Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/04/2026, 12:50
Behavioral task
behavioral1
Sample
2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 4.5MB
- Sample260419-p3dkqsaz2m
- SHA256 9f07f45550f177edbb8bf8e28fe9f4ef968b41802d9ccd66a8fdc93ee0732bda
- MD5 070aeff888cf3825808202c88ca71566
- SHA1 b6fc5f6df600d9bae08c2770c58f43494ef0c4ec
- SHA512 470012d3f12e2763b6913f9f537e1eccd7992817e41e60d7978a50a0569599acfb1fbb105bf38fd7490eca249b8ef6d238a5b3898ee6188ef13202c284c52410
- SSDEEP 49152:9TAnaoJdXN0BMOwLloBrugOrRokpp7EgnT5:9TAnBJdXN0B7+sIrRokf7Eq
- TLSH T13F266E03AA39ED22F67D34F6E898D9501C5D6C290BE334F731BAF76999335C19A30261
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\user.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\cacls.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\format.com- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\newdev.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\winver.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\autofmt.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\reg.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\setx.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\where.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\find.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\takeown.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\relog.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe -
resource yara_rule behavioral1/memory/2676-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x009800000001b598-5.dat upx behavioral1/memory/2676-864-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2676-3200-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\dotnet\dotnet.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\f\cscript.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.1202_none_fdbbcf53ca14e151\f\wimserv.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4ecd10b107da65f7\r\AtBroker.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.746_none_48b2bd808a742e25\f\netbtugc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.19041.1_none_f4025a506f9e9f01\bootim.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.572_none_3e399e76562f6053\r\netbtugc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\f\UNPUXHost.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_69775cdd639910cb\PATHPING.EXE- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-makecab_31bf3856ad364e35_10.0.19041.207_none_cef5032ec7ecd573\makecab.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\r\wmplayer.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\f\systemreset.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.19041.207_none_59ba79211607f58f\r\WinSAT.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.84_none_51ae5c25baf813ff\r\SgrmBroker.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.423_none_12ca604b48f8d3fb\CapturePicker.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.19041.1_none_753cc0191556f0a2\SecurityHealthSystray.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.19041.1_none_10c7bab3a237c3a9\SystemPropertiesPerformance.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.19041.1_none_679d42cd97347ace\PresentationFontCache.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_c939d70420d81ce4\logagent.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\f\hcsdiag.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\f\WindowsSandboxClient.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\f\hvsirpcd.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.1052_none_073e2a212d1697e6\f\ApproveChildRequest.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1266_none_69f1a169b4d96a7c\pcwrun.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.19041.1_none_683b3c51d469e51b\LicenseManagerShellext.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\r\systemreset.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.84_none_9b0dd648f2c31f16\dfrgui.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\ApplyTrustOffline.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\wbadmin.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.19041.1_none_b6b53473f278f7cc\repadmin.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.19041.1_none_33c3e07f6cce5a52\dpapimig.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\f\WerFaultSecure.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\f\FsIso.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.19041.1_none_d016f232fbeefbad\sdiagnhost.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_2afd3bd8e33c2cf2\msinfo32.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\f\ClipUp.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\ofdeploy.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.19041.1_none_67326312c2487423\EduPrintProv.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.19041.1_none_ba29c601fef9ba5d\ssText3d.scr- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\tracerpt.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\x86_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_10.0.19041.1_none_c3f8c36f1ece6e4e\ilasm.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SystemApps\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\UndockedDevKit.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.1_none_56a3c953964ea509\WinMgmt.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\r\PrintBrmUi.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.19041.1202_none_fd57358454385601\n\CustomShellHost.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.1_none_d7cac98c90803a6a\auditpol.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.19041.1_none_407b1fa0f7dce496\RmClient.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.1_none_996ba223b673811b\dsdbutil.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\Microsoft.Uev.SyncController.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.264_none_92ee62a6d5b1c18a\fhmanagew.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.264_none_7a40d01e6ba302b9\mfpmp.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_ae5ec9e59abc05e6\r\SndVol.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\qappsrv.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\r\LaunchTM.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\f\relog.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.173_none_f837263e7fdd508f\f\sppsvc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\r\SensorDataService.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.19041.1_none_ea34e25ca28496c3\tzutil.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\a60e034236e5d701ed9600001815341f.ShellLauncherConfig.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.19041.1_none_c9157ddc38b83b1b\aspnet_regsql.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\vmms.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.1_none_b0feb06b14107c04\wecutil.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.19041.746_none_59e1ce71631fef8f\r\WmsSelfHealingSvc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_72b8b02e4865ebca\f\schtasks.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_5536c5683efe1dad\r\CameraSettingsUIHost.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2676
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 5.1MB
- SHA256 c98c373a57da479dffd4620c516e1c48b2ddd09161bade0fb7f4f4ab265d4def
- MD5 33b2fdbccca31a7af527b749161dabcc
- SHA1 cc7d0b197d67a080e25f00ff519ed865d19a6ec5
- SHA512 d709989b6208bc0a39bfa3d3d72e1226763141599a4bb7c4dc4a2e0b7e176a7b62c0fa6333bc2996b9e41b4427c3de82b1acad830be8a52e94f7858e2466cb2a
- SSDEEP 49152:9TAnaoJdXN0BMOwLloBrugOrRokpp7EgnTNPji0Ajx:9TAnBJdXN0B7+sIrRokf7EWjo1
- TLSH T1DC368003BA38ED22F53D34F6D898DA545C6D3C290BA374E731BAF76999335D19A30221
- MD5 SHA1 SHA512 SSDEEP TLSH