwxaY/j5
TLSH
T14D941292B981F0B2CCB55879890ED29805ACFD716A77E94272813BFF3F311916D352E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Infotmp.txt

Path C:\Users\Infotmp.txt
Size 724B
SHA256 5f73f5ebe22cb76dca040d7c5f9854fc6a61bec3d8f6c466cd220ac6b1ae94d5
MD5 b17760dcf9d16f985730fb89d587c1f1
SHA1 452690634d1cb48204d374c90d06488703937a40
SHA512 1181c95a06bd68b50d0be78f43356989636af217647d430e635247a1a9e3b43a87e0c7c171a1f03cd7f426e2d19fe1a5f05d11d9f43236849cec34eb2b580d89
TLSH
T124019B0089859E5ED006113D0D56624CB1316914168E570386124705148C5945540643
MD5 SHA1 SHA512 TLSH

Submit Download

SYSTEM.INI

Path C:\Windows\SYSTEM.INI
Size 258B
SHA256 68951ac2fd86e6c6e8c34dcb1b18e26f876d6929f7a5962165ba75bc74a2103d
MD5 d1c169680527754e588fdfb29ec53b1e
SHA1 41fecc03d61369867e83d0337d0417fddced666a
SHA512 1a1a97a4b502ac1108fb1730a0e3b6ab0385afe101b9a6dfedc954eab975db48031e96be403046d1e21c136769dc5538d770dbb5d79aa6ba6a56371d3d01be4f
TLSH
T18ED05E0E4FDD11ADE082002E3178D4C272399F11D8320F5C9039674164687D9BF7E2AE
MD5 SHA1 SHA512 TLSH

Submit Download

fastuserswitchingcompatibility.dll

Path \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll
Size 226KB
SHA256 a275eb81fd5d5634f66b07a18b7929c23fc7ba48ebe134272664b13f0e828c9c
MD5 24c3b2b23542e55178241879b6176c30
SHA1 2dd3f93dc322cc46b824ecc65266a848bc5ea441
SHA512 2d4b433bc4c0602715e6c6d5fd9aaeb25c9e2892ac5780ffc47810f6df9fa228d0f46d6f1647bf8ab4df6e0371f5e08ff7d2b8b42fe67f7ec7a164be223b2062
SSDEEP 6144:3p9TOq9OrVXl7HWrE+icB8aa36OCwb7eEk8vEE+MzU3:3p9TOjXVHGbKaW60b7eX8vE
TLSH
T1443422EDC55DE0F7CBDE747D192EE74808B4F5BA2927891851C0ABEFF81A1207A81630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-25-0x0000000000827000-0x0000000000828000-memory.dmp

Download

memory/1036-60-0x00000000007E0000-0x0000000000829000-memory.dmp

Download

memory/1036-19-0x00000000007E0000-0x0000000000829000-memory.dmp

Download

memory/1036-24-0x00000000007E0000-0x0000000000829000-memory.dmp

Download

memory/1036-23-0x00000000007E0000-0x0000000000829000-memory.dmp

Download

memory/2036-121-0x0000000075490000-0x00000000754D9000-memory.dmp

Download

memory/2036-119-0x0000000075490000-0x00000000754D9000-memory.dmp

Download

memory/2036-125-0x0000000075490000-0x00000000754D9000-memory.dmp

Download

memory/2036-120-0x0000000075490000-0x00000000754D9000-memory.dmp

Download

memory/3104-140-0x0000000003350000-0x0000000004376000-memory.dmp

Download

memory/3104-136-0x0000000002670000-0x0000000002671000-memory.dmp

Download

memory/3104-128-0x0000000003350000-0x0000000004376000-memory.dmp

Download

memory/3104-130-0x0000000003350000-0x0000000004376000-memory.dmp

Download

memory/3104-153-0x0000000003350000-0x0000000004376000-memory.dmp

Download

memory/3104-126-0x0000000003350000-0x0000000004376000-memory.dmp

Download

memory/3104-138-0x0000000003350000-0x0000000004376000-memory.dmp

Download

memory/3104-137-0x0000000000D60000-0x0000000000D61000-memory.dmp

Download

memory/3104-115-0x0000000000CC0000-0x0000000000CD6000-memory.dmp

Download

memory/3104-154-0x0000000003350000-0x0000000004376000-memory.dmp

Download

memory/3104-174-0x0000000003350000-0x0000000004376000-memory.dmp

Download

memory/3104-203-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/3440-111-0x0000000075520000-0x0000000075569000-memory.dmp

Download

memory/3440-112-0x0000000075520000-0x0000000075569000-memory.dmp

Download

memory/3440-113-0x0000000075520000-0x0000000075569000-memory.dmp

Download

memory/3816-39-0x00000000753C0000-0x0000000075409000-memory.dmp

Download

memory/3816-40-0x00000000753C0000-0x0000000075409000-memory.dmp

Download

memory/3816-38-0x00000000753C0000-0x0000000075409000-memory.dmp

Download

memory/4376-55-0x00000000753C0000-0x0000000075409000-memory.dmp

Download

memory/4376-56-0x00000000753C0000-0x0000000075409000-memory.dmp

Download

memory/4376-57-0x00000000753C0000-0x0000000075409000-memory.dmp

Download

memory/4376-59-0x00000000753C0000-0x0000000075409000-memory.dmp

Download

memory/5232-12-0x0000000000BB0000-0x0000000001BD6000-memory.dmp

Download

memory/5232-17-0x0000000003520000-0x0000000003521000-memory.dmp

Download

memory/5232-20-0x0000000003520000-0x0000000003521000-memory.dmp

Download

memory/5232-22-0x0000000003520000-0x0000000003521000-memory.dmp

Download

memory/5232-101-0x0000000004890000-0x00000000048A6000-memory.dmp

Download

memory/5232-18-0x0000000004480000-0x0000000004481000-memory.dmp

Download

memory/5232-11-0x0000000000BB0000-0x0000000001BD6000-memory.dmp

Download

memory/5232-96-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/5232-0-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/5232-49-0x0000000003520000-0x0000000003521000-memory.dmp

Download

memory/5232-80-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/5232-6-0x0000000000BB0000-0x0000000001BD6000-memory.dmp

Download

memory/5232-1-0x0000000000BB0000-0x0000000001BD6000-memory.dmp

Download

memory/5232-83-0x0000000003520000-0x0000000003521000-memory.dmp

Download

memory/5232-76-0x0000000000BB0000-0x0000000001BD6000-memory.dmp

Download

memory/5232-70-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/5232-69-0x0000000004A20000-0x0000000004A21000-memory.dmp

Download

memory/5232-63-0x0000000004890000-0x00000000048A6000-memory.dmp

Download

memory/5232-62-0x00000000048D0000-0x00000000049D0000-memory.dmp

Download

memory/5232-14-0x0000000000BB0000-0x0000000001BD6000-memory.dmp

Download

memory/5276-123-0x0000000000170000-0x00000000001B9000-memory.dmp

Download

memory/5276-100-0x0000000000170000-0x00000000001B9000-memory.dmp

Download

memory/5276-103-0x0000000000170000-0x00000000001B9000-memory.dmp

Download

memory/5276-102-0x0000000000170000-0x00000000001B9000-memory.dmp

Download