82853829f527c5af45eb7da1a1f347373f29d2529b473e2bc93cf58c368fbe14

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
Size 3.5MB
Sample260824-qdfjgade65
SHA256 82853829f527c5af45eb7da1a1f347373f29d2529b473e2bc93cf58c368fbe14
MD5 4217beefcb62cb06f5f0bf8a53984bf5
SHA1 3a2f817c328a29a1dd70fc1b75b6cbe4beedd320
SHA512 a36b98793c83ed39be11851a7d5dd7c16bf697af97cba5a9a24273955b4842374be1b94bd9cbebdaaba0bbc65d4b151655748744f4df5ed1636de6602a4d77c4
SSDEEP 98304:wXzhW148Pd+Tf1mpcOldJQ3/VPtCXWPSm3dm:EFK4s0TfLOdo/eCtm
TLSH
T19506E058004580ABE952EB3BBD9CEE576C38E9487ED7042D19632F8097F8F44D2674BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence themida trojan

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Detects executables packed with Themida 21 IoCs

resource	yara_rule
behavioral2/memory/5732-0-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/files/0x000d00000001c589-147.dat	INDICATOR_EXE_Packed_Themida
behavioral2/files/0x000d00000001c5db-160.dat	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2704-164-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/files/0x000d00000001c5e0-181.dat	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1160-182-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/files/0x000d00000001c5e3-193.dat	INDICATOR_EXE_Packed_Themida
behavioral2/memory/5180-195-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/3936-200-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/3936-205-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1160-206-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/5732-207-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4860-208-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/5732-209-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2704-211-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/5180-236-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/5180-237-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2704-239-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2704-256-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2704-263-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2704-280-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Executes dropped EXE 9 IoCs

pid	Process
5700	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
4860	icsys.icn.exe
1276	BlueStacksInstaller.exe
2704	explorer.exe
1060	HD-CheckCpu.exe
1160	spoolsv.exe
5180	svchost.exe
3936	spoolsv.exe
4516	HD-CheckCpu.exe

Themida packer 21 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/5732-0-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/files/0x000d00000001c589-147.dat	themida
behavioral2/files/0x000d00000001c5db-160.dat	themida
behavioral2/memory/2704-164-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/files/0x000d00000001c5e0-181.dat	themida
behavioral2/memory/1160-182-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/files/0x000d00000001c5e3-193.dat	themida
behavioral2/memory/5180-195-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/3936-200-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/3936-205-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/1160-206-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/5732-207-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/4860-208-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/5732-209-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/2704-211-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/5180-236-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/5180-237-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/2704-239-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/2704-256-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/2704-263-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/2704-280-0x0000000000400000-0x0000000000A16000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
4860	icsys.icn.exe
2704	explorer.exe
1160	spoolsv.exe
5180	svchost.exe
3936	spoolsv.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
1276	BlueStacksInstaller.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
4860	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2704	explorer.exe
5180	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1276	BlueStacksInstaller.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
4860	icsys.icn.exe
4860	icsys.icn.exe
2704	explorer.exe
2704	explorer.exe
1160	spoolsv.exe
1160	spoolsv.exe
5180	svchost.exe
5180	svchost.exe
3936	spoolsv.exe
3936	spoolsv.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 5700	5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe	89
PID 5732 wrote to memory of 4860	5732	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe	90
PID 5700 wrote to memory of 1276	5700	2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe	91
PID 4860 wrote to memory of 2704	4860	icsys.icn.exe	92
PID 1276 wrote to memory of 1060	1276	BlueStacksInstaller.exe	93
PID 2704 wrote to memory of 1160	2704	explorer.exe	95
PID 1160 wrote to memory of 5180	1160	spoolsv.exe	96
PID 5180 wrote to memory of 3936	5180	svchost.exe	97
PID 1276 wrote to memory of 4516	1276	BlueStacksInstaller.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732
- \??\c:\users\admin\appdata\local\temp\2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
  c:\users\admin\appdata\local\temp\2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\BlueStacksInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\BlueStacksInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\HD-CheckCpu.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\HD-CheckCpu.exe" --cmd checkHypervEnabled
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\HD-CheckCpu.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\HD-CheckCpu.exe" --cmd checkSSE4
      4⤵
      Executes dropped EXE
      PID:4516
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4860
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1160
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5180
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-23_4217beefcb62cb06f5f0bf8a53984bf5_elex_stealc_stop_tofsee.exe
Size 927KB
SHA256 801895b346e936c1a7958135c285bab8d337e2d908e7d7b2fca4e3c39a786ed7
MD5 5b5e302ba092181293e75327331aa1dd
SHA1 2cb04bc01bec6a503589cd1e6b11a1f72cfb1940
SHA512 c63c4b2e72c2402357b4ca2e79d3797a9b2f0ec724c69f52c71d458da9f73e95674018f74f3455fd02737b2195b1e4d26e8e0403a25da6bb9f82d37e3fde66b8
SSDEEP 24576:rivtCXWeGK//NGzTukzxN660tLiYl7QNM2:OtCXWPS/m3q64LJ9QNZ
TLSH
T18915DF8C21A1C077CA530FF285E4DF672015F9913B23A52EE6952E997A70E924BF7133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backicon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\backicon.png
Size 15KB
SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
MD5 7ff5dc8270b5fa7ef6c4a1420bd67a7f
SHA1 b224300372feaa97d882ca2552b227c0f2ef4e3e
SHA512 f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef
SSDEEP 48:b//6zMh8k29WJsEvda/PSeld0/u1BLW3qLWoxN+Y9rNGZGvsc5uG7yUWT:b/Ss8kEWmkGPMAxNXrNGZGvsc5VyUA
TLSH
T1D36250A4FDF17565D849F6321DC168068C730B83EA809C86BACE8D277F01BE98C4F196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

change_hover.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\change_hover.png
Size 310B
SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
MD5 57092634754fc26e5515e3ed5ca7d461
SHA1 3ae4d01db9d6bba535f5292298502193dfc02710
SHA512 553baf9967847292c8e9249dc3b1d55069f51c79f4d1d3832a0036e79691f433a3ce8296a68c774b5797caf7000037637ce61b8365885d2a4eed3ff0730e5e2a
TLSH
T14AE02DC28308903CC3070C22602281E6E63E04D4292238024890C2382E64D0CD4187B1
MD5 SHA1 SHA512 TLSH

Submit Download

close_red.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\close_red.png
Size 15KB
SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
MD5 93216b2f9d66d423b3e1311c0573332d
SHA1 5efaebec5f20f91f164f80d1e36f98c9ddaff805
SHA512 922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32
SSDEEP 48:2/6FwMlYk29WJsEvkch6/Clu5tlL88Lem/fLu5A/luaxN+Y97sc52G7Z+EazEyIc:2SFvYkEWmDCccHAxNX7sc5dZabT
TLSH
T1CA625065BDF075A65589F5322CC564055C730B83DAC09C88FACE5C2B6F01BEA9C1F58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

custom.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\custom.png
Size 17KB
SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
MD5 03b17f0b1c067826b0fcc6746cced2cb
SHA1 e07e4434e10df4d6c81b55fceb6eca2281362477
SHA512 67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2
SSDEEP 96:wkEWMrbxNXW5G53p1pCcXdV8WMIPX7kTCM4:wkEdV8WM4YWM4
TLSH
T168727229FDF2B2EC450A523339C654015D7307C3E681AC85BACE8D162F21BDD8C8F659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\discord_icon.png
Size 564B
SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
MD5 9354bc445e979c2de9b9eedd9b7c8318
SHA1 8dc3e8fdcad0fcdad1fe19b0b94b676e8846affd
SHA512 ad13f6bf46dd8cb48a030e720c1c577a22b0d3dec794ae807aa482474fe6c2bead7fc63dd45983fb3ab82034d74d4f10b6d9967d4ff677d2226c6c18ee03a4d6
TLSH
T118F096F97D43D827F042101E764B64906C35F5782B32BB2E7588800C790F7B8522B6B0
MD5 SHA1 SHA512 TLSH

Submit Download

folder.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\folder.png
Size 298B
SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
MD5 8fc519ef684dc58830e462581184eb15
SHA1 cba35cdbb9b87c359b287b13c30a4d2984289ed6
SHA512 fb5cd6fde1b04901cc25508e7011250645d74eafd58a415b2702b04860d76266e0d6a8e9686532a946b2e534bce5cddab53f7f030930852dd4a030e1e4e49f8a
TLSH
T17EE07DD5936D2DAE6CAB812D06364647947B55192451000CDD057568212C96BE05B702
MD5 SHA1 SHA512 TLSH

Submit Download

help_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\help_icon.png
Size 1KB
SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
MD5 3c955d2be56f76de8a53f77e816f3fb8
SHA1 0c242256f7934e2d857f657ddc7f50589cf489f1
SHA512 2b4ce8453960de520bdccb658d72b55be3c3386b1d394f3acf7269405971843083d0e04d3af05758ac4b8d191ea6a61ea5313a07fa849bcdf1f8eb4d5624521c
TLSH
T18711E9C919D95DF055BB43FB00D407175F784E7225ADC34DF296653C981ED21506C78A
MD5 SHA1 SHA512 TLSH

Submit Download

info_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\info_icon.png
Size 929B
SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
MD5 8f73ec5e7100a0ec232e06e5b3786963
SHA1 15c7bb268803932192a064a4eedc9db42bd6c37c
SHA512 c628dede37fec439a849ab6704046210bdabb1bb576a5c5dae9a28b52ad021307347211ba2aecb47ef836f14e914ba18617b21863bce12bc406513f45c9eb66e
TLSH
T14B11C89128DD586A881E02B2951D97021FFEE03F89B4F40A3D83205F2821045B04A94B
MD5 SHA1 SHA512 TLSH

Submit Download

installer_bg.jpg

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\installer_bg.jpg
Size 78KB
SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
MD5 3478e24ba1dd52c80a0ff0d43828b6b5
SHA1 b5b13bbf3fb645efb81d3562296599e76a2abac0
SHA512 5c8c9cc76d6dbc7ce482d0d1b6c2f3d48a7a510cd9ed01c191328763e1bccb56daeb3d18c33a9b10ac7c9780127007aa13799fa82d838de27fbe0a02ad98119d
SSDEEP 1536:/8jAVIA5IyKedQSsmprMWI/xKdefJeGhuvIDU1pY7EQGZRV3/X35ev:IAVPVsylI/xJfJHovsU1poEBZP/H5ev
TLSH
T15473F1DC3E9FDDD855E1A3964224A3ED3E99B85E258FFD8CB8200506705A4E37DE7012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_logo.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\installer_logo.png
Size 9KB
SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
MD5 f9db10032266ce8276c922b24de2d60f
SHA1 9c7bc3e277a58c4b59e35b9622e2b7f076ebb2fc
SHA512 9e5e1e345815ff9e815f63a892724bccb2b1fe19d5db91750f681899af6ba52aa3fc9214ef6bcc691a1e7ab9a1c16c093c398544e1f57f0ad5dc883776f657b6
SSDEEP 192:fsCXsMtWAC+DwSuWzRNrk2SEDAnQfQhzNoxiw2H6v3LGAEv3BsBW/V:fsCXs1Az4WVNrLnDAnDboG5AkxeuV
TLSH
T1C322CFA1101DF0A3E72A94B1D0D97E6D936F790D3BFB710D86802DEA80930680359FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_minimize.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\installer_minimize.png
Size 113B
SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
MD5 38b539a1e4229738e5c196eedb4eb225
SHA1 f027b08dce77c47aaed75a28a2fce218ff8c936c
SHA512 2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc
TLSH
T162B02BC13608FC34C64E0935416290009921001D011024101E0500680C1B19051A4F00
MD5 SHA1 SHA512 TLSH

Submit Download

loader.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\loader.png
Size 279B
SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
MD5 03903fd42ed2ee3cb014f0f3b410bcb4
SHA1 762a95240607fe8a304867a46bc2d677f494f5c2
SHA512 8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857
TLSH
T17FD0EB93F339AC52F8018213C788083CD2FA26852E476E4C022A8CB60280D3E8AE018B
MD5 SHA1 SHA512 TLSH

Submit Download

logo_text.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\logo_text.png
Size 4KB
SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
MD5 1fbdb2b7efcae8e9f26b6536ab580968
SHA1 126386cb7c0e8a03d99acb19ec2b13a70114a7d5
SHA512 1a0218122948b7d93dd473f21512bd2411f902ff133b15bf80d36ff474cf29d53880ed0ab38ef76d8288784817e6fc49f54d85f106c97f620331e31d03d6fa73
SSDEEP 96:ucBdj0UbKsYpguE2VTlrtyQnN9EHRs8nTOCCC2Jm0ciOqT3YKU6Y4R4MKYb+OI:u2yVQQYQnARxTGJmxiOKYM6WSOI
TLSH
T148A19FC5C2856BF4B85286C79713EC474513D2052200AB171DF47CEF9441A21AF60EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setpath.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Assets\setpath.png
Size 15KB
SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
MD5 b2e7f40179744c74fded932e829cb12a
SHA1 a0059ab8158a497d2cf583a292b13f87326ec3f0
SHA512 b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c
SSDEEP 96:iS5YkEWmE5+W+BxNXrNGyxGvsc5RxZ8af:iSqk6C+z5mf
TLSH
T10E624E65FDF0B565D989E2322DC928025C730B83D6809D45BACE8CA72F00BE98D5F593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\BlueStacksInstaller.exe
Size 642KB
SHA256 314db9f6f47a876f02e5cc65119b68a64384c5c88a3539e4e6ba11a15a11b2dd
MD5 3c0976746202fdd5fb38cb1529845cf0
SHA1 2c36305fb7f5b31b0d31d893294e263485622a12
SHA512 ab90fddd4dc6c6d7c4b3b80e602ea7185c7e4fd7cbd169000f35ffe21c2fe01277ba5cb115e3dc69ec41e792001fada27b7de3c4aaeb407e7180a2fab4ab8ff0
SSDEEP 6144:bq3WNcXmfpCIwkJFgnF8M338MsRO+WQ66Eavy2p3+uwBeXmzS/0wvB5bqlMCQVb6:bDN7fpCIxcuX93+xBeD0wvB5b6MCyxY
TLSH
T1DAE4294423F4886AF2BF4FBA98F14E174A72FC467A62D31E4141584E2DB1B419EB6733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\BlueStacksInstaller.exe.config
Size 324B
SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
MD5 1b456d88546e29f4f007cd0bf1025703
SHA1 e5c444fcfe5baf2ef71c1813afc3f2c1100cab86
SHA512 c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6
TLSH
T1C9E0C21941D8FD2B5D734B13A3128852EFB0A2A391A4544CF0EE7F830F3308A6697332
MD5 SHA1 SHA512 TLSH

Submit Download

HD-CheckCpu.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\HD-CheckCpu.exe
Size 200KB
SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
MD5 81234fd9895897b8d1f5e6772a1b38d0
SHA1 80b2fec4a85ed90c4db2f09b63bd8f37038db0d3
SHA512 4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16
SSDEEP 3072:KjDeWjpu716WoCYv8NBa3eSx8LHGYwj6V4NL1q7HOAg0FujFfnk601hWNxK:opcoCYv8Xa3eSqL8j/3AOpNq
TLSH
T1FA147C10B4C18433D9B715314DF8DAB99A3DB8110B2559EB73D80B7E4F346E3BA31A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JSON.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\JSON.dll
Size 411KB
SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
MD5 f5fd966e29f5c359f78cb61a571d1be4
SHA1 a55e7ed593b4bc7a77586da0f1223cfd9d51a233
SHA512 d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be
SSDEEP 6144:GmyZXnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwd:GmIWtWrnngnnnKnanxNYhX
TLSH
T11F947250D8535838CA244778BA7396B02DF9EC718A07E6716B207EE7F13BA20ED75532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.en-US.txt

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\Locales\i18n.en-US.txt
Size 21KB
SHA256 945cbd36495c301dcf1cad837a4147479077974bce2790a3cb3961c9c71f22e2
MD5 b5d651273bada061fcff78edaf4d32ef
SHA1 9f56763bd4e373b3f186568d323521fdc7271a73
SHA512 1b1778caf39af7531610e91704a86f41065469c21dbe5ba1723923e2cf9944e812c5be497618f36471b4b002f280da3de25fd348039cbf380c81b598f1fddc23
SSDEEP 384:aBvGq6rKPsL/ds89JplYTWfUvcABRGjV+qXOJtUmEIpNnU6+FKvtCFV30Y4TWEaj:aBvGqaKPsL/ds893l+WfacWRGjV+qXOc
TLSH
T145A22B8FD777136CAAD1011A94E93542A517B35B33693A11BCACC03B1B5790E133EADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThemeFile

Path C:\Users\Admin\AppData\Local\Temp\7zS4463AE69\ThemeFile
Size 80KB
SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
MD5 c3e6bab4f92ee40b9453821136878993
SHA1 94493a6b3dfb3135e5775b7d3be227659856fbc4
SHA512 a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895
SSDEEP 1536:Vq0UZUzBB6YjhX8knUVXVqlp1D88p/LUP8f/MPFntuevdxG+PchojU1yZwbP8fZS:pUFmL
TLSH
T178832B9DEADD3C39323F52AEB6361453C847301B7912896ABA1F21215FBC89F3417B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_bg_1.jpg

Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_1.jpg
Size 30KB
SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
MD5 efb63876389c300433587a29ce85f258
SHA1 8eb00659e003a934c8538b6e5a2be65ea097e5c9
SHA512 3c4a935f949e70199333889ba54870930858e54bf2ee0ac2a27f814710264ae30c474c4cd9e59835cc9bdc9da8c7eb25b963f02ee34767b3738f43988084059d
SSDEEP 768:/8PY3wdSnzEdbnEnqTE6PBtA2Gi5DTglr3cBt41FD98/AX16gANg+IL02U:/8zygdbEniHHPZBBtsD98Md+IRU
TLSH
T1D4E2E1A8BB15C36FED990F74DC3783442B2C1D7AC83402F5A265A032EC5626ABC98249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 2.6MB
SHA256 95c0bb180042ebed7c435a6fea6754619e4409c6de24c7c3802f13bda876e99b
MD5 a33d718e02e03940ccea22c71ca0af41
SHA1 5be522726922f7f15ac3449168a128ec9c674cc6
SHA512 ef6d537d8bea12b7f06eec7ddcb2e20c535c26bd1c20712832ff6a690ca3f10fe78a6442dab1d6dadc4e0f098d16ae600a5130566801007af0954c81356e36f1
SSDEEP 49152:wXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVF:wXzhW148Pd+Tf1mpcOldJQ3/VF
TLSH
T1ADC5D197FF41C44EFB902EF53672253FEA3A813A715CBAE23B5960229014CF85E1E915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 2.6MB
SHA256 b272e0f59830405e82cfc019143b257346ede4e138c16f637a4aebcd64f80567
MD5 40f847806c73db7dc01cc008fdf365c0
SHA1 c8354653b26a9dcefc30dc486e8a69b39884946c
SHA512 7b337a0f1eeec22d36d33b15edbb4c26ae8867ddf15774de594e9053c040fc5212a29149030b0c9917e5010a2801495ef3a8a5f3bc7f632774c7b8039847724d
SSDEEP 49152:wXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEV0:wXzhW148Pd+Tf1mpcOldJQ3/V0
TLSH
T18EC5D068414A418FF9A0EA3B7E9DE8556C38D99DBDDA042D19633BC0C7F8F45D00A8BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 2.6MB
SHA256 ae630c03a28386d5047d5b3e6a0dbfbbf9986c2743580da3dfba2d03b2c5cd59
MD5 9ac41589b498958230a48e759eaf0db8
SHA1 5c7129ecf52684fb21f26a9905cc664b513ce6ea
SHA512 41eb16c0cb3f02252949115cd8a2c21d848b9e691ef7bb5130a0b601599a2fa4158add3bb25e4fb9d4a58bf3850e27ee1bd4683724a2745f2d95553943f19240
SSDEEP 49152:wXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVH:wXzhW148Pd+Tf1mpcOldJQ3/VH
TLSH
T102C5D0B600DAA787FDC6273E301748BD2938E8DE5B3DC91908B48B52E7374562761B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 2.6MB
SHA256 9691c1e93a750cf580c7feecf87228d81d000dbff11f98f99f17df6d9bcd70cb
MD5 647cfe67b7f4cb7542d6684fd2113207
SHA1 0c6879835002c002a4bf0cf4eee85ac4b1e31e38
SHA512 81d4def677b266491e9e1562e82e8657ce457b644b29210eb26f426af06a6e83b49a1fd34b17b310f293c3a87e48f181d96186bbfd9863e5eedf245de9d8822b
SSDEEP 49152:wXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVa:wXzhW148Pd+Tf1mpcOldJQ3/Va
TLSH
T108C5E1F53608615BF56DF2B87F8C6895CD0D9F9342FA11DB09848B6132E30A8DB0B9B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1160-182-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/1160-206-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/1276-153-0x0000000000830000-0x00000000008D4000-memory.dmp

Download

memory/1276-155-0x000000001B590000-0x000000001B5F8000-memory.dmp

Download

memory/1276-184-0x000000001FEB0000-0x000000001FEEE000-memory.dmp

Download

memory/1276-224-0x0000000001200000-0x0000000001208000-memory.dmp

Download

memory/1276-170-0x000000001CA10000-0x000000001CF38000-memory.dmp

Download

memory/1276-185-0x000000001CA00000-0x000000001CA0E000-memory.dmp

Download

memory/2704-256-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/2704-164-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/2704-211-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/2704-263-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/2704-239-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/2704-280-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/3936-205-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/3936-200-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/4860-208-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/5180-237-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/5180-236-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/5180-195-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/5732-207-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/5732-0-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/5732-209-0x0000000000400000-0x0000000000A16000-memory.dmp

Download