0c512088ac8214eac611a126b1e289cd8aaf490fe99ef594b1561e98f74a8d1d

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
Size 1.5MB
Sample260705-ftte6adv7k
SHA256 0c512088ac8214eac611a126b1e289cd8aaf490fe99ef594b1561e98f74a8d1d
MD5 6aff0a6f8c52adb296d1f34296cb3193
SHA1 236155e0962b42afa6abd58459808493665732c5
SHA512 35fed9c9807baef6f059be4103318ff103e29cb6514bd5ed7aadfdbe39a38010ea3ef8ca4a2512c43db9a1264a5530f3a3af974c49f2987f9b9881efb276dd33
SSDEEP 24576:PFOavGHL3siy9eKfSmtLvUDSRbm4Jah1rVxBtcSEe8g00XAIZiS8Klpxt/Pueauk:twL3s7RqeTUDBzrVx4WqipxlPuHuj4
TLSH
T1D47512237E608077C45345B0ACB9E7BABE36AE3617649C077790B7192D71343B6B520B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 7 IoCs

pid	Process
620	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
2656	Setup.exe
4764	icsys.icn.exe
4824	explorer.exe
6584	spoolsv.exe
3868	svchost.exe
3948	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2656	Setup.exe
2656	Setup.exe
2656	Setup.exe
2656	Setup.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
2656	Setup.exe
2656	Setup.exe
2656	Setup.exe
2656	Setup.exe
2656	Setup.exe
2656	Setup.exe
2656	Setup.exe
2656	Setup.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4764	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4824	explorer.exe
3868	svchost.exe
2656	Setup.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
2656	Setup.exe
4764	icsys.icn.exe
4764	icsys.icn.exe
4824	explorer.exe
4824	explorer.exe
6584	spoolsv.exe
6584	spoolsv.exe
3868	svchost.exe
3868	svchost.exe
3948	spoolsv.exe
3948	spoolsv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 620	436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe	89
PID 620 wrote to memory of 2656	620	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe	90
PID 436 wrote to memory of 4764	436	2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe	91
PID 4764 wrote to memory of 4824	4764	icsys.icn.exe	92
PID 4824 wrote to memory of 6584	4824	explorer.exe	93
PID 6584 wrote to memory of 3868	6584	spoolsv.exe	94
PID 3868 wrote to memory of 3948	3868	svchost.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436
- \??\c:\users\admin\appdata\local\temp\2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
  c:\users\admin\appdata\local\temp\2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\8f557644216a5bc83dcfe20e00c2111e\Setup.exe
    C:\8f557644216a5bc83dcfe20e00c2111e\\Setup.exe /x86 /x64 /web
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2656
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4764
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:6584
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3868
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1025\LocalizedData.xml
Size 81KB
SHA256 4198a6ae89b0be8bd07ed3c18dea6ca87239a5a47343b73ff612ce0ab47e08dd
MD5 075961c7e742c66ee4cd8b614a778141
SHA1 a5541fa0487135aaed1c336bba79e8025ac2804c
SHA512 c6881fc501805d0cb5aa9b42fc14029404a236166699e3845586e0609c26e4536bdd6ca2181e1139f83d5cb78c35d0fa7d158134f522fb9f4736880e330fc8f6
SSDEEP 384:49yMFNhaVwV/VLVWPD66KUtycONAkRtj7l/XeqSKmmM7cBp9WtCctFnDRydTJleD:OlxBdsUTJleYi
TLSH
T10483EB11AEFAA238B0BB9A14EDB381510EF37D915C75C12D00991D4E4A77FC58E16FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1028\LocalizedData.xml
Size 70KB
SHA256 7d6777e8c9484229c1b8e3f2e354a88f57539503c2c56f2b0ee47679a6ef9cc0
MD5 8b37256ce099957b91ebe1d51ad8f61c
SHA1 6bf4bcf46781126ffdce92e39ad4d1d912e75ac5
SHA512 6659dec6fae7a7f733a0c9e44a04f178a6732e1b9b785833c63efd8ed6e25adabb58e37b2ec039dacdb071732f8ee42ceb297cb2ec72b67e8d25eb093d5423a5
SSDEEP 384:491gFNhaVwV/VLV33zqjKUtycONAkiNsc2XcmacDQJOTJpcCHwx+DR+USWV/K1ND:jXqZUxBSWV/K1+gwJg5H
TLSH
T10063A512AEFB2218F0BAAA55BEB700944EF3BDD15C35C11D0099294E8A77FC58D15FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1029\LocalizedData.xml
Size 87KB
SHA256 e28d2d89fc269d25272956cee4d7150a30706f58ad305e84e3c1c9fe7ac0ee86
MD5 aadf97951359a8267f7990cdd2cc950d
SHA1 61f626b44e252e916c9c70a4222efc9c21d951c6
SHA512 2d352cf7d8d167b2a9fd4416582328d894619f2eb213fd334e1b15ef1044735a69ffca36fba02d9d1af6355e9d1a55d38c3b7f5339ecacb8c1dfdc4cc50c5342
SSDEEP 384:49ZWbTP0qTvLSGf6KUtycONAk9Mo+snsMsBTKTuTyTfQjkj/svHov+yJKe3dJTZ7:k2LTEiJUQ
TLSH
T1B393A312AEFA2218F1BBAB05BDB700A44EF77D915C35C11E0099198E4A77FC58D25FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1030\LocalizedData.xml
Size 84KB
SHA256 615a6380adcfa3a0e7a5db2df9b98dad650678d8c46b1c7c3f2d2854204f079e
MD5 e1f2f586d75650df1a751d86bb659df8
SHA1 283097241e6b1acc8f30ca822585df104c918e51
SHA512 b7fb3e366a7e5cbaaf99e8e14731653dd14885cd0b3d5462c091113f12800478ff2e5bd351bd403abaeef3041cdd5a7693825e488f27ec48d087686c95daa774
SSDEEP 384:49xUFNhaVwV/VLVWPD66KUtycONAk6iqz3b4VYRB7XrEbZfURtzBSmRLAgRQJYRe:aRB7XOtSvJcR
TLSH
T168836E11AFFA2218F1BAAB15BDB700940EB7BDD19835C11D0099298E8E77FC58925F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1031\LocalizedData.xml
Size 89KB
SHA256 01afd814b009538f387812f6940c863a9d0cd7dc4159050f34f82e50ecbc33f8
MD5 74d28384c38283518c6490bfd068ebf1
SHA1 c52d2fd41a59691e18871ec64db10c43f241fb6c
SHA512 e23ae604eafab0c3a0d8aeb07321c0dd629d21c5ba47d37958f48f1b9f27d89de4db880ec3958ad1e5f2165a69bed18d61f73f71fd743a2d7eaafdc0ef8d1cc0
SSDEEP 1536:va6UBjBFPHP5bh6a6VSjE3pg010Jsz/ziX:va6UBjBVv5bh6a6VSjE3pg010Jsz/ziX
TLSH
T196939E11AFFA2208F1FAAB54BEB711940EB3BDD19C35C11D0099298E4E77F858925B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1032\LocalizedData.xml
Size 91KB
SHA256 7106a1121056a73fed77aab7c7293dddffe0f5aecd7db969799a121ad5d88181
MD5 233d0d1551b17f2284ad80674569de79
SHA1 67cd31126c6e5547e60d7266e61b6835b80b5916
SHA512 c3375081c704fb05c7335929505ef4589fa728c97bb58738932b7ee05dd6e00c19d8ba14bb0a8dfce0d51ac73fa76bffa0ccc00772b73850eea37d39088a0473
SSDEEP 384:49eyvnT86nzWPD66KUtycONAk5+LoYRONOVA8HTiVEsmXadUk1c00CfMMHlRcyvN:ZqqQyZ0J7
TLSH
T17793E6059EFB2314B5BAAAA56DB300540EB7FDC14835C52E10A9384E8E6FF858DD1F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1033\LocalizedData.xml
Size 84KB
SHA256 b3048715a23d9bd77e9b3e1ec8577f94cfc8c2dd30b61dbf326871a97aa6e22c
MD5 31bff8efc0cc701092ab7fe606271d65
SHA1 844cc4837ebe3eea9563df6613989b4588d6f19c
SHA512 472b881df9128c93f9183ab05d2406146aeef8ce9723c9dcfa6e93d093d90b2db75bb4a3f784d26db187436242409f021fa8b7844aa04bf9cb58f48a6c4822d5
SSDEEP 384:49389tJKVQVfVjV2vjaCS89aEetgc1FTnH9Zz8NqJpR+enRROu5aeJInO/yJakC9:9nH9ZAqyJiT
TLSH
T198838F11AFFA2258F1BBAB14BEB700940EB7BD915C35C11D0099298E8A77FC58D25F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupResources.dll

Path C:\8f557644216a5bc83dcfe20e00c2111e\1033\SetupResources.dll
Size 24KB
SHA256 197cb97902aa576a8a4dcbc5b4615a28943b1941d67c6fc163b5b4a034c650d0
MD5 49a9bedc81cd400abbf794f272883a8d
SHA1 dc9aa0fe56bc4f0d5fee333eb28a29bb4750eed1
SHA512 bd579834eb275cc07d458052317f1851380c5a510869b224c0441f70d2cb468c5cea034649704c9cced28cf2425fa1c67c0f8c22011b81ce98ed243647422415
SSDEEP 384:jBXGeZnvWpreWP+9E2/yVskQzuHRN7iivpR9zKVSp:bZnacl/GgzaiivD9zGI
TLSH
T197B2828667F88505F5F77F30A9B586A22E3ABD825934D30E2681E15D18B2F40DE3473B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1035\LocalizedData.xml
Size 85KB
SHA256 e9353dedb338ce826b3b990851a955da1b04e484a378cac7c3c17a2de26d14a4
MD5 c78dddce3189c67c23f60561dcacd4a8
SHA1 e375a6d1f71709ead1ad4139b1c16476019666d2
SHA512 a58d995936f5c5310e04f7514c177a071f3451638f0a9692593c4d505c5f48caeca1cee9644b092bf32bd70c52bb956f0b87ac748190aea2040adc3afbbab3b0
SSDEEP 384:49104sUwpVbVkV4VbiO/6KUtyc6BM47xQqOYeBzW/bzKdm4Ne4Bti4l59R8fOaJt:BI/lOfOaJ+Q
TLSH
T1BD836C11AEFA2218F1FBAB15BEB601900EB3BE915C79C11D0059294E8A77FC58D25F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1036\LocalizedData.xml
Size 89KB
SHA256 c8c847bf9ddf8998520123ff0a638c6e9843c860b68943275b7f0256f324c4ce
MD5 d7e814adae1a18958416b7e29ae7078b
SHA1 857fed2c8766102d1a64d91eccb0661f6de750fd
SHA512 73ad8b3d24ace1795c93ef807b3e644512fee2a295eea05a93fea07d131746aa99f895a68075efe44c2c4e305da3881c27a342d2fa13dd6d1f258a9cc669491a
SSDEEP 384:49BEF9xWQ9RWPD66KUtycsmIPrCoEVDpFqpRatkxOGvLGj8VjfRiLYcRryQMuvtR:g+skAu8tbxhJNP/J
TLSH
T1E2936D11ABFA2218F1FBBB05BDB710940EB7BD919C35C11D0099298E8E77F858D25B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1037\LocalizedData.xml
Size 79KB
SHA256 83120845e156ecbd401a9047365647cf8e9b2ec75d9295237da33c53eda365e4
MD5 a258bd1060df46dcefe6257d4af638dc
SHA1 9e989db32e94499a717c93e889ebf47787509a42
SHA512 6f69aa98e264e3de3669f52e34140bf3a1bc333e3e3c4e06228eb1a78aabde380c8a444d9086a1f1188c49ead7ca73962db488dfb8e4e13c09ebf539ae53d011
SSDEEP 384:49lEJquUMovngPMIzVK6ptI6AmN4+sOlrAyAiAUkrzmhygwREQ0mFfGQdJjwvSJf:CV3tJjw5o
TLSH
T11483E911AEE66258F4B6EA06BDB704580EF3FE805835E11E0059295E4A7BFC18E1DF73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1038\LocalizedData.xml
Size 88KB
SHA256 5dfa759937eb0ee393d94485e0ac74546d344f342fc3d42ad33847ebbd5163e4
MD5 1b59e64e51b3f9b96e8897d5b9b17c37
SHA1 1fdd8951133add26ae062da306133980e31809b0
SHA512 f1cb4670805ccd1327a7ea31b98caccc7c5bc7cb7ea7817a5749b0e176f4bdae36339d25d1037f9cdb19a47bcaac4e53fc49656c365ee7981473264b55f2a996
SSDEEP 1536:/Za/a0a0IGII1lCIu4F70SnBIzEERhJH0rji3kC4ILiv:/ZayfxvYhXF70SnBIzEERhJH0rji3kCQ
TLSH
T13D937011AAFE2218F0BBAE157EB711940EB7BE905C39C11D0099294E4A77FC5CD25FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1040\LocalizedData.xml
Size 87KB
SHA256 5dceb300d25c68003d61437e3802f97e1d5503e27032989338f7d260c7b0904e
MD5 3192c0f7f30df881ec199d77b095b93e
SHA1 dca1cfe248a9de56f2d207d5f1979c92e006831c
SHA512 42a5f98103e23d7e8d7a34f8ba08d027ac4317d92109565b5f3fa4fd7057104d3a12b88846bee1914451cff59ed1b46e9146592784c09cd724bf004eb65864c3
SSDEEP 384:49DLGeyl/eSWPD66KUtycs9/wTIiGtjHg3XLCMa1eHzNZNs4fuD4RBJBo5U6sxuY:+ukaYtJGk
TLSH
T1E1936E11AFFA2218F1FBAB04BEB601944EB7BE919C35C11D0099198E4A77F858D25F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1041\LocalizedData.xml
Size 76KB
SHA256 1c2587f7c0d7e57494061d24638a83c8f9d33a4eb192cfe6bd65c172fb6a76a4
MD5 4cfdb16e84869a51119e17a545ace7a2
SHA1 5eb358e13291d65ff8805513254b02ff3b83d7c6
SHA512 381878c16a98aae9ef688bf4735b13d2d42b2c115d76c1677f5c275db3745b35fac35468f11d80284307a6f5ed93265fa2c378a5199284d848fdf984f2a88daf
SSDEEP 384:49MUFNhaVwV/VLVWPD66KUtycONAkNmZXg++oMeRCcLsRbJDhFiv:/hmJC
TLSH
T11573E711AEFB2218F0BAAA55BDB710940EF7BD905835C12D0099294F8A77FC58E15FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1042\LocalizedData.xml
Size 74KB
SHA256 721cf8956fb2fb01df302713351eb9721cfccff096dc429d02b0f2b150855919
MD5 401f386416c7c37f92da9ec1688d750b
SHA1 c6565b80ba557827e3e6b96901f27fdcd1b525c6
SHA512 f4ac60826287262b87bd407c85091d583ac504645faabd6fe8e116ac50e35908341d85850e8888e5928cb8235101e6b7a1074597946d584550e8aea6a7fba591
SSDEEP 384:49QyFFhyV4VnVLV//rCjKUtycONAkaETFU9WNtelnfYbzqRjXU2ggRZVDhYAS+KY:AbNte+b+xJr
TLSH
T13A73A712AEFB2218F0BAAA55BEB711940EF37DD05836C11D0099294E8E77FC58D15FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1043\LocalizedData.xml
Size 86KB
SHA256 88de82f8c0934f23e0eb16224def959ff55da396610bd34149e4fb9aab24fb03
MD5 18efd16361a280efe263f261a4faa21e
SHA1 6e5bbbc46b2decdb00cd957d02e27bbbf2a4d880
SHA512 b4bdaf600c5a855c040db974744b780c4860474c38ec453c4bfdc5a11c8beff65437d17c5ab0c3c78b5b861d93b0d41f1c3f4d5d435d233ba3719f78c9058446
SSDEEP 384:49uoNVxJ4i/5Qbkkk5vWPD66KUtycsyUjr9FQvFzyDZAZ7dns7YGoDq1RYktgNVX:FvREQ7dnwuqGhHtP0tJJ8Z
TLSH
T154837012AFFA2218F1FBAB157EB610904EB3BDD15835C11D0099298E8E77FC58D25B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1044\LocalizedData.xml
Size 85KB
SHA256 8165d0b468d73347a495f525dc81d847bb84b3391c8af1abc95e2b8f4a51d620
MD5 a9998c1f395c44bcd41faa0ae60439e4
SHA1 4a267707c7dd8a24eed4c433b3c41b7e1a6a936b
SHA512 9f0fb00c34ee788f9e8058915794b822fcb31f1c35a1d47ce5da2b15bae904cab513d55111ae4cccbf4da2587a4c3e045f0cc2e95654c9b5631a3a4a86632bd3
SSDEEP 384:49XulskoDBkIWPD66KUtycONAkIdkmgJAjMFwrbDbGBklKn9COrtQ2GCJYkTQQv:zkkU9Ct2GCJYu9
TLSH
T12B836E11AFFA2218F0BBAB15BDB600940EB7BDD19C35C11D0099294E8A77FC58965F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1045\LocalizedData.xml
Size 88KB
SHA256 4362c962c7611190999b36e139370245104b66398ebddd56b210810440c43e88
MD5 5eadf11a5b9af3f40b21328474ba3b7e
SHA1 af456b6123f9adf4ea0b926124b926ea3056248e
SHA512 e0f0c32c736d23d40508daaa2fb7b7033034154869a4f411aa4ff96c7ff197d97b1d89eb4a6da1dbfeacdd3373c45f22bdda70554521bbce409c051ae4573e42
SSDEEP 768:YuUuGp9Vi0iG0XE2Uq4DplOe6lsQjPLJbOzdH:mCjJyZ
TLSH
T13E93B011AEFA2218F1FBAB44BEB710944EF7BD91AC35C11D0059298E4A77FC48D25B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1046\LocalizedData.xml
Size 85KB
SHA256 c2afb880f0986ca807b1dacbd5a9f2a5b9be4930c29379cdd88a6ebf9b0618c1
MD5 361a4c229849b55e4540943b5c04403c
SHA1 46a0751432df223c936393f21a7543a3b314157e
SHA512 40ba8c19286f992e5742f342532161062c36504aa3a364cdaee15e2e3ab750012d6502278d064f45b3df13b3063c66a361d688adbcaa6eb7a657c9a50e0e9380
SSDEEP 384:49Qbb8UAjJUgYN5s6KUtycONAkpuroXInXN5khHL4lzSv3kOY8vg2m/qKdxEcyJD:XUbcyJzyN7K
TLSH
T15D838E11AFFA2218F5BBAB05BEB610944EB3BE919C35C11D0059194E8E77FC48E25F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1049\LocalizedData.xml
Size 87KB
SHA256 3b2c633bb0a7342418aef0ce29331643a4cd48a572ddbb90c3d3433d135fd952
MD5 f65088c4998e6ca3a872fc66bdd2a192
SHA1 c697a3a043a6104befd6f8e1b85e746c3d84e390
SHA512 a5938da7cab6e963c553de1c135ee9c7ec565fc97ed4d433dfff9debb5d31ba3bbf3d1b8a12e814462fd92f4c39680ae71dbd2e3df846f23a1a98921f3981992
SSDEEP 384:4xOCNVxJ4i/5Qbkkk5vWPD66KUtycONAkCS72VrkSVfGo/RGKVcng5/spnBthXlL:TfVUJj
TLSH
T1D093F907EEFA2214F0BAA6546EB704D00DF3BE905A35C15D009F2C4E4A7BFA55A15FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1053\LocalizedData.xml
Size 84KB
SHA256 b28bd460c2df31315297083c5507c233a569e1e89547127191468598b35eb36e
MD5 a6f6198758552f453df96c4a8fb84134
SHA1 c40dd5faafe457c6c814695b4885f065f9d2f4bd
SHA512 9b958a0556d5989f71d1e38848c8b6b54ff6bfe292ad599b81e808f4c193cd41a23885d806539a0c246b811519a73d5fe7b0ce679c53119cfa97f999784fb66b
SSDEEP 384:49yw+WCXVVV6VOVWPD66KUtycONAk92JuWf59pWIYLn6uOuos98LSGcgqBV6kMQw:JvVIYLnznIXrJJpoE
TLSH
T1B8835E12AFFA2218F5BBAB14BDB700940EB7BDD15C35C12D0099298E4A77FC58925B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\1055\LocalizedData.xml
Size 84KB
SHA256 98b5b75b8a89606dfcb54c622884671211199dffced96c29269010b81b06231a
MD5 c515bca575c7e7e7dba8c1ac2a3031d7
SHA1 3aa307513e55a2ada4866ff8fcb2de4e5184a1ad
SHA512 5a8c51f55aa6ae44f0a6932a30f0054e8c012080696d5fc784a3ec89aa63275978440364e6b9663eab5466af459594fd1c5d517c629f312bc9b4943e9e040a29
SSDEEP 1536:p7gos8blQm/wobG+PKarUdTvJ4rtRevfS6bh:p7gos8blQm/wobG+PKarUdTvJ4rtReXd
TLSH
T1DF836111AAEA2218F5FBAB457EB710900EF3BD916C35C11E0099294E8A77FC58D15FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\2052\LocalizedData.xml
Size 70KB
SHA256 4577902142bb96b849f6b78866a5e81c761109a454470948902a40c73f7b9b7f
MD5 83242627ea9f4ea7c346a8830026eeb5
SHA1 75a8f52fa3e03b2f04b168d517117f80212b5672
SHA512 cd27e3ad4168b7bb61b2336f73cd9f61516b953271aeecafbe22cbcffe18ef45d4a4e2c7513c3986939ffd635f2e7d1868798182ffcb4ae0e7aa207c5bc67bc2
SSDEEP 384:49bL8FNhaVwV/VLVWPD66KUtycONAkExkZtmqaDCWehZATfVxzR/8XMHRd4LOPcW:8kZtmqaCEmXw4LOPjAJN6
TLSH
T1CC639411AEFB2218F1BAAA15BEB710940EF3BDD15835C11D0099294E8E77FC58D25FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\2070\LocalizedData.xml
Size 87KB
SHA256 4aa6b559e8993de92797e0d1c595cec0bf305403dd275a231f8417ba4c09c1a1
MD5 50b9f5f566fd83ceeb0fd0992739388b
SHA1 c040e31d59580541bbcbd662598e8d3fbf52b51e
SHA512 87736f5db8bbcbe4924667e8f5820dc5329e902632d22480ac4768023215fd0db399f442eb1ba76ab2c5c008e58611f006cae4307605a5340380127fd83f70a4
SSDEEP 384:49LlFNhaVwV/VLVWPD66KUtycONAkdIxHIbNlHtRTQYOdxIL1FskOYNigvR/nikj:tau6kzX0JZ5OW
TLSH
T16E938011AFFA2218F5FBAB05BEB600944EB7BE919C35C11D0059198E4E77FC48E25B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\3082\LocalizedData.xml
Size 86KB
SHA256 9d3fd31e3826b91d68ea34a6961cf288e23251cdf8faf0aad02653a55c53f2e0
MD5 14005b857dd90ec8bde8e80c3cb0faea
SHA1 7aa4e6f4c9feb808b2dc95f7541bd10aee02874b
SHA512 5ad424144a47fcc47ce5a33225a7cb1017b4278b5e3241da48213e132c4cef549ea3c107e7789f42886bdc0a343f50fcd0fc0b287efaff010bc1186251c5c0ec
SSDEEP 384:49D0PfH7g2HbWPD66KUtycsJ7USMY8Pex7UM/I9aXdoBchU7aF/6JD1NDoAjJuLT:ch72VgZN08Jtikin
TLSH
T1A3938F11AEFA2218F1FBBB05BEB710944EB7BD919C35C11D0059298E4A77F848E25F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DHTMLHeader.html

Path C:\8f557644216a5bc83dcfe20e00c2111e\DHTMLHeader.html
Size 15KB
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
TLSH
T1B672765326E84248A1B6BE49AFB640750B79BD45A83CCE7D05A0591F49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ParameterInfo.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\ParameterInfo.xml
Size 1.0MB
SHA256 5b872fc7d87f00634137d4051ee6f4cf481f9f7e0163ae7589a6c40a7c828569
MD5 4a0c5e0d81034c74bedc85b7f4759888
SHA1 d2c13fca6d918c7b4d25c8b9290bac053c551694
SHA512 913425ea56c02ec136ee6eab4ab6a44e6a61f428ee431df241e2c745377d33835a6ecac69a8d02596f2adbbbf602a8afe578a05a1e3d253aa6e60e5666e1214c
SSDEEP 1536:a2G6cREMZxAbd1CVcWfFXRhshTFekI03IzU54pZf3A3sWfNgvhyh8cetGcXthYhJ:acFehceDWeHdIl
TLSH
T13C35E11227FA0305F3B76D257AF1889A89773892DC34C35D406C128FA7A3E95CA62F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\8f557644216a5bc83dcfe20e00c2111e\Setup.exe
Size 118KB
SHA256 43290269962f9edb13d042d54973a76570f6e4b6a4af33e7362f8284b9083720
MD5 f7a63e2d4217b71d39e4b18b3dadf632
SHA1 c3446cd1a50f6374c3ad3446607864bee97426d9
SHA512 1703b6c1b1f96febdee8663fa9e8e11939715781810f5feccc6f11b0298fed4f83f6decd975ed1c05dd0e976a12b0738040d0c09db46389a2720462a6624c942
SSDEEP 3072:GqabbpJcxE4VRAlHX/r/PRFX/gBQZYnCnJrw6:ggW4oDX/9ZY4T
TLSH
T176C35A43B5D0C4B1E476093108A6DEB55E2F7D224F604EAB3398762E1F712C1AE36D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupEngine.dll

Path C:\8f557644216a5bc83dcfe20e00c2111e\SetupEngine.dll
Size 899KB
SHA256 3a45fbe9c5e03f67b49808c068eb2ce831e4eebdd1b38e520e4be5a5537a72e4
MD5 9964ce1f4874a686910dbc1aeec1a326
SHA1 0b434c566f6722c765245a1228b7600fd10ba1c9
SHA512 8d123ab8e6b767a80d122b021a77460373e2b0841c92375ba1f56830529a2610bbf3749ce95aa64b67f45591378246409f035518feced582c7ebe1b6609dba99
SSDEEP 24576:dG2ynlYAM4CUGav3y4XFMaU0z4wg3qdGCqqt:dG2ynlYAM4PC4maUnwoqdGCqqt
TLSH
T101153B213AEC8035E3BF277075BC6555A97EBC300B72C5CF22909E6D1E36AD15A34B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUi.dll

Path C:\8f557644216a5bc83dcfe20e00c2111e\SetupUi.dll
Size 341KB
SHA256 1f757ea33835920a08fd9558f973761f70bc63a8c01fda4db1170e19ebf0c73d
MD5 b90a60068318cefa24e3344c4ef71649
SHA1 e61893f999442bbf6c0b1fa4c154fddb3be721f1
SHA512 372d17ddc5ecc1190a81be67d1e9a256e9d52d1225a0de064dcebc3b7da983412a3ec1c5cb4f3f1abfe5a1fb3cc69157abbdf05e1c6bbea368d0a357afbd611b
SSDEEP 6144:rYAYlUo2Fdj0V50kC6oiQRM2lCaMuumZ1AK6howZ2HlK8v:yyfiQVl5FumZj6hJA48
TLSH
T1BD744B207A9894F1F16F1634B52897A0DAADB8700BF0C1CBEB98DADD3E346C14E35B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUi.xsd

Path C:\8f557644216a5bc83dcfe20e00c2111e\SetupUi.xsd
Size 31KB
SHA256 aaf8cb1a9af89d250cbc0893a172e2c406043b1f81a211cb93604f165b051848
MD5 a9f6a028e93f3f6822eb900ec3fda7ad
SHA1 8ff2e8f36d690a687233dbd2e72d98e16e7ef249
SHA512 1c51392c334aea17a25b20390cd4e7e99aa6373e2c2b97e7304cf7ec1a16679051a41e124c7bc890b02b890d4044b576b666ef50d06671f7636e4701970e8ddc
SSDEEP 768:hlzLm8eYhsLP8s05GFaAMET/chT+cxcW8G2P4oeTMC:lwchT+cxcDm
TLSH
T1E7E227C631C1CA001B374832AD223B0DFED5A57382D43D61B5DCA637BB76AC62967279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplashScreen.bmp

Path C:\8f557644216a5bc83dcfe20e00c2111e\SplashScreen.bmp
Size 117KB
SHA256 b05141dbc71669a7872a8e735e5e43a7f9713d4363b7a97543e1e05dcd7470a7
MD5 bc32088bfaa1c76ba4b56639a2dec592
SHA1 84b47aa37bda0f4cd196bd5f4bd6926a594c5f82
SHA512 4708015aa57f1225d928bfac08ed835d31fd7bdf2c0420979fd7d0311779d78c392412e8353a401c1aa1885568174f6b9a1e02b863095fa491b81780d99d0830
SSDEEP 384:pu66qlxe0UqtcSiS2gLsd5xfAg+zqFv4t:LP
TLSH
T13FC3EF9C27BF054AE63AAF9A352546441B1EAE9437E03B8F5D3732CAB173341D788285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Strings.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\Strings.xml
Size 13KB
SHA256 2a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b
MD5 8a28b474f4849bee7354ba4c74087cea
SHA1 c17514dfc33dd14f57ff8660eb7b75af9b2b37b0
SHA512 a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369
SSDEEP 384:VqZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VqB
TLSH
T1B352834376FB2018B1B23ACA6FFBC1B4CF6675D00976462F0159204B87D7C1B6AA2776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UiInfo.xml

Path C:\8f557644216a5bc83dcfe20e00c2111e\UiInfo.xml
Size 63KB
SHA256 b879f9bc5b79349fa7b0bdbe63167be399c5278454c96773885bd70fbfe7c81d
MD5 c99059acb88a8b651d7ab25e4047a52d
SHA1 45114125699fa472d54bc4c45c881667c117e5d4
SHA512 b23a7051f94d72d5a1a0914107e5c2be46c0ddee7ca510167065b55e2d1cb25f81927467370700b1cc7449348d152e9562566de501f3ea5673a2072248572e3b
SSDEEP 1536:24UR0d5vud5vcZ2QYQLIN/N7pfMGgrX8FPirziPfwws36z7y/HoQilwJwowJwXZR:24UR0d5vud5vcZ2QYQLIN/N7pfMGgrX5
TLSH
T1EF5319535FEB0118E1F6AA4D69B304701F5B7A45083AD53C14EC364EEFE7E6288A07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

print.ico

Path C:\8f557644216a5bc83dcfe20e00c2111e\graphics\print.ico
Size 123KB
SHA256 d80ffeb020927f047c11fc4d9f34f985e0c7e5dfea9fb23f2bc134874070e4e6
MD5 d39bad9dda7b91613cb29b6bd55f0901
SHA1 6d079df41e31fbc836922c19c5be1a7fc38ac54e
SHA512 fad8cb2b9007a7240421fbc5d621c3092d742417c60e8bb248e2baa698dcade7ca54b24452936c99232436d92876e9184eaf79d748c96aa1fe8b29b0e384eb82
SSDEEP 192:ly3ul6MeeS80xxb11yXXVzzzzzlzTTTbt/Pu:lj6MeeSXxxb11yXXVzzzzzlzTTTbt/Pu
TLSH
T191C324636ADE7DD6D0B866B13B7783D1C70EEE058922D02EA2D4366AD17D5037A433C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

save.ico

Path C:\8f557644216a5bc83dcfe20e00c2111e\graphics\save.ico
Size 123KB
SHA256 1372c7f132595ddad210c617e44fedff7a990a9e8974cc534ca80d897dd15abd
MD5 c66bbe8f84496ef85f7af6bed5212cec
SHA1 1e4eab9cc728916a8b1c508f5ac8ae38bb4e7bf1
SHA512 5dabf65ec026d8884e1d80dcdacb848c1043ef62c9ebd919136794b23be0deb3f7f1acdff5a4b25a53424772b32bd6f91ba1bd8c5cf686c41477dd65cb478187
SSDEEP 192:cICfR9iBLLLLLLiii1dkx2Xwi+XI7b6ZZZZZZZZZZGGGGys7v5Z7vvvvvvvvvvwF:H2R9iJJi56ZZZZZZZZZZGGGGyHIIIhh0
TLSH
T1BEC3BE07AAEDBEDBD085A271FB3982B1DEE0ED1D4721404E76F9A666E471E1331020DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.ico

Path C:\8f557644216a5bc83dcfe20e00c2111e\graphics\setup.ico
Size 123KB
SHA256 a0c7b4b17a69775e1d94123dfceec824744901d55b463ba9dca9301088f12ea5
MD5 6125f32aa97772afdff2649bd403419b
SHA1 d84da82373b599aed496e0d18901e3affb6cfaca
SHA512 c4bdcd72fa4f2571c505fdb0adc69f7911012b6bdeb422dca64f79f7cc1286142e51b8d03b410735cd2bd7bc7c044c231a3a31775c8e971270beb4763247850f
SSDEEP 192:+7yhu1uz//TAAA555AAAAAr99899AubBqj:oX1uz//TAAA555AAAAAr998991bBy
TLSH
T1F3C3122366DEBDDAC4B467B03B77C3D5C71EEE554922D12EA2C0262A917E0437A433C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warn.ico

Path C:\8f557644216a5bc83dcfe20e00c2111e\graphics\warn.ico
Size 194KB
SHA256 4bb9ea033f4e93dbf42fc74e6faf94fe8b777a34836f7d537436cbe409fd743f
MD5 c8824ea3ce0a54ff1e89f8a296b4e64b
SHA1 333feb78e9bb088650ce90dea0f0ccc57d54a803
SHA512 c40e40e0cb2aaa7cf7cccbe29ca4530ff0e0a4de9a7328996305db6dfd6994cbe085fab7b8f666bbd3d1efd95406ea26b1376aa81908ace60dc131a4e9c32d40
SSDEEP 1536:cpUNHIL4Oj0qwL2IupGF8yJtJFFhxGgX/3/HRVq:8mHILxnDIiGFxG4s
TLSH
T12D1418526E2EBFC5F548B231D839C1B00910EE7948AA966B35F67E8B39772237431F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqmapi.dll

Path C:\8f557644216a5bc83dcfe20e00c2111e\sqmapi.dll
Size 221KB
SHA256 b236253e9ecb1e377643ae5f91c0a429b91c9b30cca1751a7bc4403ea6d94120
MD5 6404765deb80c2d8986f60dce505915b
SHA1 e40e18837c7d3e5f379c4faef19733d81367e98f
SHA512 a5ff302f38020b31525111206d2f5db2d6a9828c70ef0b485f660f122a30ce7028b5a160dd5f5fbcccb5b59698c8df7f2e15fdf19619c82f4dec8d901b7548ba
SSDEEP 3072:Dl5e8m9Z5G6ZUMIiaQVedGGEc6SYm8X/UvHFupHIjNNlMi/fbtcICcu0b9+x0o/l:gG6ZUon6GVSYmnGHEvlMMac59+xfbB
TLSH
T1172419D1E1F68071D3D2133072592377E9FAA92F2DD8BE8B1380E6573830982D76975A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-05_6aff0a6f8c52adb296d1f34296cb3193_amadey_elex_redline-stealer_smoke-loader_stealc_swisyn_tofsee.exe
Size 1.4MB
SHA256 05e9ada305fd0013a6844e7657f06ed330887093e3df59c11cb528b86efa3fbf
MD5 39304ce18d93eeeb6efa488387adaed8
SHA1 22c974f3865cce3f0ec385dd9c0b291ca045bc2c
SHA512 4cf7f831fc1316dd36ed562a9bd1fda8cca223d64d662f3da0ade5fddc04be48c2d40333ba3320ee2d6c900e54c4f7e4f503897793e86666eac7e242d8194f5b
SSDEEP 24576:MGHL3siy9eKfSmtLvUDSRbm4Jah1rVxBtcSEe8g00XAIZiS8Klpxt/PueauCCk:RL3s7RqeTUDBzrVx4WqipxlPuHujk
TLSH
T1E265232236B1C073D4B316309AF5E7F1AE3AF62A13748547BF84672D1F22790657A709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HFI7B37.tmp.html

Path C:\Users\Admin\AppData\Local\Temp\HFI7B37.tmp.html
Size 16KB
SHA256 045b3f8653d0a9f2c3caea01e1dfa2a593fdaa7598200b03abf1747abeea24a1
MD5 b930994de2878b454ce3374e2cb219c4
SHA1 9e880a3d5cd613c8f1a6f23717ae51b80c730604
SHA512 ed9acc9edc35855b7a00c82d49418360e463cf8903e74ab54db20f8aad2322ef669a484280ba97ea7c8b1927851a8d2403a42bff0c99753a69622a63420cfe70
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHj7:fdsOT01KcBUFJFEWUxFzvHv
TLSH
T1C772785326E84248A1B6BE49AFB600750B79BD45AC3CCE7D05A0591E49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 a5f8a84b277610a682aa2411d4334757fef94537bdf1fa3866577fea97e16626
MD5 5c572d06705ecabbfd01e6e57d8a4594
SHA1 797396b6284e15fb4a9ef0996a807eed47e53517
SHA512 131d533d1707e0f27e91463d538b1c4afe9bfa2b1a7f728e42d892a7e21dfd16d705083f3d57e36d68108c6666c64d19889d8210cf031146861829eae9fab6b7
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVdF:UVqoCl/YgjxEufVU0TbTyDDalPF
TLSH
T13CD3F9337E29802FD45285F22C6AD66AB6211D353BA0AE0B3367BB146975307B5F131F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 cde856641739c97787b9a3e4b12759148b7e39a1b8ccc99ee3cfed9f88bdbdad
MD5 0c8db8e66045f5bc6805586d88dba644
SHA1 2eaef7ca5c59b4b2ade29eea7aa7cf5b8236033c
SHA512 3d91b333310cbf6cd37e4043fbf3e1c090f8ab67b99185d4e5a26383f4730e04252dab9ad91c2c0c87e335d388ee56e343a4d501212c8fcb584d1be396eb8894
SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalPXyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyw:UsLqdufVUNDatyyyyyyyyyyyyyyyyyyU
TLSH
T141D3F913BD18A06AC80689F17C6DEB6EBD215E321B94BC0B6362FB156971303B6F110F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 3bcbc551837f03558058667d8f48f6a1d1fd9a32269506c410f03ef9f99fb066
MD5 d248ec1527d244cd2e3c0cc2e84110f1
SHA1 2067aeb500451acfe50758ea352bdb6b85d8a19f
SHA512 84e0a16849ae7c37c13cbf65f46a80737c46215183b3d81d2d5f3dc215b6109c68ace39b598a4d4f3592ea2819860b1e894c4cd59f3f235491e6d75dc57ef3b7
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVdP:UVqoCl/YgjxEufVU0TbTyDDalPP
TLSH
T13CD309236E18606EE572C5F02CAD9B6DBA251F3617D1AC0BB262BB0275B174375F120F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 b61467389beafa551cb2806097945624cedf01297828ba76a8f8b09afa230e39
MD5 2376086450fb770236337ab68664d36f
SHA1 435763deb929a6ec3e0ae42382f67382aeec5ba0
SHA512 4d2acc9661288b74431e0ab853475a30b33f4dc985a8962b65234e316c4dc3a66131351eb6ad56842e1c46bb3b1848fb3dc32cfd9415b1e41791e6d1065837d0
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVdh:UVqoCl/YgjxEufVU0TbTyDDalPh
TLSH
T133D31823BE19902AD526C2F1ACA9D65BB9611E362BE4AC132393FF04657630775F430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/436-312-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3868-317-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3948-309-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4764-274-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4764-311-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4824-316-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6584-310-0x0000000000400000-0x000000000041F000-memory.dmp

Download