Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/04/2026, 12:50
Behavioral task
behavioral1
Sample
2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 4.5MB
- Sample260419-p3dkqsaz2m
- SHA256 9f07f45550f177edbb8bf8e28fe9f4ef968b41802d9ccd66a8fdc93ee0732bda
- MD5 070aeff888cf3825808202c88ca71566
- SHA1 b6fc5f6df600d9bae08c2770c58f43494ef0c4ec
- SHA512 470012d3f12e2763b6913f9f537e1eccd7992817e41e60d7978a50a0569599acfb1fbb105bf38fd7490eca249b8ef6d238a5b3898ee6188ef13202c284c52410
- SSDEEP 49152:9TAnaoJdXN0BMOwLloBrugOrRokpp7EgnT5:9TAnBJdXN0B7+sIrRokf7Eq
- TLSH T13F266E03AA39ED22F67D34F6E898D9501C5D6C290BE334F731BAF76999335C19A30261
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\compact.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\getmac.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\help.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\cmd.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\cipher.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\runas.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\recover.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\hh.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe -
resource yara_rule behavioral2/memory/1916-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x002a00000002b13f-5.dat upx behavioral2/memory/1916-926-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1916-3178-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{7D4668E7-9A84-4825-A94E-3FFCB96DCA7A}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\dotnet\dotnet.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\f\Taskmgr.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.22000.71_none_152ef1c98c20fad4\f\fodhelper.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.493_none_a9fee4e32efd000a\wuauclt.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_cc9ed34da60ac9c4\r\Robocopy.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.22000.1_none_510540d2769488b0\ThumbnailExtractionHost.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.22000.41_none_1d0a15319901359b\f\PinEnrollmentBroker.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.348_none_8c1cd5f65f938380\f\DataStoreCacheDumpTool.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\splwow64.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\f\ScriptRunner.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.22000.1_none_a345420f88ad9925\at.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\r\cmproxyd.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\audit.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.120_none_68fb744ea962915c\r\conhost.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.22000.51_none_35df5a459d516a9e\f\omadmclient.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.22000.1_none_6672795e56429a85\netcfg.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.22000.1_none_8de8e95b9cda88b4\MigRegDB.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.22000.1_none_cec61f64d1d9b52e\Magnify.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.434_none_b4a3a74a80427a96\f\CheckNetIsolation.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.22000.1_none_17403e0ec10de4a8\verifier.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.22000.194_none_213203c52af71b4b\f\bfsvc.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msdt_31bf3856ad364e35_10.0.22000.1_none_fbc5ff99224f8cee\msdt.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\f\rdpshell.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.22000.282_none_3c5af3814be830ab\f\klist.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.22000.318_none_64b09e1111e8c6f6\r\winresume.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_bc172f1a0215d298\wevtutil.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_windows-defender-management-v1_31bf3856ad364e35_10.0.22000.1_none_70e9301c0d12b212\ConfigSecurityPolicy.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.22000.1_none_35fb189c78bdb167\eventcreate.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmpconfig.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.22000.1_none_9f5dc1b77d80d899\AppVClient.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.22000.1_none_6e22e868f79867b0\msdtcvtr.bat- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.22000.1_none_3c227c0792e6c811\NgcIso.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.22000.1_none_0e8c117a0fb4af58\setup_wm.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_5faf7b34bce42c4c\r\SearchProtocolHost.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup360-media-base_31bf3856ad364e35_10.0.22000.469_none_259c259bf9e2d267\f\SetupPrep.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\ApplySettingsTemplateCatalog.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.22000.1_none_d9e8af91dd649cea\UserAccountControlSettings.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\r\vds.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_c24a28fb71aa07c9\f\Robocopy.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.469_none_71e2bda169e58aea\audiodg.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.22000.1_none_43054e9f294487ea\DisplaySwitch.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.22000.1_none_d4a473e8ed9480cf\smss.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.22000.1_none_c036c8699ff31951\TapiUnattend.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.22000.1_none_901640fccc3c2d55\Dism.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_03b4c900a639c980\TpmTool.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\f\cmdiag.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.22000.1_none_f318e861ad1b476f\convert.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.22000.434_none_fc228ebcd84d69db\f\repadmin.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_c78a68497548f374\r\fsutil.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.318_none_b139c7be49b8cbb9\f\FsIso.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_9c5aa041b6a59db2\f\RMActivate.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_a6af4a93eb065fad\RMActivate.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.22000.434_none_8c92a0565e9eec19\f\bootmgr.exe- 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_070aeff888cf3825808202c88ca71566_amadey_coinminer_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1916
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 5.1MB
- SHA256 c98c373a57da479dffd4620c516e1c48b2ddd09161bade0fb7f4f4ab265d4def
- MD5 33b2fdbccca31a7af527b749161dabcc
- SHA1 cc7d0b197d67a080e25f00ff519ed865d19a6ec5
- SHA512 d709989b6208bc0a39bfa3d3d72e1226763141599a4bb7c4dc4a2e0b7e176a7b62c0fa6333bc2996b9e41b4427c3de82b1acad830be8a52e94f7858e2466cb2a
- SSDEEP 49152:9TAnaoJdXN0BMOwLloBrugOrRokpp7EgnTNPji0Ajx:9TAnBJdXN0B7+sIrRokf7EWjo1
- TLSH T1DC368003BA38ED22F53D34F6D898DA545C6D3C290BA374E731BAF76999335D19A30221
- MD5 SHA1 SHA512 SSDEEP TLSH