0a51365691744f53cbc69ad5a1daca9e8238c0eb8727329069fde7d73d302f81

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.exe
Size 5.7MB
Sample260819-hc7mkazzfv
SHA256 0a51365691744f53cbc69ad5a1daca9e8238c0eb8727329069fde7d73d302f81
MD5 07ce76b75e635ce82d252667a645145c
SHA1 0b84ab808050eb97034e13f8b9bef570018ef204
SHA512 88bab1eeb30a45b2400c1c0897db473f6425ffe9c5ec9f0b33cd9fa77cacfbd20b018b224c92df67dbd90d3445a5d11ec5adb1d9287ec6df1018aaad8b40097b
SSDEEP 98304:TL3se/ez3jgnKmmsOXv6nthzqpFq8f3Jwd26aLcUh7Le3e/lzPPgDIftK4vOgk8:38e/eXkvmjItNq2o0Na9hvR/lsDF4GP8
TLSH
T1555633233690A673C0570570C28EABB569B7BA3316398657FB546F2E2E31744DC6B30E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\lsass.exe	2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.exe
File created	C:\Windows\SysWOW64\drivers\lsass.exe	lsass.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmd.pif	lsass.exe

Executes dropped EXE 3 IoCs

pid	Process
3384	lsass.exe
3360	2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.~tmp
1288	Setup.exe

Loads dropped DLL 4 IoCs

pid	Process
1288	Setup.exe
1288	Setup.exe
1288	Setup.exe
1288	Setup.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	lsass.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.~tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1288	Setup.exe
1288	Setup.exe
1288	Setup.exe
1288	Setup.exe
1288	Setup.exe
1288	Setup.exe
1288	Setup.exe
1288	Setup.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4976	2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.exe
4976	2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.exe
3384	lsass.exe
3384	lsass.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3384	4976	2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.exe	88
PID 4976 wrote to memory of 3360	4976	2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.exe	89
PID 3360 wrote to memory of 1288	3360	2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.~tmp	90

C:\Users\Admin\AppData\Local\Temp\2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\drivers\lsass.exe
  "C:\Windows\system32\drivers\lsass.exe"
  2⤵
  - Drops file in Drivers directory
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3384
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.~tmp
  "C:\Users\Admin\AppData\Local\Temp\2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.~tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\88733573eb191cc917\Setup.exe
    C:\88733573eb191cc917\\Setup.exe /x86 /x64 /lcid 1045 /lpredist
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LocalizedData.xml

Path C:\88733573eb191cc917\1033\LocalizedData.xml
Size 80KB
SHA256 e4ec814ecb215c2f83ab2d6da5ae80d6ebdc015da2ea8f028657f35e632c4540
MD5 ffd712ff1645648321ed91117f981017
SHA1 bf53f8ce3a4750b7fc4b6569fc5ef7ea20494450
SHA512 f633fe71f63fd8661174636232ad07e387c38a52dd0dcc0f8573376ca411a61e870d11c95cc537eacc5f381ea372c830814b5c5857848672f2b4469eeafa1533
SSDEEP 384:4go89tJKVQVfVjV2vjaCS8etgcsFTeyfg8NqJpR+enRROu5aeJInO/yJakC65qWA:2eyfJqyJiT
TLSH
T127837E11AFFE2258F1BBAB14BEB710940EB7BD915C39C11D0099188E8A77F858D25F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\88733573eb191cc917\1045\LocalizedData.xml
Size 85KB
SHA256 5a8590a5f330368b9d36596d88237af30f43601eb139166ec637b9a8308978be
MD5 1e2a5cfa76c45bd26c6700023a0877a6
SHA1 419fc0663b047b8c46b83edf44f7b86bb3e4d79b
SHA512 7a8903b6b771bb112ce2954cc0539784bcc3d3bf5ead25133d9388696e181d582a35755941b1642e9255878bb49b30de7018792c3756f1685123ee84b77c2837
SSDEEP 768:npUuGp9Vi0iG0XE2Uq4DplOe6lsQjPLJbOzdH:uCjJyZ
TLSH
T14683BF11AEFA2218F1FBAB44BEB710944EB7BD91AC35C11D0059298E4A77FC48D25F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupResources.dll

Path C:\88733573eb191cc917\1045\SetupResources.dll
Size 31KB
SHA256 b210f771c66287b1464ec83582caf6154374dd384744776f96d8e4b54225f7a3
MD5 7d59db3b19c949db643f0a7f3659222f
SHA1 b565dbf54d667a86e044c6f4cbdb022132854639
SHA512 e4740b6051a4da1670aa6da0edf000b4c273c2aeb240aa58cf7dbe75712fc09a7ae607bcc51ab80ee33c703564f15c16ff8cc63460c869cca19cfb2c4b0cc653
SSDEEP 384:8V05/Q+CNfvaRr2CWseWKZ6F0GftpBjncc4HRN7Julbj62tva:RqVoKs+iyB2va
TLSH
T159E2B541A7F84502FAF36F70A6B5D6D25E3EBE536A30C25F2651E18D18A1BC0DA10B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DHTMLHeader.html

Path C:\88733573eb191cc917\DHTMLHeader.html
Size 15KB
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
TLSH
T1B672765326E84248A1B6BE49AFB640750B79BD45A83CCE7D05A0591F49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ParameterInfo.xml

Path C:\88733573eb191cc917\ParameterInfo.xml
Size 1.1MB
SHA256 7a4fbba072f53b62d38736a8b0255f380806673d82467179609a3516e0ad80ae
MD5 5c824bd35544d4b87d9df3db8a1ded55
SHA1 c23e1e48d8f397df6c53f524a32f0eadce08974f
SHA512 624bf37a0c7d4f503d07bbbcafc43ce3ea6261448849159fcd607705f8649c701bf79ee8b5d76e89779317243bc92ba53f60f0db48735b324013277a813f779c
SSDEEP 1536:8QiOahVFiGXZiDYhsZitZiDAhsZi7ZiDDhsZiUIl:89Il
TLSH
T115459C1123FA0305B3B36E257AF5889A897B3892DC34C79C405D558E97B3E84CA72F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\88733573eb191cc917\Setup.exe
Size 125KB
SHA256 fd54615d479e33197b7a63873e7468f3e2e5467bdd4384d6471b4d8009f13dcf
MD5 d8bdc90b8d9c47548b0789b33c93b266
SHA1 e2287110a405c2988f49a61d859455d41eac7215
SHA512 687cdd99c2ce3075b9cbc8f4113fa2245b01c93607bb15396ea26406eca53181998aa124452dbb4681492e29e273bd14a1b427953e59ade17aa27bbbaf249b14
SSDEEP 3072:EKLmagUSSQC4XeDOkeotvmX/gBJnUUQ7I:iUKCbAX/0UA
TLSH
T163C36B43B5D0C4B1D476093108B6CAB25D3E7E624F604EAB3398762E1E713D1AE36D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupEngine.dll

Path C:\88733573eb191cc917\SetupEngine.dll
Size 901KB
SHA256 d199d038d59d3b6a219258009635699226d835bf9163357e9458352b6578b157
MD5 87125d428eb7b400af6822af0c4e72dd
SHA1 67dc6ef3ae8e32fda9e941d450ae9e0adbcf3982
SHA512 d4ca91b014557827449426d00689f86599a6d7bdd231c358d1666001dfa73d54e199b695a8cb5c21aab7e191b01bdc7e031d6a9288af27b6b271f736d963ceb6
SSDEEP 24576:IG2ynlYAXALWhWcjb0Ei546gDudOvp/RfZG8xV:IG2ynlYAP0E246gK8h/p48xV
TLSH
T10A152B113EECC075E3BF173079B86916A97AB8304B31D58F22909E6D2E35ED25970F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUi.dll

Path C:\88733573eb191cc917\SetupUi.dll
Size 342KB
SHA256 3b9822668816a77b623258f8036120eaa5da5d74b16aadfc601cb0e513a56461
MD5 e31641c114d66ea24d79ed4032269dd0
SHA1 911fd6d8e62c61a76a464306f84c9b80e93467aa
SHA512 dc7377cadda1bf63c7df267f3313f916a92363004ab8859e6f3a77aa7938d20de0f6857b8842e6424de2749cf6686f35898002054d8f9c4ed4f5775035cec54c
SSDEEP 6144:vTjfyZYXoH/6pPjW8CXunm+BgS1zd0yB8h:vuYLPK8m+BN1ZPB8h
TLSH
T120748E1076D58031E17F5630B96996A499EDB8B00BF0C1CBFF849B5E2E35AE25E30F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUi.xsd

Path C:\88733573eb191cc917\SetupUi.xsd
Size 31KB
SHA256 aaf8cb1a9af89d250cbc0893a172e2c406043b1f81a211cb93604f165b051848
MD5 a9f6a028e93f3f6822eb900ec3fda7ad
SHA1 8ff2e8f36d690a687233dbd2e72d98e16e7ef249
SHA512 1c51392c334aea17a25b20390cd4e7e99aa6373e2c2b97e7304cf7ec1a16679051a41e124c7bc890b02b890d4044b576b666ef50d06671f7636e4701970e8ddc
SSDEEP 768:hlzLm8eYhsLP8s05GFaAMET/chT+cxcW8G2P4oeTMC:lwchT+cxcDm
TLSH
T1E7E227C631C1CA001B374832AD223B0DFED5A57382D43D61B5DCA637BB76AC62967279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplashScreen.bmp

Path C:\88733573eb191cc917\SplashScreen.bmp
Size 117KB
SHA256 b05141dbc71669a7872a8e735e5e43a7f9713d4363b7a97543e1e05dcd7470a7
MD5 bc32088bfaa1c76ba4b56639a2dec592
SHA1 84b47aa37bda0f4cd196bd5f4bd6926a594c5f82
SHA512 4708015aa57f1225d928bfac08ed835d31fd7bdf2c0420979fd7d0311779d78c392412e8353a401c1aa1885568174f6b9a1e02b863095fa491b81780d99d0830
SSDEEP 384:pu66qlxe0UqtcSiS2gLsd5xfAg+zqFv4t:LP
TLSH
T13FC3EF9C27BF054AE63AAF9A352546441B1EAE9437E03B8F5D3732CAB173341D788285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Strings.xml

Path C:\88733573eb191cc917\Strings.xml
Size 13KB
SHA256 2a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b
MD5 8a28b474f4849bee7354ba4c74087cea
SHA1 c17514dfc33dd14f57ff8660eb7b75af9b2b37b0
SHA512 a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369
SSDEEP 384:VqZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VqB
TLSH
T1B352834376FB2018B1B23ACA6FFBC1B4CF6675D00976462F0159204B87D7C1B6AA2776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UiInfo.xml

Path C:\88733573eb191cc917\UiInfo.xml
Size 35KB
SHA256 8f7847cfc9ec70b6758f6fbe9b98809ca7bf8ecb25bf9b3a8e7e052b83dfa94b
MD5 8ace169bf65675c089e0327d5b1f7437
SHA1 43646e29c878f58ac4b5d7c192d11b3becd9e9f6
SHA512 3e98f8351e96bab4b8cecf93e590c722233d119d7cec76445a0b170f69de647bd65eafeafecc8888573e986b3f80403480728c7a1e014961fbd60dc169ca5db7
SSDEEP 768:24URHd5vESguJQvFQXvDINJh6FmhPsrVsG8t+p3879km2VG9GMGNGTDKvefkfub:24URHd5vEQYQLIN/6FmhPsrVsG8t+p3+
TLSH
T191F216575BEB0118E2F6AA4D69B304705F1B7E45083AD13C04EC394DEFE7E6289A07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

print.ico

Path C:\88733573eb191cc917\graphics\print.ico
Size 123KB
SHA256 d80ffeb020927f047c11fc4d9f34f985e0c7e5dfea9fb23f2bc134874070e4e6
MD5 d39bad9dda7b91613cb29b6bd55f0901
SHA1 6d079df41e31fbc836922c19c5be1a7fc38ac54e
SHA512 fad8cb2b9007a7240421fbc5d621c3092d742417c60e8bb248e2baa698dcade7ca54b24452936c99232436d92876e9184eaf79d748c96aa1fe8b29b0e384eb82
SSDEEP 192:ly3ul6MeeS80xxb11yXXVzzzzzlzTTTbt/Pu:lj6MeeSXxxb11yXXVzzzzzlzTTTbt/Pu
TLSH
T191C324636ADE7DD6D0B866B13B7783D1C70EEE058922D02EA2D4366AD17D5037A433C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

save.ico

Path C:\88733573eb191cc917\graphics\save.ico
Size 123KB
SHA256 1372c7f132595ddad210c617e44fedff7a990a9e8974cc534ca80d897dd15abd
MD5 c66bbe8f84496ef85f7af6bed5212cec
SHA1 1e4eab9cc728916a8b1c508f5ac8ae38bb4e7bf1
SHA512 5dabf65ec026d8884e1d80dcdacb848c1043ef62c9ebd919136794b23be0deb3f7f1acdff5a4b25a53424772b32bd6f91ba1bd8c5cf686c41477dd65cb478187
SSDEEP 192:cICfR9iBLLLLLLiii1dkx2Xwi+XI7b6ZZZZZZZZZZGGGGys7v5Z7vvvvvvvvvvwF:H2R9iJJi56ZZZZZZZZZZGGGGyHIIIhh0
TLSH
T1BEC3BE07AAEDBEDBD085A271FB3982B1DEE0ED1D4721404E76F9A666E471E1331020DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.ico

Path C:\88733573eb191cc917\graphics\setup.ico
Size 123KB
SHA256 a0c7b4b17a69775e1d94123dfceec824744901d55b463ba9dca9301088f12ea5
MD5 6125f32aa97772afdff2649bd403419b
SHA1 d84da82373b599aed496e0d18901e3affb6cfaca
SHA512 c4bdcd72fa4f2571c505fdb0adc69f7911012b6bdeb422dca64f79f7cc1286142e51b8d03b410735cd2bd7bc7c044c231a3a31775c8e971270beb4763247850f
SSDEEP 192:+7yhu1uz//TAAA555AAAAAr99899AubBqj:oX1uz//TAAA555AAAAAr998991bBy
TLSH
T1F3C3122366DEBDDAC4B467B03B77C3D5C71EEE554922D12EA2C0262A917E0437A433C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warn.ico

Path C:\88733573eb191cc917\graphics\warn.ico
Size 194KB
SHA256 4bb9ea033f4e93dbf42fc74e6faf94fe8b777a34836f7d537436cbe409fd743f
MD5 c8824ea3ce0a54ff1e89f8a296b4e64b
SHA1 333feb78e9bb088650ce90dea0f0ccc57d54a803
SHA512 c40e40e0cb2aaa7cf7cccbe29ca4530ff0e0a4de9a7328996305db6dfd6994cbe085fab7b8f666bbd3d1efd95406ea26b1376aa81908ace60dc131a4e9c32d40
SSDEEP 1536:cpUNHIL4Oj0qwL2IupGF8yJtJFFhxGgX/3/HRVq:8mHILxnDIiGFxG4s
TLSH
T12D1418526E2EBFC5F548B231D839C1B00910EE7948AA966B35F67E8B39772237431F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqmapi.dll

Path C:\88733573eb191cc917\sqmapi.dll
Size 221KB
SHA256 b236253e9ecb1e377643ae5f91c0a429b91c9b30cca1751a7bc4403ea6d94120
MD5 6404765deb80c2d8986f60dce505915b
SHA1 e40e18837c7d3e5f379c4faef19733d81367e98f
SHA512 a5ff302f38020b31525111206d2f5db2d6a9828c70ef0b485f660f122a30ce7028b5a160dd5f5fbcccb5b59698c8df7f2e15fdf19619c82f4dec8d901b7548ba
SSDEEP 3072:Dl5e8m9Z5G6ZUMIiaQVedGGEc6SYm8X/UvHFupHIjNNlMi/fbtcICcu0b9+x0o/l:gG6ZUon6GVSYmnGHEvlMMac59+xfbB
TLSH
T1172419D1E1F68071D3D2133072592377E9FAA92F2DD8BE8B1380E6573830982D76975A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.~tmp

Path C:\Users\Admin\AppData\Local\Temp\2026-08-19_07ce76b75e635ce82d252667a645145c_amadey_elex_redline-stealer_smoke-loader_stealc_strictor_tofsee_wannacry.~tmp
Size 5.6MB
SHA256 ad17c6a75cc6997bd0063d34c24e491ba2ae1136e4f4c83aa7e70ab9c2e69a66
MD5 18df17788d2f7d36e04448ccb0e99cc9
SHA1 f8c08fd80ebe9c265d0ade0ed312f77e78aa1d44
SHA512 ba71be1ac69baa423af4506de1ba1cf983a2f3dab1af3c9581536e46c8121fa15cf988c7eb55a2ffd17ee7dd15b114a5c84465bf32e799f4bea1bd138b14f83d
SSDEEP 98304:WL3se/ez3jgnKmmsOXv6nthzqpFq8f3Jwd26aLcUh7Le3e/lzPPgDIftK4vOgk8j:e8e/eXkvmjItNq2o0Na9hvR/lsDF4GP0
TLSH
T1FA5633333290A673C0571570C2CEBBB52CBBBA3312358616FB556B2E2E71794D96730A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HFIF11E.tmp.html

Path C:\Users\Admin\AppData\Local\Temp\HFIF11E.tmp.html
Size 16KB
SHA256 ce73e2932fba9141be4ffbb782447218168174658dc867fe5c4e918bdbe39eb8
MD5 c77308d4891610b4bf264d525624aae4
SHA1 c63fdf04df4fde24f2e77f967d145d3b733531ab
SHA512 ecc4f056ca49bd49511c1449dcecfcdab5fa263b71ee12fc502d63e6d384046ba001a9ca1dcc3b89fc879f0f7b56da68429072a3ad5c192b21d342322041d03a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjb:fdsOT01KcBUFJFEWUxFzvHv
TLSH
T12672785326E84248A1B6BE49AFB600750B79BD45AC3CCE7D05A0591E49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Windows\SysWOW64\Drivers\lsass.exe
Size 32KB
SHA256 c497ea69e53cfffbc4fe5fb47210eaa33ea0af661076449825e7d520942817a5
MD5 e281b96b27ef494ed21823a91d9e221f
SHA1 bcf847a5b4de51140849a557afa3104a8e339596
SHA512 78d4608e2f1418766ea7c3230d48998db670be31793a9331fc5a764f0d7b6dd8eb60ea7700379aeb1720f03b2342d72987d189c0d802feef060198b1c055b903
SSDEEP 384:3brYXRlCzLvoxt1VdwBZsKXMbeC5BnKLWQRF0425UD:3bgjVt17wBaKXMSmRQRC48U
TLSH
T151E2190BBD978E82F518C970871B8BB9D2B316663E6D08CB47802D5E2D375418DAD71C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download