d0020deda3006f0b44c8905fc9dee3d5442b05031dbca72e8af6f7fbc3ca92a1

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 5.4MB
Sample261014-eexnlavx7p
SHA256 d0020deda3006f0b44c8905fc9dee3d5442b05031dbca72e8af6f7fbc3ca92a1
MD5 df60138b1fd5c404a261ef408b607b7a
SHA1 8eaf7966abcb73aacf56d048ae02471a6aa6bea1
SHA512 3eac024ea2ed6dc8763c2ea99b2130d0b50f0e5ab03a6b3447aa5a3d0eb2295d4a32acf6ed7278d021ae6c4177e5d0ddcc4e3caf875b3f7e9a2789a3a0af8d6d
SSDEEP 98304:SmYAlhwg3S5bJqsEy6JvFvWZr4fpNfcrob+jH+PS0J/m7Zs9i3iJwUFeoCIRYaqG:QAh7S51qLLtWexyrobC+PTmZ8jegYW
TLSH
T135463312E751CD33E5E2047CA8A0D3B1BA783572572B8053BB9D1B2D3A722E1A67D707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000002436f-35.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4572	Rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	Rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
376	system.exe
1892	2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4664	Setup.exe

Loads dropped DLL 8 IoCs

pid	Process
2596	Rundll32.exe
4572	Rundll32.exe
4572	Rundll32.exe
4664	Setup.exe
4664	Setup.exe
4664	Setup.exe
4664	Setup.exe
4664	Setup.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Rundll32.exe
File opened (read-only)	\??\F:	Rundll32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\system.exe	2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Windows\SysWOW64\pgdougaa.dll	system.exe
File created	C:\Windows\SysWOW64\lplpugaa.dll	system.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AAV\CDriver.sys	Rundll32.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
612	sc.exe
3880	sc.exe
2376	sc.exe
2440	sc.exe
1416	sc.exe
4076	sc.exe
3236	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2596	Rundll32.exe
2596	Rundll32.exe
2596	Rundll32.exe
2596	Rundll32.exe
2596	Rundll32.exe
2596	Rundll32.exe
2596	Rundll32.exe
2596	Rundll32.exe
2596	Rundll32.exe
2596	Rundll32.exe
2596	Rundll32.exe
2596	Rundll32.exe
2596	Rundll32.exe
2596	Rundll32.exe
4572	Rundll32.exe
4572	Rundll32.exe
4664	Setup.exe
4664	Setup.exe
4664	Setup.exe
4664	Setup.exe
4664	Setup.exe
4664	Setup.exe
4664	Setup.exe
4664	Setup.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1788	2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 376	1788	2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	85
PID 376 wrote to memory of 2596	376	system.exe	86
PID 2596 wrote to memory of 3288	2596	Rundll32.exe	87
PID 2596 wrote to memory of 1096	2596	Rundll32.exe	88
PID 2596 wrote to memory of 1416	2596	Rundll32.exe	89
PID 2596 wrote to memory of 2440	2596	Rundll32.exe	90
PID 2596 wrote to memory of 3880	2596	Rundll32.exe	95
PID 2596 wrote to memory of 612	2596	Rundll32.exe	96
PID 2596 wrote to memory of 3236	2596	Rundll32.exe	97
PID 2596 wrote to memory of 4076	2596	Rundll32.exe	98
PID 2596 wrote to memory of 1788	2596	Rundll32.exe	84
PID 2596 wrote to memory of 376	2596	Rundll32.exe	85
PID 2596 wrote to memory of 3288	2596	Rundll32.exe	87
PID 2596 wrote to memory of 1096	2596	Rundll32.exe	88
PID 2596 wrote to memory of 1416	2596	Rundll32.exe	89
PID 2596 wrote to memory of 2440	2596	Rundll32.exe	90
PID 2596 wrote to memory of 3880	2596	Rundll32.exe	95
PID 2596 wrote to memory of 612	2596	Rundll32.exe	96
PID 2596 wrote to memory of 3236	2596	Rundll32.exe	97
PID 2596 wrote to memory of 4076	2596	Rundll32.exe	98
PID 1096 wrote to memory of 3476	1096	net.exe	104
PID 3288 wrote to memory of 3628	3288	net.exe	105
PID 2596 wrote to memory of 2376	2596	Rundll32.exe	107
PID 376 wrote to memory of 4572	376	system.exe	109
PID 1788 wrote to memory of 1892	1788	2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	121
PID 1892 wrote to memory of 4664	1892	2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\system.exe
  C:\Windows\system32\system.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\pgdougaa.dll Exbcute
    3⤵
    - Checks computer location settings
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\SysWOW64\net.exe
      net stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3288
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WinDefend
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3628
  - - C:\Windows\SysWOW64\net.exe
      net stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1416
  - - C:\Windows\SysWOW64\sc.exe
      sc config MpsSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2440
  - - C:\Windows\SysWOW64\sc.exe
      sc stop ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3880
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:612
  - - C:\Windows\SysWOW64\sc.exe
      sc stop 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3236
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4076
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" stop PolicyAgent
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2376
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\lplpugaa.dll Exbcute
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4572
- C:\Users\Admin\AppData\Local\Temp\2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\45673e9a85f77bcf9f40d709639c\Setup.exe
    C:\45673e9a85f77bcf9f40d709639c\\Setup.exe /x86 /x64 /lcid 1046 /lpredist
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

LocalizedData.xml

Path C:\45673e9a85f77bcf9f40d709639c\1033\LocalizedData.xml
Size 80KB
SHA256 e05a62d8e872e156d1a8c2486660d4d93f48c286ad4d1ced442521d27abe1df9
MD5 a732a0e073087eaec7854eba10acd451
SHA1 7f1fadca0646288cef1b126a2c8f336df9f7b941
SHA512 9ed0f9111cc8d73f76496d5d15f151343b3a29dacb3446f2e91f903f1b9e5c87c25b08070882187d96442a9f90291f146494b7cb6048ff135f905189daf8ad65
SSDEEP 384:4Ai89tJKVQVfVjV2vjaCS8etgceFTNKKENqJpR+enRROu5aeJInO/yJakC65qW4v:aNKvqyJiT
TLSH
T125837E11AFFE2258F1BBAB14BEB710940EB7BD915C39C11D0099188E8A77F858D25F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\45673e9a85f77bcf9f40d709639c\1046\LocalizedData.xml
Size 82KB
SHA256 d804971f306b53a3a28e933bd09a735975748871222a13d18098f3bfc9b4c4bc
MD5 7af79b95e03784b74a7da99c1b3c5728
SHA1 1bde3a744d2ef1f45de60cc0fe6c8644c9ff0caa
SHA512 7a9d00c7b115a7601e6ecefc06f06508be952140936fe87fee81057c64785c1b9513400666e51af6d99977709b33a0cdb035c13bad0fe3eb660e67b86968a867
SSDEEP 384:4wzbb8UAjJUgYN5s6KUONAk6uroXInM7xHL4lzSv3kOY8vg2m/qKdxEcyJ2m9Zy4:4ubcyJzyN7K
TLSH
T1D2838E11AFFA2218F5BBAB05BEB610944EB3BE919C35C11D0059194E8EB7FC48D25F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupResources.dll

Path C:\45673e9a85f77bcf9f40d709639c\1046\SetupResources.dll
Size 29KB
SHA256 354b6386d18d3d139ddfa56a74a67eab5e00b6c452ded7e279593b8012986b35
MD5 6832d2572aabd012b4b4f242fe842768
SHA1 bc547ea471f88859584a67de043fa3d1060e4239
SHA512 21b6ba20ae74e2baafcca860cae7cf875703d5262382ff130ce72777da351dffa329f960fd3f2757e92feec5376ca60e6d0f3866716dbceb0578d58472462be8
SSDEEP 384:qXAYQcx0SnTB1HcpmqWveWJTMq0GftpBj0VrxT4bHRN7FfQElGizvvOg:qXPC2B18yVuigr6bFvnOg
TLSH
T14BD2958597FC5501F9F36E3065B49A935E3ABE825C38810E1651E59E2CB1F80DE34B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DHTMLHeader.html

Path C:\45673e9a85f77bcf9f40d709639c\DHTMLHeader.html
Size 15KB
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
TLSH
T1B672765326E84248A1B6BE49AFB640750B79BD45A83CCE7D05A0591F49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ParameterInfo.xml

Path C:\45673e9a85f77bcf9f40d709639c\ParameterInfo.xml
Size 921KB
SHA256 ff0a0bf38b98b5dccf58245aced7ab645578f44a4d3698317f01556448023d4a
MD5 41f68f1aff471f19b97d870ddf33e1ea
SHA1 7e820af783f1380cba003d5fa371fbed96bf1ca0
SHA512 a3ec0e1809d0d391e93a86db679dafd266c9cc73604cf426a4e3034238347af1a2d03192051d178d718a5feb73af623325076dd2b0ca9b96a17dc3c8c37bdfb0
SSDEEP 768:+X/A0wr3EdVUmgoMW4azplOatAOmwbhYcXTC1wr3EdVUmgoMW4aEplV9EOCLnvsq:+o3ugsTt37FZ3fejlZ3rZ3fbjlZ3mIl
TLSH
T1CD15B11127FA0304B3B32E256AF6886A897B3892DC34C75D405D558F97B3E84CA72F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\45673e9a85f77bcf9f40d709639c\Setup.exe
Size 86KB
SHA256 3820754b3b946efe036f73b936aae7c37bfdc25061d645b4d11112fe3aa8a463
MD5 9bdadecee0b0c3be2be081fe4a72b133
SHA1 a8cb99592e7b74ef8e4713378d1f8aeda8797ed8
SHA512 9899a8f106d19e6525b4704a8296733bfd561456ee309f45898df26d1c0fda631b9a10e1f09aead7696faf61c9362e1c638352c34b2346e6928fdb3ae42c9883
SSDEEP 1536:2e8hgX1PdzaodhYnyyyygPosa9+WZnqxMQP8ZOs0JJ+xabYs:2e8hiVd1YyyyygPosGX/gBqxa0s
TLSH
T1DB838E41B6A4C472D89619304477CAB36E3DBE839DB0055B3398B7AF1FB33C16A28765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupEngine.dll

Path C:\45673e9a85f77bcf9f40d709639c\SetupEngine.dll
Size 858KB
SHA256 7e0b7f01fb76451306aee006db6ccc409b3ea2bdad6f29337206956057336984
MD5 272279447bf00d1738d3ff6f86189219
SHA1 d310dd647d7dc0ef7ed54d612c053b969235b19d
SHA512 10551db19dc6d4d78e69de760a6e26d66f3d4d1161fe4d79e80b115d6bd3aca108e110982ef829ada521834cba502eb651c81fcc35422edc7febb587152e8fb2
SSDEEP 24576:aG2ynlYAwHKreMHZQP5hv0vtJ9f3xPetKGYn/BkV0/F5:aG2ynlYATK++DuJ9f3letKGq/2V0/F5
TLSH
T1AA154C232FF9C035E2FF1731B93A575A6AB6F9A29870C51F22C45E1D1E31A119934B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUi.dll

Path C:\45673e9a85f77bcf9f40d709639c\SetupUi.dll
Size 312KB
SHA256 1a66ec052f665d7a05afabda8e2a8df4e69273956da56a5c3b61c106752c191a
MD5 e60b6c8b90e04e4acd9b8f2e0d60d23b
SHA1 99b580ef3fd97225ea453d6784a3a0987090a5bf
SHA512 80b777c2971cba16a946487cfbedb493ad2accbe316294b956a2f63cec210dd922116bade2606b6ea4c797a719c9ad0aa2f81e653d54195334ae8106dd89d632
SSDEEP 3072:eTvVUK59lWUzUEOJSs8B3RPZAt/kCyhjiqhTGJcKNJZaT1eiingiSu1avQeo0sXU:hB8B3BMPm/4ci+T1edngi2QezpaY2A7
TLSH
T161646C227BE5C075C0EF1730B62AD7AC457AF2B298F0D10BBB941B2E4E73651D928B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUi.xsd

Path C:\45673e9a85f77bcf9f40d709639c\SetupUi.xsd
Size 31KB
SHA256 aaf8cb1a9af89d250cbc0893a172e2c406043b1f81a211cb93604f165b051848
MD5 a9f6a028e93f3f6822eb900ec3fda7ad
SHA1 8ff2e8f36d690a687233dbd2e72d98e16e7ef249
SHA512 1c51392c334aea17a25b20390cd4e7e99aa6373e2c2b97e7304cf7ec1a16679051a41e124c7bc890b02b890d4044b576b666ef50d06671f7636e4701970e8ddc
SSDEEP 768:hlzLm8eYhsLP8s05GFaAMET/chT+cxcW8G2P4oeTMC:lwchT+cxcDm
TLSH
T1E7E227C631C1CA001B374832AD223B0DFED5A57382D43D61B5DCA637BB76AC62967279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplashScreen.bmp

Path C:\45673e9a85f77bcf9f40d709639c\SplashScreen.bmp
Size 117KB
SHA256 b05141dbc71669a7872a8e735e5e43a7f9713d4363b7a97543e1e05dcd7470a7
MD5 bc32088bfaa1c76ba4b56639a2dec592
SHA1 84b47aa37bda0f4cd196bd5f4bd6926a594c5f82
SHA512 4708015aa57f1225d928bfac08ed835d31fd7bdf2c0420979fd7d0311779d78c392412e8353a401c1aa1885568174f6b9a1e02b863095fa491b81780d99d0830
SSDEEP 384:pu66qlxe0UqtcSiS2gLsd5xfAg+zqFv4t:LP
TLSH
T13FC3EF9C27BF054AE63AAF9A352546441B1EAE9437E03B8F5D3732CAB173341D788285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Strings.xml

Path C:\45673e9a85f77bcf9f40d709639c\Strings.xml
Size 13KB
SHA256 2a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b
MD5 8a28b474f4849bee7354ba4c74087cea
SHA1 c17514dfc33dd14f57ff8660eb7b75af9b2b37b0
SHA512 a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369
SSDEEP 384:VqZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VqB
TLSH
T1B352834376FB2018B1B23ACA6FFBC1B4CF6675D00976462F0159204B87D7C1B6AA2776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UiInfo.xml

Path C:\45673e9a85f77bcf9f40d709639c\UiInfo.xml
Size 37KB
SHA256 4bd293cff72726b3be4e3747370b66fbd2109b284bbef255307e28681828c711
MD5 47e2b8066a699ca608e3dd5f3fb9d10e
SHA1 788dbd5e116ff52e95e79c9f99ffe8c6e7d1fe98
SHA512 cf8e90c7d9f78f12ddb8310b044ac748a9581d0387c3df8bab9139f2061d2aa57181546ac61f369537f4b6892509c926cb2762ddbba051e723402d38d8205126
SSDEEP 768:24URHd5vc2PH5HSguJQvFQXvDINJh6FmhPsrVsG8t+p3879km2VG9GMGNGTDKveP:24URHd5vc2PH5HQYQLIN/6FmhPsrVsGg
TLSH
T1EB0326575FEB0118E2F6AA4C69B304705F2B7A45083AD53C04EC354DEFE7E6289A07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

print.ico

Path C:\45673e9a85f77bcf9f40d709639c\graphics\print.ico
Size 123KB
SHA256 d80ffeb020927f047c11fc4d9f34f985e0c7e5dfea9fb23f2bc134874070e4e6
MD5 d39bad9dda7b91613cb29b6bd55f0901
SHA1 6d079df41e31fbc836922c19c5be1a7fc38ac54e
SHA512 fad8cb2b9007a7240421fbc5d621c3092d742417c60e8bb248e2baa698dcade7ca54b24452936c99232436d92876e9184eaf79d748c96aa1fe8b29b0e384eb82
SSDEEP 192:ly3ul6MeeS80xxb11yXXVzzzzzlzTTTbt/Pu:lj6MeeSXxxb11yXXVzzzzzlzTTTbt/Pu
TLSH
T191C324636ADE7DD6D0B866B13B7783D1C70EEE058922D02EA2D4366AD17D5037A433C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

save.ico

Path C:\45673e9a85f77bcf9f40d709639c\graphics\save.ico
Size 123KB
SHA256 1372c7f132595ddad210c617e44fedff7a990a9e8974cc534ca80d897dd15abd
MD5 c66bbe8f84496ef85f7af6bed5212cec
SHA1 1e4eab9cc728916a8b1c508f5ac8ae38bb4e7bf1
SHA512 5dabf65ec026d8884e1d80dcdacb848c1043ef62c9ebd919136794b23be0deb3f7f1acdff5a4b25a53424772b32bd6f91ba1bd8c5cf686c41477dd65cb478187
SSDEEP 192:cICfR9iBLLLLLLiii1dkx2Xwi+XI7b6ZZZZZZZZZZGGGGys7v5Z7vvvvvvvvvvwF:H2R9iJJi56ZZZZZZZZZZGGGGyHIIIhh0
TLSH
T1BEC3BE07AAEDBEDBD085A271FB3982B1DEE0ED1D4721404E76F9A666E471E1331020DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.ico

Path C:\45673e9a85f77bcf9f40d709639c\graphics\setup.ico
Size 123KB
SHA256 a0c7b4b17a69775e1d94123dfceec824744901d55b463ba9dca9301088f12ea5
MD5 6125f32aa97772afdff2649bd403419b
SHA1 d84da82373b599aed496e0d18901e3affb6cfaca
SHA512 c4bdcd72fa4f2571c505fdb0adc69f7911012b6bdeb422dca64f79f7cc1286142e51b8d03b410735cd2bd7bc7c044c231a3a31775c8e971270beb4763247850f
SSDEEP 192:+7yhu1uz//TAAA555AAAAAr99899AubBqj:oX1uz//TAAA555AAAAAr998991bBy
TLSH
T1F3C3122366DEBDDAC4B467B03B77C3D5C71EEE554922D12EA2C0262A917E0437A433C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warn.ico

Path C:\45673e9a85f77bcf9f40d709639c\graphics\warn.ico
Size 194KB
SHA256 4bb9ea033f4e93dbf42fc74e6faf94fe8b777a34836f7d537436cbe409fd743f
MD5 c8824ea3ce0a54ff1e89f8a296b4e64b
SHA1 333feb78e9bb088650ce90dea0f0ccc57d54a803
SHA512 c40e40e0cb2aaa7cf7cccbe29ca4530ff0e0a4de9a7328996305db6dfd6994cbe085fab7b8f666bbd3d1efd95406ea26b1376aa81908ace60dc131a4e9c32d40
SSDEEP 1536:cpUNHIL4Oj0qwL2IupGF8yJtJFFhxGgX/3/HRVq:8mHILxnDIiGFxG4s
TLSH
T12D1418526E2EBFC5F548B231D839C1B00910EE7948AA966B35F67E8B39772237431F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqmapi.dll

Path C:\45673e9a85f77bcf9f40d709639c\sqmapi.dll
Size 221KB
SHA256 b236253e9ecb1e377643ae5f91c0a429b91c9b30cca1751a7bc4403ea6d94120
MD5 6404765deb80c2d8986f60dce505915b
SHA1 e40e18837c7d3e5f379c4faef19733d81367e98f
SHA512 a5ff302f38020b31525111206d2f5db2d6a9828c70ef0b485f660f122a30ce7028b5a160dd5f5fbcccb5b59698c8df7f2e15fdf19619c82f4dec8d901b7548ba
SSDEEP 3072:Dl5e8m9Z5G6ZUMIiaQVedGGEc6SYm8X/UvHFupHIjNNlMi/fbtcICcu0b9+x0o/l:gG6ZUon6GVSYmnGHEvlMMac59+xfbB
TLSH
T1172419D1E1F68071D3D2133072592377E9FAA92F2DD8BE8B1380E6573830982D76975A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 5.3MB
SHA256 77a16e0ef2a5e0af422c83403c96e9c2b714f173cffb62aa4db2a12df8ec9ebe
MD5 31f156c19cd909bbaa59b11da7a9be32
SHA1 9eda13fe93c1f20ced4a184aafc0d756be14a740
SHA512 bc0c0c4944957d3e66b29936871b3c64d7a7876bdf7087634337aaba8ce68e20d208eef60248436ee861195efecdeeb9dcc230b7037c268944314419d9542609
SSDEEP 98304:ZmYAlQwg3S5bJqsEy6JvFvWZr4fpNfcrob+jH+PS0J/m7Zs9i3iJwUFeoCIRYaqG:3AQ7S51qLLtWexyrobC+PTmZ8jegYW
TLSH
T15D46332317A1C133E6B20970ECA0E2F1BE7835A39630C547AB6C1B3D19B31D5B66DA57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99F9.tmp

Path C:\Users\Admin\AppData\Local\Temp\99F9.tmp
Size 4.3MB
SHA256 58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705
MD5 6c7cdd25c2cb0073306eb22aebfc663f
SHA1 a1eba8ab49272b9852fe6a543677e8af36271248
SHA512 17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6
SSDEEP 98304:U+VAwiFxfTTITz+DjHWtIXS3k/8HqoVN:nAwiDTqz+DjHWtIXS3k/8HqoV
TLSH
T127268E5167FA5799F7F35A3469B865658CBABC32ED21CB8D0252100A09B2E81CF74F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup_20261014_045224937.html

Path C:\Users\Admin\AppData\Local\Temp\Setup_20261014_045224937.html
Size 16KB
SHA256 e6675338e204bb9872852efda2b7e778fb126cf309144a75dc09566a7a4ff39c
MD5 4d24ad308005356eed6e26ff4f2ee74c
SHA1 6613a7d38674b6ead91e1a5513367a601fcebfaa
SHA512 a20d7929267961567a1c2116f544a5920fb969ce3d40ca37515ec83762b9fb969a5a4ec63f625ea8c94f17c0c137d45190d5dd854149d3ef9e81126006a11776
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjL:fdsOT01KcBUFJFEWUxFzvHv
TLSH
T16D72685326E84248A1B6BE49AFB600750B79BD45AC3CCE7D05A0591E49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lplpugaa.dll

Path C:\Windows\SysWOW64\lplpugaa.dll
Size 23KB
SHA256 7c2fa4a51de2badce90521f4c36f5bebfdf0bc93ddac96277b48972f3f617b32
MD5 d306664efe8e3f8093201c8189c41ba9
SHA1 4835837f6cf08450bf1274147fb9460df5fee86e
SHA512 4103771d2335c58d55145bb2f38b482137b54442da195dce4792c0083149f3f63763839c0fa3eeb9aa0f4ebd2b0811e1c176c72ff6379207fa25f887a3c88af8
SSDEEP 384:gp4GXvaOHVhhR8SycTQcgYiAOuT6pp0gRRJfP0bDKMR9CHom:gp4G/rbYSyhYNvgdfPGDhCH
TLSH
T15FB2C369F74EEE21E19640B67264EA3A644C6931138FB0E7F7C34E1115742E0A67AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pgdougaa.dll

Path C:\Windows\SysWOW64\pgdougaa.dll
Size 77KB
SHA256 11ef1bb3ff9d11008a7d5439b5f8ebdfe51ef637bc812db97c8594997b2e7eed
MD5 67ebf9f4c63bd69f58119538e14799b2
SHA1 8ffa7f574c0a3485374cf8328da7110c4bdd9974
SHA512 3b7aaa74de1e40ab74c2464f5c222ea70f5c8a60c1e55bba72801bafea5e7b9f4b88ee02f0c32a2425da9583f1bf40357a0d2ee652a2da6078150e0cbaf6cf9a
SSDEEP 1536:WzlLerP0gGg1Qe6+Qlr0i7802rd9cqCmh6DY5atOXPQ:WzlS3Ylr0i780SJV
TLSH
T1A4731744F301CD26D9D004BD6275E372751D1A32AB9F94B377DA2E2AB7302F3A629706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.exe

Path C:\Windows\SysWOW64\system.exe
Size 144KB
SHA256 4f5c154b3bc66f993c07c97a119a478d4c09c8cdb3c1701495c6b1a3cbb1f7c9
MD5 9e801cc7c8d98d8944b361d3a3e596f0
SHA1 892c029920e2c3de95e7adcf02b1a2d357e6d82d
SHA512 2488fa1f43cc7366eb9e65e0deae58b9e498aa4b5b8f1f8ce0f0958fdfd86254e74eead3d8540ece4722dbeafe12818c81540003c2026f50b114b7cb7539e32e
SSDEEP 1536:JUV+9j27NPcjXsUzlLerP0gGg1Qe6+Qlr0i7802rd9cqCmh6DY5atOXPQZ4t9hYQ:KKHXsUzlS3Ylr0i780SJVMMhYNMfP7
TLSH
T17FE35A05F741DD32C4D100BD2175D772651D6A325B9F90A3B7CA1F6ABB302E2AA39B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1788-0-0x0000000000470000-0x00000000004CB000-memory.dmp

Download

memory/1788-9-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/1788-38-0x0000000000470000-0x00000000004CB000-memory.dmp

Download