Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/08/2026, 19:35
Behavioral task
behavioral1
Sample
2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 400KB
- Sample260819-yayvmsgq8w
- SHA256 08cea8ff8b35916517d29591a5dd2baa4d12a51a6f3887660f0a36b9c988f5a2
- MD5 58ff17de038bde48e7d5b33222ac760e
- SHA1 be57a30ba8ffcdd1075519775a506b8dad56e6c3
- SHA512 7feb987e7b3f185e5fe6294a544a89f6241b1b6f974cacc1b77381eddad7ce96093f0afd7d3fbdf27034dedc6d7697c635a62999d4340b70b0a7c2fc654a9cfd
- SSDEEP 12288:mXkDNL2o8wE39uW8wESByvNv54B9f01Zm:9DNL2o8wDW8wQvr4B9f01Zm
- TLSH T1D6948D0273D1BE31CE5C18B05CE9B254522CD8E0BFABDBEF6545E789BDB2281D62D241
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
berbew
C2
-
http://viruslist.com/wcmd.txt
-
http://viruslist.com/ppslog.php
-
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhpgca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mkepineo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Namegfql.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nconfh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocknbglo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Klbgfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Leabphmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohncdobq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nakhaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kopcbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lknjhokg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Llpchaqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mclhjkfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ocmjhfjl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Poidhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nconfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ofdqcc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qbngeadf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qelcamcj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qihoak32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klbgfc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kaopoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Poidhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pkabbgol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Moefdljc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkabbgol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pbbgicnd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmjhlklg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kopcbo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkepineo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mddkbbfg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbbgicnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qbngeadf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llpchaqg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlgjhp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mddkbbfg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nfnjbdep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ofgmib32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocmjhfjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pdqcenmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdkoef32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Leabphmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkqgno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qihoak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kaopoj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mclhjkfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mhpgca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nfnjbdep.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qelcamcj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nakhaf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofgmib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ocknbglo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Podkmgop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kdkoef32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Moefdljc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ohncdobq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pmjhlklg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lknjhokg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Namegfql.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofdqcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Podkmgop.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdqcenmg.exe - Detects Padodor trojan 64 IoCs
resource yara_rule behavioral1/files/0x0008000000024597-6.dat family_padodor behavioral1/memory/4520-7-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x000700000002459f-15.dat family_padodor behavioral1/memory/924-28-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245a1-23.dat family_padodor behavioral1/files/0x00070000000245a3-30.dat family_padodor behavioral1/files/0x00070000000245a5-38.dat family_padodor behavioral1/memory/4400-39-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245a7-46.dat family_padodor behavioral1/memory/2720-52-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245a9-55.dat family_padodor behavioral1/files/0x00070000000245ac-62.dat family_padodor behavioral1/memory/4940-68-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245ae-71.dat family_padodor behavioral1/files/0x00070000000245b0-79.dat family_padodor behavioral1/files/0x000800000002459c-86.dat family_padodor behavioral1/files/0x00070000000245b3-94.dat family_padodor behavioral1/memory/3484-105-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245b5-101.dat family_padodor behavioral1/files/0x00070000000245b7-108.dat family_padodor behavioral1/files/0x00070000000245b9-115.dat family_padodor behavioral1/memory/1352-120-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245bb-122.dat family_padodor behavioral1/memory/2740-125-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245bd-131.dat family_padodor behavioral1/memory/3500-133-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245bf-138.dat family_padodor behavioral1/memory/1960-140-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245c1-147.dat family_padodor behavioral1/memory/2648-149-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245c3-155.dat family_padodor behavioral1/memory/2804-157-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245c5-163.dat family_padodor behavioral1/memory/948-165-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245c7-171.dat family_padodor behavioral1/memory/5072-173-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245c9-179.dat family_padodor behavioral1/files/0x00070000000245cd-196.dat family_padodor behavioral1/memory/556-201-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245cb-188.dat family_padodor behavioral1/files/0x00070000000245cf-203.dat family_padodor behavioral1/files/0x00070000000245d1-212.dat family_padodor behavioral1/memory/4720-216-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245d3-219.dat family_padodor behavioral1/files/0x00070000000245d5-227.dat family_padodor behavioral1/files/0x00070000000245d7-235.dat family_padodor behavioral1/files/0x00070000000245d9-243.dat family_padodor behavioral1/memory/1832-250-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/files/0x00070000000245db-251.dat family_padodor behavioral1/memory/2620-259-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/936-329-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/4520-331-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/4612-333-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/924-335-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/3808-337-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/4400-349-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/2720-351-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/5084-353-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/4940-355-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/2608-357-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/2432-359-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/4536-361-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/4068-363-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral1/memory/3484-365-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor - Executes dropped EXE 33 IoCs
pid Process 4520 Kdkoef32.exe 936 Klbgfc32.exe 924 Kopcbo32.exe 3808 Kaopoj32.exe 4400 Leabphmp.exe 2720 Lknjhokg.exe 5084 Lkqgno32.exe 4940 Llpchaqg.exe 2608 Mkepineo.exe 2432 Mclhjkfa.exe 4536 Mlgjhp32.exe 4068 Moefdljc.exe 3484 Mddkbbfg.exe 2360 Mhpgca32.exe 1352 Nakhaf32.exe 2740 Namegfql.exe 3500 Nconfh32.exe 1960 Nfnjbdep.exe 2648 Ohncdobq.exe 2804 Ofdqcc32.exe 948 Ofgmib32.exe 5072 Ocknbglo.exe 3264 Ocmjhfjl.exe 4936 Podkmgop.exe 556 Pbbgicnd.exe 1504 Pdqcenmg.exe 4720 Pmjhlklg.exe 3732 Poidhg32.exe 5044 Pkabbgol.exe 5008 Qbngeadf.exe 1832 Qelcamcj.exe 2356 Qihoak32.exe 2620 Amhdmi32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Llfgke32.dll Klbgfc32.exe File opened for modification C:\Windows\SysWOW64\Kaopoj32.exe Kopcbo32.exe File created C:\Windows\SysWOW64\Leabphmp.exe Kaopoj32.exe File created C:\Windows\SysWOW64\Moefdljc.exe Mlgjhp32.exe File created C:\Windows\SysWOW64\Namegfql.exe Nakhaf32.exe File created C:\Windows\SysWOW64\Abohmm32.dll Nconfh32.exe File created C:\Windows\SysWOW64\Pbbgicnd.exe Podkmgop.exe File opened for modification C:\Windows\SysWOW64\Qbngeadf.exe Pkabbgol.exe File created C:\Windows\SysWOW64\Dcmlbk32.dll Mkepineo.exe File created C:\Windows\SysWOW64\Mlgjhp32.exe Mclhjkfa.exe File created C:\Windows\SysWOW64\Nakhaf32.exe Mhpgca32.exe File created C:\Windows\SysWOW64\Bqpqlhmf.dll Ocmjhfjl.exe File opened for modification C:\Windows\SysWOW64\Pdqcenmg.exe Pbbgicnd.exe File created C:\Windows\SysWOW64\Amhdmi32.exe Qihoak32.exe File opened for modification C:\Windows\SysWOW64\Amhdmi32.exe Qihoak32.exe File created C:\Windows\SysWOW64\Kdkoef32.exe 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\SysWOW64\Lkqgno32.exe Lknjhokg.exe File opened for modification C:\Windows\SysWOW64\Nconfh32.exe Namegfql.exe File created C:\Windows\SysWOW64\Ofdqcc32.exe Ohncdobq.exe File opened for modification C:\Windows\SysWOW64\Kdkoef32.exe 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\SysWOW64\Llpchaqg.exe Lkqgno32.exe File opened for modification C:\Windows\SysWOW64\Mlgjhp32.exe Mclhjkfa.exe File opened for modification C:\Windows\SysWOW64\Ofdqcc32.exe Ohncdobq.exe File opened for modification C:\Windows\SysWOW64\Ofgmib32.exe Ofdqcc32.exe File created C:\Windows\SysWOW64\Pgoikbje.dll Ofdqcc32.exe File created C:\Windows\SysWOW64\Eflmkg32.dll Podkmgop.exe File created C:\Windows\SysWOW64\Cboleq32.dll 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Gpdkpe32.dll Llpchaqg.exe File opened for modification C:\Windows\SysWOW64\Mclhjkfa.exe Mkepineo.exe File opened for modification C:\Windows\SysWOW64\Ohncdobq.exe Nfnjbdep.exe File created C:\Windows\SysWOW64\Nnmmnbnl.dll Ofgmib32.exe File created C:\Windows\SysWOW64\Ocmjhfjl.exe Ocknbglo.exe File created C:\Windows\SysWOW64\Gkhikf32.dll Pbbgicnd.exe File opened for modification C:\Windows\SysWOW64\Poidhg32.exe Pmjhlklg.exe File created C:\Windows\SysWOW64\Najlgpeb.dll Leabphmp.exe File created C:\Windows\SysWOW64\Lkqgno32.exe Lknjhokg.exe File opened for modification C:\Windows\SysWOW64\Mddkbbfg.exe Moefdljc.exe File created C:\Windows\SysWOW64\Mhpgca32.exe Mddkbbfg.exe File opened for modification C:\Windows\SysWOW64\Nfnjbdep.exe Nconfh32.exe File created C:\Windows\SysWOW64\Pdqcenmg.exe Pbbgicnd.exe File created C:\Windows\SysWOW64\Qbngeadf.exe Pkabbgol.exe File created C:\Windows\SysWOW64\Qihoak32.exe Qelcamcj.exe File created C:\Windows\SysWOW64\Abggif32.dll Lkqgno32.exe File created C:\Windows\SysWOW64\Mclhjkfa.exe Mkepineo.exe File created C:\Windows\SysWOW64\Mddkbbfg.exe Moefdljc.exe File created C:\Windows\SysWOW64\Jcokoo32.dll Ohncdobq.exe File created C:\Windows\SysWOW64\Cogcho32.dll Pdqcenmg.exe File created C:\Windows\SysWOW64\Fddogn32.dll Pmjhlklg.exe File created C:\Windows\SysWOW64\Qelcamcj.exe Qbngeadf.exe File opened for modification C:\Windows\SysWOW64\Qelcamcj.exe Qbngeadf.exe File opened for modification C:\Windows\SysWOW64\Moefdljc.exe Mlgjhp32.exe File opened for modification C:\Windows\SysWOW64\Pbbgicnd.exe Podkmgop.exe File opened for modification C:\Windows\SysWOW64\Kopcbo32.exe Klbgfc32.exe File opened for modification C:\Windows\SysWOW64\Nakhaf32.exe Mhpgca32.exe File created C:\Windows\SysWOW64\Nfnjbdep.exe Nconfh32.exe File created C:\Windows\SysWOW64\Eobdnbdn.dll Ocknbglo.exe File created C:\Windows\SysWOW64\Pkabbgol.exe Poidhg32.exe File opened for modification C:\Windows\SysWOW64\Klbgfc32.exe Kdkoef32.exe File created C:\Windows\SysWOW64\Kaopoj32.exe Kopcbo32.exe File created C:\Windows\SysWOW64\Ieaqqigc.dll Lknjhokg.exe File created C:\Windows\SysWOW64\Mkepineo.exe Llpchaqg.exe File opened for modification C:\Windows\SysWOW64\Namegfql.exe Nakhaf32.exe File created C:\Windows\SysWOW64\Omclnn32.dll Namegfql.exe File created C:\Windows\SysWOW64\Pmjhlklg.exe Pdqcenmg.exe - System Location Discovery: System Language Discovery 1 TTPs 34 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kaopoj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Namegfql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Podkmgop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmjhlklg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Leabphmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfnjbdep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocmjhfjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qbngeadf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mclhjkfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlgjhp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbbgicnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkqgno32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkepineo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nconfh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qihoak32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kopcbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohncdobq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdqcenmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkabbgol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qelcamcj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amhdmi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lknjhokg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nakhaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofdqcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdkoef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llpchaqg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Moefdljc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhpgca32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocknbglo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Poidhg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klbgfc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mddkbbfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofgmib32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Leabphmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Podkmgop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Qbngeadf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Leabphmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjigocdh.dll" Mlgjhp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Moefdljc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ofdqcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ocmjhfjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlkjom32.dll" Pkabbgol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qelcamcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Moefdljc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mddkbbfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omclnn32.dll" Namegfql.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ocknbglo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abggif32.dll" Lkqgno32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kdkoef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Klbgfc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mkepineo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mhpgca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nakhaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ofdqcc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cboleq32.dll" 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mddkbbfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abohmm32.dll" Nconfh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pdqcenmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogcho32.dll" Pdqcenmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llfgke32.dll" Klbgfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kopcbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mclhjkfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mlgjhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipiddlhk.dll" Mhpgca32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Namegfql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nconfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcokoo32.dll" Ohncdobq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Namegfql.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ocmjhfjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eflmkg32.dll" Podkmgop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkhikf32.dll" Pbbgicnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fddogn32.dll" Pmjhlklg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pkabbgol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qbngeadf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmejnpqp.dll" Qelcamcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Llpchaqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcmlbk32.dll" Mkepineo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ofgmib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ocknbglo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Poidhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejcdfahd.dll" Qihoak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Qihoak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieaqqigc.dll" Lknjhokg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpdkpe32.dll" Llpchaqg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nakhaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqpqlhmf.dll" Ocmjhfjl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pmjhlklg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Llpchaqg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mclhjkfa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mlgjhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnmmnbnl.dll" Ofgmib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pbbgicnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pmjhlklg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhfhohgp.dll" Kdkoef32.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4612 wrote to memory of 4520 4612 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe 83 PID 4520 wrote to memory of 936 4520 Kdkoef32.exe 84 PID 936 wrote to memory of 924 936 Klbgfc32.exe 85 PID 924 wrote to memory of 3808 924 Kopcbo32.exe 86 PID 3808 wrote to memory of 4400 3808 Kaopoj32.exe 87 PID 4400 wrote to memory of 2720 4400 Leabphmp.exe 88 PID 2720 wrote to memory of 5084 2720 Lknjhokg.exe 89 PID 5084 wrote to memory of 4940 5084 Lkqgno32.exe 90 PID 4940 wrote to memory of 2608 4940 Llpchaqg.exe 91 PID 2608 wrote to memory of 2432 2608 Mkepineo.exe 92 PID 2432 wrote to memory of 4536 2432 Mclhjkfa.exe 93 PID 4536 wrote to memory of 4068 4536 Mlgjhp32.exe 94 PID 4068 wrote to memory of 3484 4068 Moefdljc.exe 95 PID 3484 wrote to memory of 2360 3484 Mddkbbfg.exe 96 PID 2360 wrote to memory of 1352 2360 Mhpgca32.exe 97 PID 1352 wrote to memory of 2740 1352 Nakhaf32.exe 98 PID 2740 wrote to memory of 3500 2740 Namegfql.exe 99 PID 3500 wrote to memory of 1960 3500 Nconfh32.exe 100 PID 1960 wrote to memory of 2648 1960 Nfnjbdep.exe 101 PID 2648 wrote to memory of 2804 2648 Ohncdobq.exe 102 PID 2804 wrote to memory of 948 2804 Ofdqcc32.exe 103 PID 948 wrote to memory of 5072 948 Ofgmib32.exe 104 PID 5072 wrote to memory of 3264 5072 Ocknbglo.exe 105 PID 3264 wrote to memory of 4936 3264 Ocmjhfjl.exe 106 PID 4936 wrote to memory of 556 4936 Podkmgop.exe 107 PID 556 wrote to memory of 1504 556 Pbbgicnd.exe 108 PID 1504 wrote to memory of 4720 1504 Pdqcenmg.exe 109 PID 4720 wrote to memory of 3732 4720 Pmjhlklg.exe 110 PID 3732 wrote to memory of 5044 3732 Poidhg32.exe 111 PID 5044 wrote to memory of 5008 5044 Pkabbgol.exe 112 PID 5008 wrote to memory of 1832 5008 Qbngeadf.exe 113 PID 1832 wrote to memory of 2356 1832 Qelcamcj.exe 114 PID 2356 wrote to memory of 2620 2356 Qihoak32.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\Kdkoef32.exeC:\Windows\system32\Kdkoef32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Klbgfc32.exeC:\Windows\system32\Klbgfc32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\Kopcbo32.exeC:\Windows\system32\Kopcbo32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\Kaopoj32.exeC:\Windows\system32\Kaopoj32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\Leabphmp.exeC:\Windows\system32\Leabphmp.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\Lknjhokg.exeC:\Windows\system32\Lknjhokg.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\Lkqgno32.exeC:\Windows\system32\Lkqgno32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\Llpchaqg.exeC:\Windows\system32\Llpchaqg.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\Mkepineo.exeC:\Windows\system32\Mkepineo.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\Mclhjkfa.exeC:\Windows\system32\Mclhjkfa.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\Mlgjhp32.exeC:\Windows\system32\Mlgjhp32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\Moefdljc.exeC:\Windows\system32\Moefdljc.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\Mddkbbfg.exeC:\Windows\system32\Mddkbbfg.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\Mhpgca32.exeC:\Windows\system32\Mhpgca32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\Nakhaf32.exeC:\Windows\system32\Nakhaf32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\Namegfql.exeC:\Windows\system32\Namegfql.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\Nconfh32.exeC:\Windows\system32\Nconfh32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\Nfnjbdep.exeC:\Windows\system32\Nfnjbdep.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\Ohncdobq.exeC:\Windows\system32\Ohncdobq.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Ofdqcc32.exeC:\Windows\system32\Ofdqcc32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\Ofgmib32.exeC:\Windows\system32\Ofgmib32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\Ocknbglo.exeC:\Windows\system32\Ocknbglo.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\Ocmjhfjl.exeC:\Windows\system32\Ocmjhfjl.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\Podkmgop.exeC:\Windows\system32\Podkmgop.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\Pbbgicnd.exeC:\Windows\system32\Pbbgicnd.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\Pdqcenmg.exeC:\Windows\system32\Pdqcenmg.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\Pmjhlklg.exeC:\Windows\system32\Pmjhlklg.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\Poidhg32.exeC:\Windows\system32\Poidhg32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\Pkabbgol.exeC:\Windows\system32\Pkabbgol.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\Qbngeadf.exeC:\Windows\system32\Qbngeadf.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\Qelcamcj.exeC:\Windows\system32\Qelcamcj.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\Qihoak32.exeC:\Windows\system32\Qihoak32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\Amhdmi32.exeC:\Windows\system32\Amhdmi32.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\Kaopoj32.exe
- Size 400KB
- SHA256 9522c3e4e410be08e42117b3b76769cecb1e7bb7dae96f4008eec4783567c556
- MD5 254df471c882e82acdd3c223194a4d53
- SHA1 49674685c89516c0b7b4a28c1dc271dcfe8fc801
- SHA512 9e7e36f9a1c084f583a031ded50e3635007fc082d73d03e5578720d0b612f8bbc077d2ce8535cfc84dbd4aa2c1aec7a83ebbd49755317b9cfc6a92bb76246681
- SSDEEP 12288:G24Z4Z2o8wE39uW8wESByvNv54B9f01Zm:G24Z4Z2o8wDW8wQvr4B9f01Zm
- TLSH T106948D92F7D15DB0CED4387002EA52D4721CDC20BF16DBAFE241E68DBCB518ADA2D661
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Kdkoef32.exe
- Size 400KB
- SHA256 c35ca2b3ce55a042e6a12a03efe17b49ef4bb287e6c253a9e0f8846d05a9ca05
- MD5 cd617b5efbb09387a24edac3ae3be17a
- SHA1 80dea683f73207f79ad1e0257f30d0e7ecae2919
- SHA512 49f59b539287367b79ab4336047d2f5974fde69e264f583ff3e3c1024406bd52330f1cb64a9d278e9227ae9d4f33efbb880d773d433bab9dba0cbd530e8af21f
- SSDEEP 12288:xJ2cv3tT2o8wE39uW8wESByvNv54B9f01Zm:352o8wDW8wQvr4B9f01Zm
- TLSH T182948C1737D35D39EE5C09B814EA9254261CDC24BFAFEB6F2141E689BCB3382D6AC041
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Klbgfc32.exe
- Size 400KB
- SHA256 1dd1569b7a21202237aad27b90acfc0718f26e4ebacc999ffde28cda6601ba7f
- MD5 141c1f7e7e79db44d78a2ddd6c9d4aa5
- SHA1 73a0b31d61f86aa1869ff86f1e67b21f49341d16
- SHA512 832e9f7098f6f234ceffbcd70f9e615c4536dfeebc1e858bb25aee4e5b3a689e7ec574d45e50356e7e8127b1ff5360e070314c6183d60c9c773f8216a2e67588
- SSDEEP 12288:mM4wyV0C2o8wE39uW8wESByvNv54B9f01Zm:mgyV0C2o8wDW8wQvr4B9f01Zm
- TLSH T124949D0673D29D31EA740CB040EAE264521CD8A2BF26DFAF6145E699BDF3183DA2F541
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Kopcbo32.exe
- Size 400KB
- SHA256 284d21d589b421464a2b2dcc9f88fd3774e0fbc081ac4e2bf6b644ef6c90bc09
- MD5 33c8147233d0efff6f4584bb0f664b17
- SHA1 19a47192374546f37fbaa5dbeb74b279817b032e
- SHA512 1d0d92c5abdd35dc95bb3eda1d41f0f8581d6cdf4db67da6ac43d152f7719a83380f2bd7773e72e27f993c4b0596025c34d16dcb2eea61c69102c9633615720b
- SSDEEP 6144:/jSVQrAYeJ6/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz://8C2o8wE39uW8wESByvNv54B9f01Zm
- TLSH T1D2949D1637D99830FE680DB014EA9264766CDB20BF26DB6F2141F6DDBDFE285DA2C041
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Leabphmp.exe
- Size 400KB
- SHA256 8e58d7a86303dba5cb4e9bb1c488b8d85c2549e484f7476402bcf21472809805
- MD5 b14f0ba4fb4ca339c334e511088e2b67
- SHA1 615ff4830e1d53e2963b02554f080db5bba779a2
- SHA512 0457ee82ed031721cee770fb00880f141275f12cb2d2281ac8db1b61b56e6b5286027172f7698d129729f00c92d7ed499f83a0d10b30d9b1afdaaeb29c161883
- SSDEEP 12288:DNeFWUlp032o8wE39uW8wESByvNv54B9f01Zm:DMHD032o8wDW8wQvr4B9f01Zm
- TLSH T1F5948D0633D55F31CE540DB03CEAA214262CDA21BF26DBBF6341E69EBCF2A85D62D451
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Lknjhokg.exe
- Size 400KB
- SHA256 e42c7e6ddefa38aa02ee6d9147de6572961e78afcf58ab769e1ab3963404d5de
- MD5 725fd2c9509aef0bdc08b3a7f7e1fb55
- SHA1 bc144546bbeb1837965cd60ebcc2dedc39b5002e
- SHA512 1157ad2355049fb15c8f7f2542852649c1439219c8661e46735b7e55af314ff8c4aaf96415f4008c4ab30e01cbc61d18a2c0c323392d31c6aa059a97def64759
- SSDEEP 12288:WiZOlUb2o8wE39uW8wESByvNv54B9f01Zm:WiMUb2o8wDW8wQvr4B9f01Zm
- TLSH T137949D0677E5EDF1CE140CB424EA9254661CF862BF26DFAF2251EA8DFDB1181EA1F401
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Lkqgno32.exe
- Size 400KB
- SHA256 ebea28e9eb064ee16e9859dbb3f6896473928cce10286c3eab95c678526e95e6
- MD5 3823b7e9f54d8a7eb0261cfce3db29d4
- SHA1 75e09087877fc6fe9991959bf8d7adbe941432e1
- SHA512 44e2ae4fbffe6ae14cdd52ab0a361bc2c3240c82e7410c9ef2a4a7f780120bad84a3ed454d486b38f766d71cfca81cf73382d87373ed996cdd3e4762e30af151
- SSDEEP 12288:PWbYW2o8wE39uW8wESByvNv54B9f01Zm:c/2o8wDW8wQvr4B9f01Zm
- TLSH T199948C9673D1DC31CE640CB000EE926C662CDE60BF2ADBAF2145E69DADB61C7DE2C451
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Llpchaqg.exe
- Size 400KB
- SHA256 f86e12aeeadd3ace46e3688f41140afb0fdf819200a61b73008ff16db8dcb360
- MD5 741dc21ba40ce0c8cec3248b2156d28f
- SHA1 4756ffa3fb7705afa3e2d752d704dc210cecd7c0
- SHA512 1991ada7b3d464c5af479cbf68e44aeaa31ba80355679486f8b958d05d3086a2b0634df342b35da12f322afa272f639e2e93a5586fe1c41caba2bf39cdeddeaf
- SSDEEP 12288:cxsp6E3f2o8wE39uW8wESByvNv54B9f01Zm:c86E3f2o8wDW8wQvr4B9f01Zm
- TLSH T1CA948C9E73D19931CE5408B004EE9266626CDA64BF26DF6FE14FF689BDF1183DA2D001
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Mclhjkfa.exe
- Size 400KB
- SHA256 f10773c3fbc6ad26c53b6ca7cc17247cc56a7e608a652253f70b9e595166fd2f
- MD5 18dd76038b702378bc49f47a154e1241
- SHA1 cc18de67e4c19421631e52d86a536e5b8fdb0483
- SHA512 f0efad051852b57279d096e52ac5efe655636dcd40957c1c324f0b8e137fbb0126c2706f7cf9f45a4392266d1f24f4729a27bc2a69ba34cb4bb303c4e5c26045
- SSDEEP 12288:TVZIWO2o8wE39uW8wESByvNv54B9f01Zm:JZg2o8wDW8wQvr4B9f01Zm
- TLSH T1BE949D3673D59C31CF5C2AB000EA5664161CD820BF29DF6F6151E6ABFDF6283DA2C849
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Mddkbbfg.exe
- Size 400KB
- SHA256 71d8a8fbf782ad854a08b44d814e547bfd851a7f4fbd5db8f78dbf4c9e218667
- MD5 beed00cf46bae75cd86cb28026f708e3
- SHA1 4a4e0467f16c619995458704303d218770a57690
- SHA512 a5a1ab0d66dbe63d5febd9d58ebfe9f8359366987154e1174391a6186035dfd14551ff8e96ca208aad4272b3480e18f1068eb77094f6a2cdab36f5b45c799562
- SSDEEP 12288:IMW812o8wE39uW8wESByvNv54B9f01Zm:th12o8wDW8wQvr4B9f01Zm
- TLSH T184949E9673D15C79CE188CB884EA5254652CD920BF26EF6F6349EE8DBDF1183DBAC001
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Mhpgca32.exe
- Size 400KB
- SHA256 a52a105f81171062e38a000ba451c780f750d5a3d707f94e4a5571f6b9fb1c97
- MD5 9b4e671c5c0f181d309b6ee0f6f34923
- SHA1 ce685ce9951ee32f51bdd8ee4b5a2657291dd36e
- SHA512 76b7f23af925594d032f629aeb5a5b476f2d224b94f7019b40058b50f1c9a4f936608ad91eddd0c7e253ecb7393f81ff48b132208e2ef300adc0b4796a0059d3
- SSDEEP 6144:0/SKL16/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz:lKa2o8wE39uW8wESByvNv54B9f01Zm
- TLSH T1AF949C067392DD31CE3409B804EA9264665CD8A4BF26EFBF2141E789BDF3186DA3D471
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Mkepineo.exe
- Size 400KB
- SHA256 7fd9403db7fd9801235ccb58394b9f678ee31227313737b76b948b663d2792e1
- MD5 fea7b79bc589a609aa4226c144469933
- SHA1 e1832b3d8d821590ca67dda68291ce1b5823cb5d
- SHA512 bc762fa26b624df6342e7cc9889baa7703f4f4f9baf554590c5333316596b46f31e22b4355c777b0ff0fa118b056d7d2d5dc4da3cdae24ccd11c4f6ee810b090
- SSDEEP 6144:l0ZuK0+y9+UXT6/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz:G29M2o8wE39uW8wESByvNv54B9f01Zm
- TLSH T182948C117BD15937CB588CB004EAA254263CD934BF26DF6F6146E6CBBCB1182DA2EC4D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Mlgjhp32.exe
- Size 400KB
- SHA256 e5da8b925821da18643cdd76e63cc052916f2cf8b8a171a14dc665d76fbe2d21
- MD5 a798f4da3917f3a02491a4820c357e13
- SHA1 2599d692df708ce96267b3183c3440231a104d9e
- SHA512 02d4e1eb69d8ff455b72e1996cf406048bdf373a334d5c5f370335701219c14699038efd499e47aa1f2a427aa764ac964bfba1a79026345aa812eb7d6605beaa
- SSDEEP 12288:mf058yZ2o8wE39uW8wESByvNv54B9f01Zm:k05V2o8wDW8wQvr4B9f01Zm
- TLSH T11D948C1233D19E35CF6C9CB004EA7664961CDC24BF26DBAF6241F6ABBDF1181DA2C251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Moefdljc.exe
- Size 400KB
- SHA256 7a4a6b9a144d9f4b657ae92728f5f8acd1fbd30a4da275b9f60bbb5e8c584fe1
- MD5 8306db83962cbe5db52be276a2322585
- SHA1 be2073b805df775d56fb5f63b73974b731800f90
- SHA512 4ad171bf061e9b8f52a37b2b8d1216be16f236f83aded9b8d46132db6d598d717ea999768d2c051395f6c3e442c5e2e303f961156ae5397cdd43eb9d98236d05
- SSDEEP 12288:aJDB602o8wE39uW8wESByvNv54B9f01Zm:z02o8wDW8wQvr4B9f01Zm
- TLSH T161948C123FD29E31CE18ACF044EAA6541A3CD921BF36DB6F614DE2E9FDB1581DA2C441
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Nakhaf32.exe
- Size 400KB
- SHA256 a7bd8d83e723d7604e762f3f4655a17bd21d4e7b9d9c8a96cb2a7d4300d060c8
- MD5 e97233e21e5f51746c375b8f2f733b8d
- SHA1 643440b8aae48ecdeaf243af994b40327fec4cff
- SHA512 1ef98bd3538723bb57ea108b246d938c789f6fcd618394e534b8094f0e938280397a04b42ff5e5de7b5cb297d398ae5972d2f0ce96276ebc79be29c2ea2a10be
- SSDEEP 12288:F6oUlt2o8wE39uW8wESByvNv54B9f01Zm:F6oG2o8wDW8wQvr4B9f01Zm
- TLSH T1E0948B1233D2DC31CA5C18F4A4EEE254625CDA20BF26DBBF6551E3A9ECF6181DA3D841
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Namegfql.exe
- Size 400KB
- SHA256 729ca00b30f6a7f452cf37b35f20a55afec958fa3803e20642670cadb89b4ef7
- MD5 2d3f0182f6ee7ecb5af0efd1acd96f8e
- SHA1 340c80c38b5461318cad42c1b45378886877937b
- SHA512 573c89dfafc1dd47c911973d2048184c77cc5a536aed568706d6330ff45bf32c58cd24f56fcb67d0bbfdf6d007b98aa401ed7b13252b2d7d2bb2fc8c749ef574
- SSDEEP 12288:mIk8hj2o8wE39uW8wESByvNv54B9f01Zm:tx2o8wDW8wQvr4B9f01Zm
- TLSH T1D3947C1A73D15D31CA680DB19CEAB694511CD8A0BF2EDAFF2141E799ECF1283DB2D442
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Nconfh32.exe
- Size 400KB
- SHA256 8dfc9bdebcf0b0da5711afb6b86901488384d878e70a8f38f0e650f4134adf18
- MD5 6e46885989d2ae916af794897c80bb04
- SHA1 73362a5f3c93b999407cf8b00313979aae263159
- SHA512 2cdc23ff4ad901eaa4dac26d8f531b163c6c688f7235b58618b9ace70122e670e8b79d8e4139d1c6a13a00095875a2819dcdf58e7ec3e7102e327da04e0ab72b
- SSDEEP 12288:rSfJcy2o8wE39uW8wESByvNv54B9f01Zm:ur2o8wDW8wQvr4B9f01Zm
- TLSH T148947A177BD59D34CF5518B049FAA268271CD820BF2EDBAB31C9E689BCB5381DE2C045
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Nfnjbdep.exe
- Size 400KB
- SHA256 79e5690228d42780b96772baf2fcd78fbf7352691cb2305782e3d7a5a0f7abac
- MD5 345e59d620b8dbae1ed8e0c7ede09ee3
- SHA1 eba5bc5746562e6109e28895e3de4cb8cf80d5f6
- SHA512 f8614131fea85f82637556d8bd52d0f4bcce73ffaba8f2369a7471b84b8d314bb740f5cc6b99b1331d94ddd34d87a2a3d0f537c0f52eb0a06594304bd671df59
- SSDEEP 6144:dvs5NwS6/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz:dv92o8wE39uW8wESByvNv54B9f01Zm
- TLSH T1A694AD06F3D5AC35CE551DB814EA921622ECD830BF26DFAF2285E699FCF5181DA2C341
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Ocknbglo.exe
- Size 400KB
- SHA256 2e902640e773575dac49294162de2b8576528fd32c90bd2ca3a1a21fb1d7875e
- MD5 cf79d046b0efe459d1cc6d7de396cea8
- SHA1 7dc618b6ea4459b0099ddb6ac7211fcbb86d38c3
- SHA512 47e6e71555066119cb0c8594cba2669315567c085adb7a717d51b107514c21236758087faf9b108bf8379cb7bc36a6c129e89a034a174eb50b108e52b42099b6
- SSDEEP 12288:sN5/jR2o8wE39uW8wESByvNv54B9f01Zm:sNFR2o8wDW8wQvr4B9f01Zm
- TLSH T180948D0273D15C37CE5B0CF090EE9254521CDC29FF26DBAF6181E69DADBA189DA2D0C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Ocmjhfjl.exe
- Size 400KB
- SHA256 d9df75a89d162cd9c736907c39f6f0c4535330a5331476d4c8775bea8858894b
- MD5 a8e955dfd2dbd029c406f59a15d25cbb
- SHA1 ac4060222554366164a22e6ba47a93e3e077c0f0
- SHA512 ce88af0d92ab91a8bbffe4ec6b42f9105de9281859f9e603899533cb12f6a7ac63d6c3b624ce1b25c58955c3b3f3b83750f09a2f4bf2567002d5742d37a0e91c
- SSDEEP 6144:vitf6/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz:viC2o8wE39uW8wESByvNv54B9f01Zm
- TLSH T164948C1277D15D33CE6C0CB208FAA254D51CD821BFAADB6F1144EE99BFF2182DA2D841
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Ofdqcc32.exe
- Size 400KB
- SHA256 580e790a7020f4842dc29e8962f7c45bf2d4e8083687253661cde2468a072425
- MD5 4f5b4472f838f52edaf58ea82ff6b450
- SHA1 86258626fd1a38ae518cac2031a8bff8cf7a13f6
- SHA512 8d0d1b06cdda44d027e3937fa06fd2b22d32e0b72e62f6535e63bf4e620b89ba0f1eb62a172a9519ee69b86f6003a6fe754ba8330e328418fa75fefa52d658e1
- SSDEEP 6144:bW2oKMth6/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz:+KMI2o8wE39uW8wESByvNv54B9f01Zm
- TLSH T11E948D1773D1993DCA5808F004EAA664121DD811BF2FEFEF6163E69BBCB1285DA2D443
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Ofgmib32.exe
- Size 400KB
- SHA256 72f05cf4efd208033ac74150ee7d3c64a3132db24dcd4c0df9f7a963592c3cd5
- MD5 55022f2b449a2e78f47343ed0b707de4
- SHA1 6752bf3a2ff5008f68c1e1e16575ce9ccfe8edf3
- SHA512 8a5b02e6477a7a2b7c9fc57d40e15187bb6c1a6e03557b3d7b831f226f94e7e1fbcfb4fb3451b7fad84fd9c3b795e907524f98b74c992ef6f7251e2b5f19d5ab
- SSDEEP 12288:O+6b4f2o8wE39uW8wESByvNv54B9f01Zm:O+Q4f2o8wDW8wQvr4B9f01Zm
- TLSH T1E2948C1633D25833CE7829B044FA92543A1CD824BF26EF6F61A1F68DBDF5981CA9C543
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Ohncdobq.exe
- Size 400KB
- SHA256 b54fd85021fd069a43cbc295c622b0dd7882d371246b9474716223b7a36eda37
- MD5 e9a1553e8f373ff7120b47ec1128723c
- SHA1 e1749235e1c579c68322b692a1bc234e70a39f1d
- SHA512 2e7bccf383627a76443f15f0b9e671a9d283378e3611501a3dde0c255748d220e30b575d944d5f02e723d52d0a02160c40c4e2aeeb8dcd42b533680ff7aa68e2
- SSDEEP 12288:ADp8q2o8wE39uW8wESByvNv54B9f01Zm:Xq2o8wDW8wQvr4B9f01Zm
- TLSH T1B2947C1673D2BA74CEE81CB014F99216622CD820BFB6DF6F6941F789ADF1181FA2C445
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Pbbgicnd.exe
- Size 400KB
- SHA256 2065bf687fe8afd397126c1584f7ada1bf164a5a9dc6cec5589cf2a4c6b3f624
- MD5 da012cf9926c59d3886bfd184980527e
- SHA1 624f5c7fbc776867c281ff1b8dac060314bbce3b
- SHA512 3f2aaff254221d6105cf316c40c61ceb0cb2099924c21542506dec7cf1cd5fa0c7bd84dfb2186f640d51a445807d702a201513e1f76ef494e423d34465bb2afd
- SSDEEP 12288:+t+5L2o8wE39uW8wESByvNv54B9f01Zm:+052o8wDW8wQvr4B9f01Zm
- TLSH T1CF947C0273D17870CE5828B044EA921C561CE930FF26EBEF2943B699FFB5581DA9F251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Pdqcenmg.exe
- Size 400KB
- SHA256 3ba4a341a5eb0acab09ca4e287ee84ad2e80b613314714232f77b63f0aa10379
- MD5 25cf97d634674bc0387e5f0499d766c4
- SHA1 0071142022c81ddf10960a9dc18301c97923a28e
- SHA512 6c0684773a96902c316e94de8485d1e7d52429d33d53a41be3608d56013c68336957919cb9a2952de3b88eecb348593d64afdc7d9ab2bfe6eb3102c13cf533c4
- SSDEEP 12288:BFpbaG2o8wE39uW8wESByvNv54B9f01Zm:bUG2o8wDW8wQvr4B9f01Zm
- TLSH T141948C1637F29D36CF14087000EA6254563CDA23FF2ADFAF6147E699FDB2286DA2D141
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Pkabbgol.exe
- Size 400KB
- SHA256 65141c98b18baf38f630ea4c378218db0fb9ec62ea42bceb6813d74b8d8219db
- MD5 47bb158f6d2d9811a0614ae4f855d059
- SHA1 fac2f7accbebda10f2602162f8056e66896164c6
- SHA512 fb0f7550f54c271956abda041bfcc28840813f1af2e93d5adc829f9f5cdb754d9f82a826c0734244e922d0b9c921c4eecfc75e8a1c32b6757d5f3385406b6299
- SSDEEP 6144:snyxMre6/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz:sTn2o8wE39uW8wESByvNv54B9f01Zm
- TLSH T1CD948C1677ED8C30CE2A1D7844EA9654262CD820BF26DFAF2152E69DFCF5182DE2C0D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Pmjhlklg.exe
- Size 400KB
- SHA256 de2be56775026ec113fc72216036933fabb081ccdd8f7f4d5fa2c23a1d918ad2
- MD5 febacf5b67935dc74543ec963299d251
- SHA1 9eae67939681317729d259bbd318a73867e6a0bf
- SHA512 82109f354c653aef02b34450e7d40941b0ca9d159ca1a3b5cd771e271948734e8b426d9ccfa01d535def3751758d650c4d15dc325f73946a1f832cfe2e914f93
- SSDEEP 6144:WP5AKyl36/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz:WhAa2o8wE39uW8wESByvNv54B9f01Zm
- TLSH T136947B0673F99D30CA6409B010EB9254161DD821BF2BEFAFB14DE6A9BDF5681DE2C053
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Podkmgop.exe
- Size 400KB
- SHA256 8d81572ec9eaebc834f9e9065b269a1942ae2dc7d0b110471fa006aa7fd22265
- MD5 67dbf7798495fa30401385a73cab7c7d
- SHA1 19e867441aa1ad0bdc122477372e487304cbd48d
- SHA512 4e6d7b16a190e28721480f19b5da2788a69adeaba7995fc3a1713fdc32f689c436da12721def793136c78c5cbe306b16d1a4e83506c1df35d0b06d6a8bdab4d3
- SSDEEP 6144:0VLVy7lk6/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz:0VL02o8wE39uW8wESByvNv54B9f01Zm
- TLSH T158947B9236D95935CE380CF080EAA2A8F55CD838FF27DF6F1143E6D9ADB1285D62C451
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Poidhg32.exe
- Size 400KB
- SHA256 6663ad2f4df41a6f62e73e41aad0afde603bba49d30e9bbe2363262757c622ab
- MD5 2aa889b9df06eb8642f6e6decf4e5422
- SHA1 37c9c15df1185b9aa6cfae4ac851375ba6c9bc5f
- SHA512 518c2a83be2e4071cb071e96af78869dc3fb4a4b18a83e9856db1a3ce1e0794ccfbaabb8b07bad752bc505dfa5d1c0ba64f6250fdb9f2dc726606219b0d53342
- SSDEEP 6144:ATcJ74RqA6/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz:deRG2o8wE39uW8wESByvNv54B9f01Zm
- TLSH T1BB948D1273D19971CA540CB006EAE6D4563ED93ABF2EDB6F6181E2ADFDF1181DA2C043
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Qagfppeh.dll
- Size 7KB
- SHA256 0418dbca82f0576ef8d7a2f70ca1071c706b081cd3214fa1d815f5163469e039
- MD5 42edf50b9ef6ed05cccd6501afa358b2
- SHA1 aac9035140786a6a4ac588e3a517c2893af57509
- SHA512 09f39ae8c467ec317ae1da68f28e0430485e173c8ca4ea045e2f4af8b01cef6fc069e61199b802bdfdd05f7d1cef2df4c9da885f6cecaa1bb2d630e334dfc13c
- SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPBd3cX5aXW:wUaJf/aFbP0Oe2JaX
- TLSH T1EAE14493FD8041FBC08D067911FF26229B6E69342AD890096B8899351C9CFDFFF78546
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Qbngeadf.exe
- Size 400KB
- SHA256 25095b4ebe5cc3b35e12f9103b8010ef742dba8340470fdfba6738cd06476539
- MD5 c9cbf5595c5854e93395d2725ef265eb
- SHA1 8ad083b606f81460cc128d231c9c2461b21080b3
- SHA512 ec0195ea01351f35eb6e612c73c78d21825d6a0a6e6233aba69569388059186b0c13e9292c6fcf1f2f05cec8b411fe5b3e2b8d246e1c2156afdde69d5453715a
- SSDEEP 12288:/fHJDd2o8wE39uW8wESByvNv54B9f01Zm:/n2o8wDW8wQvr4B9f01Zm
- TLSH T15E948C3677D29C33DE240CB040EAA654F66CDC22FF26DBAF6141E69BBDB1181DA2D441
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Qelcamcj.exe
- Size 400KB
- SHA256 c12b49f7b3bb2cb5cb86cc0fb54b380f9e16eb1224911e482e67c7dec4711ed1
- MD5 275bb775017f8b732264ce1c5ecbe494
- SHA1 f843a0b6219e6bc5c9c451a3e8bc731d50d26b02
- SHA512 9b336d56654dee4d708fb93e366ec0fbcfb4e3abf7621771754691c39ad54141678cf18464d3a7850be48f6fc25d5db4103888f145e0fcdf6467b69f33dd7f88
- SSDEEP 12288:Bbyc4c2o8wE39uW8wESByvNv54B9f01Zm:4m2o8wDW8wQvr4B9f01Zm
- TLSH T141948C0E37D15A31CE6C0DB044EE9654262CF920BF1BDB6F3253E7B9ADB9681CA1C245
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Qihoak32.exe
- Size 400KB
- SHA256 c66e7557db08aa9193258b802a4ebb1830afce8f8b56ac8b254b67fc5026687d
- MD5 cb47c6e0c001a1be8c80c3e91249032a
- SHA1 388e0d437494215ae8269265beeda907d6673ecd
- SHA512 85809e9886e939428895d7aa67a825ae3a523ebe6f7dc0e97fb97dab9e50bbe3cc25c3816efd7573a4da2df98ef1dd739b916ec185f59f3b2702f90be048e4fb
- SSDEEP 6144:qQpbn1XxF3ILX6/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz:1jFL2o8wE39uW8wESByvNv54B9f01Zm
- TLSH T14694AD8633D55D31CEDB0EB004EA9264566CD821BFE6DBBF6181E68DFDF6981CA2C041
- MD5 SHA1 SHA512 SSDEEP TLSH