5c11e6419e783d822dc03c865d72526349d31eafe0bfb8de00bc02909f1db3be

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
Size 819KB
Sample260505-efffpsfz7y
SHA256 5c11e6419e783d822dc03c865d72526349d31eafe0bfb8de00bc02909f1db3be
MD5 86f0031f2b8151cc5348acf551b52eb8
SHA1 85e7cf0b74e5a4f598cf7a62e0b99550e2762c1a
SHA512 570bf9ed53b3b4f9b76947a48bcf982bc39f5b68ca0de690d02188ef992484d5eccfd394e663bc8c97daf9db4440e602e3b20bf0e1c52ee0a8141daa9190ff49
SSDEEP 12288:P4Ryed8I7r/7mdUd6bi9I6Sk7a3iwbihym2g7XO3LWUQfh4Co:P4R5CIH/7JI1p+gkE2fh4Co
TLSH
T1EB053A26F6648236E073C079C5E2A69AE9313C610B3089CB5385F76C3E736D3E536726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4332	UpdatAuto.exe
5456	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3160	sc.exe
4220	sc.exe
2064	sc.exe
1116	sc.exe
5580	sc.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
4332	UpdatAuto.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 3896	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	79
PID 3868 wrote to memory of 4332	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	81
PID 4332 wrote to memory of 4972	4332	UpdatAuto.exe	82
PID 3868 wrote to memory of 5456	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	84
PID 3868 wrote to memory of 4240	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	86
PID 3868 wrote to memory of 6044	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	87
PID 3868 wrote to memory of 4252	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	88
PID 3868 wrote to memory of 4084	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	89
PID 3868 wrote to memory of 3188	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	90
PID 3868 wrote to memory of 4300	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	91
PID 3868 wrote to memory of 6028	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	92
PID 3868 wrote to memory of 5580	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	93
PID 3868 wrote to memory of 1116	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	94
PID 3868 wrote to memory of 2064	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	96
PID 3868 wrote to memory of 4220	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	97
PID 3868 wrote to memory of 3160	3868	2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe	98
PID 4240 wrote to memory of 5908	4240	cmd.exe	110
PID 5908 wrote to memory of 6056	5908	net.exe	111
PID 4252 wrote to memory of 5352	4252	cmd.exe	112
PID 5352 wrote to memory of 3380	5352	net.exe	113
PID 6044 wrote to memory of 448	6044	cmd.exe	114
PID 6028 wrote to memory of 6076	6028	cmd.exe	115
PID 448 wrote to memory of 1792	448	net.exe	116
PID 6076 wrote to memory of 5296	6076	net.exe	117
PID 4084 wrote to memory of 5096	4084	cmd.exe	118
PID 4300 wrote to memory of 5264	4300	cmd.exe	119
PID 5096 wrote to memory of 2576	5096	net.exe	120
PID 5264 wrote to memory of 2276	5264	net.exe	121
PID 3188 wrote to memory of 4472	3188	cmd.exe	122
PID 4472 wrote to memory of 5936	4472	net.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3896
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4972
- C:\Users\Admin\AppData\Local\Temp\2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee~4.exe
  2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee~4.exe
  2⤵
  - Executes dropped EXE
  PID:5456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:6056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6044
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:5936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:2276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6076
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:5296
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5580
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1116
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2064
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4220
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 824KB
SHA256 85c6913fc5678e58a73740d6f51ea3bc06da776aa9c0049fbdbf9fa16c4bee6b
MD5 dcb8435c6bc97e8b5a40b4a9d3f9f6f1
SHA1 1ad03aef8a9af9bd189637170285572a2cdcd49f
SHA512 f67731cb1244ab6f3f47958c2014acf8657a1ff4942cc4332e1fce05ac5e373453513cb9e34fcfab6bc361522a5d6fb2a8f91371b51bfbd7626281fcdfd02ff0
SSDEEP 12288:P4Ryed8I7r/7mBUd6bi9I6SDXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:P4R5CIH/79I110Le5ji0hmxNrM
TLSH
T128052926F6648335E073C0B9C5E2A69AE9313D610B7089CB5385B76C3E336E3D536726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.2MB
SHA256 c2a3fe798496461fcb139461a49b3ec878d8fe1de8e3398af516e26ea5149b77
MD5 e4d69ca2337f3e7a04c9db3f63244207
SHA1 8a009427779949888b0b5d698f2a21e18da889cb
SHA512 c131620a421248633d9b82761b82add6a6222aefe8e95812f73b003f3f93b1d99039deffb1026edf2be17e9f0b7bdc822f4a995137eef33c5eeb4e8a5f8fc9a2
SSDEEP 24576:P4R5CIH/79I1fa7/ezSC6vUyD/aqgrvWx6q8wyu:PabH/5I1S/ezSC6vUzPvMHjy
TLSH
T15C450925F5788323D0B2C0BAC5D6A69AFD3238524B3089CB5346A76C3D336E6D53573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 967KB
SHA256 0937bf83bcb489e4a172bac404bd375359c224fd55110fc5ecc65933811c1e0d
MD5 265c9f97405c9d091f63e233ea21a236
SHA1 44b6d88eee0d57b27921f710ea97c92bdea6f6d0
SHA512 1ef854acda9f554e311fd43abdf5dd384b0e7622782370ffb22fbec2a5277f8a803b76c50ea80b41abece0399ea223ac5bb42911f8c687547abeac506e952b13
SSDEEP 12288:P4Ryed8I7r/7m8Ud6bi9I6SBVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:P4R5CIH/7+I1BVbqPb88hv/l+7
TLSH
T15D252A26F6A4C221E073C0B9C5E2969AEE323C514B3189CB5345B72C3E776D6D636732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 289KB
SHA256 c0ed890897f0d99ffa112c29ae379138956791bb71e3e6b06c65524bb69e13ce
MD5 a0a1946081e7d6d9c285e28e64c97f67
SHA1 6fcb08321805748384a112d78270382d45762bc5
SHA512 b5828979f588909a754ccb294b24e694c533ec5c2c0b52dd4e766eb0ee6f881f62bbe204598ab67757c0e5f94efe709ba8f9cd0b396af93894b498acf4a93a50
SSDEEP 6144:P4RywzYmqBml6I7r/7mvUAUlIzFbi9I6KoQva7:P4Ryed8I7r/7mvUd6bi9I6Sva
TLSH
T1C2543A226A84E02AF29345746938D2A679297E710AD1DC0BB7C0BB5E38716D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.3MB
SHA256 66ea5bbbc17511648ddca644ca7387d8b3fd9683167d043468f5e1fd9ff7e33b
MD5 b883be87be3059f8b8eec5b57269a6b3
SHA1 ae77c8178d84aa3d17a5abf47d93b9d3abcc37a3
SHA512 fa1294d507531b75d47904d21d034062e44ea8ab4cf3ea5c9cbe59baa21fffa96d87688fe51a7d81681ae16a4c03f196de7a63936466fb2d39790f48701898f3
SSDEEP 49152:PabH/hI1Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4l:OI1bQRQyi36YOcP+Lvw2gAf+PN34
TLSH
T1C1667C13F3A501E8E05ED974CF3D52229B357C5A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.3MB
SHA256 8e234bb6ae3f179a3974f40c0ea92541c7cf58ad06fa9b47035343f277e6f645
MD5 64876d9ad8e3eb75717b3fb348927d47
SHA1 9a9940ce8f6a92bf56c5d525f7095671309438fb
SHA512 223d5b07050554b490facaa679ebf1dcf3370e96f87880def917ad9035887005599350ef1f9798ce6c6af87706940551342ed74f8b9e5838631a3b9da489a4d4
SSDEEP 49152:PabH/hI1Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4l:OI1bQRQyi36YOcP+Lvw2gAf+PN34
TLSH
T163667C13F3A501E8E05ED974CF3D52229B357C5A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 6cfbccf8233c73a3a83cbefc2e9d30aff84b4db7eb8aaccdc651cb77a6eb7185
MD5 64903425c62f39537d6cf269952e7869
SHA1 1cb21ace151a4f4066e85331fd86f0820c33f3cf
SHA512 25e631e793a51d3f189e5b99a4b6c74c747facfd3a84529650a09f51c248c9f9898937cc308a4d9428c61d68b6d7f7fccf5696ceaf46b798a3619fb1fcd47731
SSDEEP 24576:P4R5CIH/7lI1mwvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU3/5W/ohL01:PabH/hI1w68Qg55nhoeWu7PNU3/Q
TLSH
T1A1A51733B2E200A9D04DD1769F5A872196E17C718FE0D7DB8641731A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.7MB
SHA256 81e6f47f90f1f93a18914356a2b6358623d3db5439334b001b7935e13c8897af
MD5 6b129d5b6c10c06e7a7e6e91cc11059a
SHA1 d6dc66b6e9a52955ef50a402dea262e5732746e4
SHA512 30f18bf0ed9ebdafd3260eb400bc3e86b25a47912b1b7d16332fb1114ec212b51687b76e1fbd1b3d30073a83ba02be0b5d0a4641e05cf7f008ab7fc643f31291
SSDEEP 49152:PabH/hI1o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznm2FQ/nhs:OI1Fy5112gYy5azzVvf69nLKnhZO
TLSH
T1AB067A13F29900E8E05DD178874A9232EA72BC534B31A6DF0A5077522F7BEE5AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.5MB
SHA256 2470c171e017f758fbc18f15b6b7cdf3cb03438e31fa922c6485c7ef0502631d
MD5 c09f5ea9632065066c24976c9be811e2
SHA1 5919483a173a17790c20c52a037d5127ceed470f
SHA512 249446e6b4d28dfb534e0fb5577a717874202d86d8ce444ff9da3709f1123ffcc61c31cdcbe9921166c3e6277bb19682b3ee6327102263451dcf2ca8ab5efdc3
SSDEEP 49152:PabH/hI11B+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:OI17u6Jm0xd2d3
TLSH
T11EC58C13F2D941E8D06AC078975A9233F962BC590B30B6DF0B9073562A77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 1.9MB
SHA256 fe66cf2b5d8d99e6a1b1061461bd77b8a3a979e5963ace4a5ff6cf9afbc6b74f
MD5 3a47ee1c31fb247bdb7f1976b06099aa
SHA1 820cebd4e242e714ecc78ee909b75bcefb739d70
SHA512 fa4b4dc7cc47960a0349110993db0d7f0d98dacf0551ad8146de148b15559c540508f23f6405d1c7f140fccf533701c36c5c8809f1f04810ea3de0e6a7be3f0d
SSDEEP 49152:PabH/hI1t1hpsNoJpF1A6GU44CwH7R4xu:OI1tmifP5R7
TLSH
T112959D13F2D840E8D05AC17897569232EA75BC650B20BADF0780B7962F77BE06B3D716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.1MB
SHA256 6c35e46fb9c71452e1835926b6bc927c2b27a0aea7cbe9021e5d6fc06d1993b9
MD5 58b41d7cf2476f8f54deb298b8a0223d
SHA1 3fdd5f5556df63f505897d082fd902bd23da36f8
SHA512 67957f20a0e51f55992f1339376051c40ca220121f773ba47656f5534c02cfb8cbc62d195674af2bbadd26c256b5cce3a7641747133290a072991aeaadc2874c
SSDEEP 49152:PabH/hI1kSuZQIY0Be2K8RVtOnks6NMHq6:OI125dKCi616
TLSH
T1DAA58D13F2E940E8E0BAD57497659232EA72BC550B34A6DF074072591E77FE0AB3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.3MB
SHA256 e16f86d9e7a051dbd93ff21e8bb944db168c81df2f881d5ede7751f31b6608d6
MD5 297f2df4866c99b319530e180afbd6d9
SHA1 ecbcf37157a4041ec4780649cb75a141e6ed55c2
SHA512 dc2515f94b8ae6dfcd45c38c551e20feee1652961bf818e58b74c197ea8153b052bf7e9be63b6803db37b6ee2e28b414be7c09ae75536fb4ef83071f1416e41b
SSDEEP 49152:PabH/hI1lyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AX:OI1km7vj1BDlZG
TLSH
T1F3F59C13F2D940D9D05AC078875AD232EA32BC594B21A6DF0B90BB562F77BE06B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 3d8af8f51c5c0535eeeb059666c922fd7d06d273c010bd6891a36ffa838c5ff8
MD5 9a6dc6d5f8cc7d36b7afcdecdb4aa5eb
SHA1 6c953315ddc4db1f5a48bea90db33bcb05eeffb0
SHA512 936633fab369e8f24ceb1b5329ac978495f33c6b46d893be8d9befa481e4232ef72f3b475f0d209002cefd6ae8f7ead17e5fabe5752ac4c674b3c4e66518ec6b
SSDEEP 49152:PabH/hI1mhtSn8EApI0fig1giDn0AP5w2:OI1nX2iwphX
TLSH
T1B7859D13F2D840E9E05AC174C7568632E972BC250B35AADF0B90B7562E77BE06B3D316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 298KB
SHA256 9667d3b3bdb3c25237eed53501983c91cd91a5b218d2e0daba4e69857cb027cf
MD5 f8058e29b12630b67a0647da2409261a
SHA1 39b9cf29701631f2672ca19ff91313ca82d9a00e
SHA512 a58a0e20fb263900767c03a0b549a5ecd9db643fdab189f314b7fc229188b392ece7366eca390f1fec0fc60c1729b5b64dd08f40e3e418726521432021ef9db4
SSDEEP 6144:P4RywzYmqBml6I7r/7mFUAUlIzFbi9I6KoQZe7:P4Ryed8I7r/7mFUd6bi9I6S87
TLSH
T10F544B226A84E02AF2934574A978D2A679393E710AD1DC0BB780B71A39717D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 298KB
SHA256 7e2707a582ab9d2d690603ff2cb53a1ced21f8b23ca2d9f6f465f7c5d89c4c6b
MD5 8297cca2584abf4f723cae68ea632e77
SHA1 977588b80383f7f5b90d79e5ebb248d5f4fa477b
SHA512 10007cb7977fd8d18c7d30e100163bf7072de9f3dfa8e7d4f1ab70cc06f40b5086c70c6d017a0f1cc27efd89aaa60bebcdc741679e87b56dca38d6f7d5d3899b
SSDEEP 6144:P4RywzYmqBml6I7r/7mFUAUlIzFbi9I6KoQyNx:P4Ryed8I7r/7mFUd6bi9I6SCx
TLSH
T1DA544B226A84E02AF29345746978D2A679393E710AD1DC0BB780B71A39717D3F6F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 298KB
SHA256 1decd90a6304fa187977f70db8eaf39dbc6c52f8e798c0d60b2e012ce5f546c4
MD5 a6e225e323d30e3bb2da8e14cc14c226
SHA1 a31366f24474c6e9bf5a8c34e6f910782d80dc51
SHA512 7824b8040c78d19e9c22a61877d61afee7213377ebc8423744a3652ecaf50122f85230d923f71b7a349c7c2df63367d0c8b157b8b476da5042c3326c74844d64
SSDEEP 6144:P4RywzYmqBml6I7r/7mFUAUlIzFbi9I6KoQtqs:P4Ryed8I7r/7mFUd6bi9I6S4s
TLSH
T135544B226A84E02AF29345746978D2A679393E710AD1DC0BB780B71A39716D3F6F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 319KB
SHA256 e466af8883853939b33cbaabdca77a2d8deb0e0b5950490a0ff4466c1bab15ea
MD5 76323de7708fe9b9d9f1b1a181264b29
SHA1 ba70b5f597778cf68235b959a3ac01884e854250
SHA512 d91191875996394ed5356962755864d8eb531f5ebedd0f4c6b69fea2ef4c03adb41f9db839a3f0fe72f2810d45170195864d2c1f10861b16e27e0ac5caa9b4ab
SSDEEP 6144:P4RywzYmqBml6I7r/7mVUAUlIzFbi9I6KoQDuSiox6oI:P4Ryed8I7r/7mVUd6bi9I6S9Vc
TLSH
T117645B226A84E026F2A34574A938D2A679393E710AD1DD0BB7807B1A39717D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 298KB
SHA256 b772a8e43ba591ca7b2d58ad7fadc70f6e0bcd2290d1f610a50f2b73ed27f17d
MD5 ee7b86ea98e75c1d06a067abeb6fd9e2
SHA1 0e86ce2dd1ebaefc7534a1f2654e475fbc85fe5f
SHA512 282e0a15f6c1c16415b9f85cfc927c5409d0422cd97b36e11f1b1cfce0e6fbf1602920887d206af24e07e87fb8e7d8b8f0f9fa5e473f310780f6c233ba8c3c44
SSDEEP 6144:P4RywzYmqBml6I7r/7mFUAUlIzFbi9I6KoQlJZ:P4Ryed8I7r/7mFUd6bi9I6SPZ
TLSH
T18D544B226A84E02AF29345746978D2A679393E710AD1DC0BB780B71A39717D3F6F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 418KB
SHA256 fbbadaf6c8e3c8f9e7586ce39fdfa6aec19c9b31698100b442285acfa4743f5e
MD5 fc219ad4eba04b27bc37c7a2c20f422c
SHA1 22a442322a2103fc80b940679409cfc2343e65ed
SHA512 1a4446f01d712073306bb350b80dc2b6d8a0bebd83429e9343355964ebcdb4023b310dd239a484e7400f21f3dea54198a292d607fe124ed30c53ea5765c1e873
SSDEEP 6144:P4RywzYmqBml6I7r/7mBUAUlIzFbi9I6KoQw3psmeI+sQFqT3Qi:P4Ryed8I7r/7mBUd6bi9I6S/Xsf3z
TLSH
T118943B22E6849066E15E4174DB2882627A3B3E7106D1D94BB7C0F73E2B316D3B9F570B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 331KB
SHA256 58eb2d320c67e1601312ada69a347bbc06dd0afbe3b36dce81f6e1183c4db03c
MD5 004c99da71a10fc3b748eb76040f5d49
SHA1 479d30a80239c81b9fc141cbcda8d1396400baf3
SHA512 e36d3be6ecc52668ba749b9d8998ed69fe811f10f4710d67b139a4d9f2680dec7f91a129d64bc75f4306e895fd50092700a2458653159cc03987fd0380e4ad7b
SSDEEP 6144:P4RywzYmqBml6I7r/7mFUAUlIzFbi9I6KoQsJJ:P4Ryed8I7r/7mFUd6bi9I6Ssr
TLSH
T124745B226A84D066F2934574A938D2A679397E710AD19C0BB7C0B71A39327D3F6F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 339KB
SHA256 4fbf6edce3fd3c3895b34ae2c4e6090f4f30514040610167c324f4c391084115
MD5 467ad73067e956cd4408383b0f3a7939
SHA1 21cf282df46b62134385fe1a80b37a76ffe9eb6e
SHA512 d7d68647d0e8caf892a49fe05ee2ca98a6995eb8229e63ccfef290199c0da72710f976d41a06369c47f86ea78b3700eee7f095176b6346fdb9a02cfe28041110
SSDEEP 6144:P4RywzYmqBml6I7r/7mHUAUlIzFbi9I6KoQmk3nkraVT8:P4Ryed8I7r/7mHUd6bi9I6SmqnkraG
TLSH
T107745A226A84D06AF2934174A938D2A679297E710AD0EC4BB7C0B71A39717D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 335KB
SHA256 b7f2ed17bef214903a5d8f817583e74b8bd6c018e1d706c435512d8128da7ed4
MD5 f2e14c0cdc3ac391a88f1e658acb33b9
SHA1 8adf10d690724f8c82dd96f54798ffa4d97dc6e3
SHA512 ff2377350acc2a7108004329f922571dba41edaacc227a084509f3f84ae5991af4decd0de791fc0530befed80cff12b58eaacbbc4ef6f4222b2246779e43a6df
SSDEEP 6144:P4RywzYmqBml6I7r/7mpUAUlIzFbi9I6KoQkpw5ySuJQX0:P4Ryed8I7r/7mpUd6bi9I6SkpIyvJd
TLSH
T1E7745A226A80D06AF2934574A93992A679397E710AD1DC0BB7C0B71A39327D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-05_86f0031f2b8151cc5348acf551b52eb8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_tofsee~4.exe
Size 544KB
SHA256 2067a6448c697152a253ffdb2414312ccf0918dda8c66c6a650cf1316b2a8f58
MD5 dd94b2d469968b27a06cccf36ffaff32
SHA1 300165a935162d0c471010e9620875c394dcac2e
SHA512 b223cd84902fc9490bbbf2b074e4701da4a638a30da267574e34cc3e8eb761fa2246b76ec99fa1916b815adde3b575128d1eae8342967a853c743d3112b88c34
SSDEEP 6144:mE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQf+L+G:d7a3iwbihym2g7XO3LWUQfh4Co
TLSH
T148C4F826F6748335D073C0B9C5D2A68AEE7130865B308ACB0286D77C6F676E6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 275KB
SHA256 3a062d50a303f4178752dc372170b8e1252ac9642a7f14e42e9802e8eceeee70
MD5 7c53a13f3847cd3148a691bcadc34115
SHA1 ea7d9d7726cdc33e79a9a5d56fc272c129792e1a
SHA512 f269e46676ab24b89931da5414e5f03be223e7e3ebd8db8773809bf86da37c3007ef5e9a4c37d06c8910ebc47eddbe32b5f472bb6db29134eb8901dfde0c2521
SSDEEP 6144:P4RywzYmqBml6I7r/7mdUAUlIzFbi9I6KoQU:P4Ryed8I7r/7mdUd6bi9I6SU
TLSH
T16F543A226A84E02AF29345756938D2B679293E750AD1DC0BB7C0BB1A38716D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 275KB
SHA256 e72d756bfa2dba795f38077268448f1a2db60ec8d6feec3718ffaaab119c56da
MD5 26eb081ce0b95aa50c8993ad439e806d
SHA1 e6d32521b45df48891895b4d6997a77b582c42f1
SHA512 4229acbdadb622377d66d1d7465e6499a2047283ad4368ca1ddab62ef8c70c4866459708e61f2b751c6edce53376c34f44dc1d68997348e891ef6b3ab8b8fc33
SSDEEP 6144:P4RywzYmqBml6I7r/7mpUAUlIzFbi9I6KoQU:P4Ryed8I7r/7mpUd6bi9I6SU
TLSH
T149543A226A84E02AF29345756938D2B679293E750AD1DC0BB7C0BB1A38716D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 275KB
SHA256 922087fe7cba2b402b0823eebf934a61541c73d6034227f1974e7ca3aec59157
MD5 bb2c16b3267b09a03a22b5029385976e
SHA1 153f69aa83606aae05dc8415533adcfd2e312572
SHA512 1cfd3dee877616904fda726acc5811d043b8c7671241a0ef59ea52dea1a8523c7adf6664e80e6d71733d0e60a2445495d474c687ee627c6dcc0975a1f625e767
SSDEEP 6144:P4RywzYmqBml6I7r/7mpUAUlIzFbi9I6KoQU:P4Ryed8I7r/7mpUd6bi9I6SU
TLSH
T1A1543A226A84E02AF29345756938D2B679293E750AD1DC0BB7C0BB1A38716D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 275KB
SHA256 f0a2017b271da2c1f74e486229cee3eb64fe2e549308cacaa5ca15024e2a8a6a
MD5 2b1db6ef24d1317e6f80e1548fce2eef
SHA1 b572196fa65557d2421130f4d6b6edda98c2fb83
SHA512 68b19fe185797ab619c0efa7eadca8f91d365d216147625840799faa099bb29f3e621ab3d5ccf08e9546015a1c1cb0e7b64a916f8c84f6e816b93a0346f51327
SSDEEP 6144:P4RywzYmqBml6I7r/7mVUAUlIzFbi9I6KoQU:P4Ryed8I7r/7mVUd6bi9I6SU
TLSH
T17B543A226A84E02AF29345756938D2B679293E750AD1DC0BB7C0BB1A38716D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 275KB
SHA256 5f51802af9c867740cd8f4b8fa49ddedd55e4266dcb81b07104d06b3eee2b301
MD5 a89656f3b8b34b6e00b5b7eb257ad48c
SHA1 602358088bbb81faaf89c6260b30c4965bb2acc1
SHA512 5fe8d7e48f7ef63563cbe209570b9be7ca9496599592d420bded262dc2be8f61876da1dd03ddbea2e31f2cfc6b77022d6ba1a0f6815295a1959de39eaddf8cea
SSDEEP 6144:P4RywzYmqBml6I7r/7m8UAUlIzFbi9I6KoQU:P4Ryed8I7r/7m8Ud6bi9I6SU
TLSH
T186543A226A84E02AF29345756938D2B679293E750AD1DC0BB7C0BB1A38716D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 275KB
SHA256 79cb93d61af86bf85e9961cb46a1569a28ffc99596583250261d1dfc0d84e905
MD5 8c6b4ba0016004006aa56a606dda0095
SHA1 034ad03b1cb5b2db049d9c8b9b3aa20056c9c82c
SHA512 93309f4394a5b6273f7b3a2686b696c74749eb59fca2d4bfc7f85863f366846b2995b3a626226df20bbd73dcf9ba4eb8c76dcf62421bb49e086d1f0ad5bf4e8d
SSDEEP 6144:P4RywzYmqBml6I7r/7mvUAUlIzFbi9I6KoQU:P4Ryed8I7r/7mvUd6bi9I6SU
TLSH
T1E4543A226A84E02AF29345756938D2B679293E750AD1DC0BB7C0BB1A38716D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 275KB
SHA256 25f9e332cbadf77537f288cc189bbd8d40a3698232fa609a110c3a6bb438f3ea
MD5 90e9286332986e30b4faa22b923de8f9
SHA1 0b99b176a157cffc319822e237b56eab8653c18b
SHA512 4899b79ec56e5cfa36c1425493d906bf03e2e96c5fc2e012656d5cea99b2591c9999acb527aef552cff65c58fbb9c6c3ec1e9f3b4a6be853f08b8b4c8e3319c0
SSDEEP 6144:P4RywzYmqBml6I7r/7mBUAUlIzFbi9I6KoQU:P4Ryed8I7r/7mBUd6bi9I6SU
TLSH
T1A2543A226A84E02AF29345756938D2B679293E750AD1DC0BB7C0BB1A38716D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 275KB
SHA256 3076477500b92b37cf0f271cbbfbdbe7d05c4984e5ba81248a8a0f09bbb7df24
MD5 560be5833452ff72dcd7975e07c423b9
SHA1 949db2405a9a8bc50c51159f2cfc563c7d1d97ad
SHA512 b95cd103801b645e900e8feb18460afdfeb3bef2834f96dd98c24994147ecc3658e0fa8fb5f482b86209f343b42ba8c62616fd2b14949806b7a91b1fe1aa95d3
SSDEEP 6144:P4RywzYmqBml6I7r/7mHUAUlIzFbi9I6KoQU:P4Ryed8I7r/7mHUd6bi9I6SU
TLSH
T115543A226A84E02AF29345756938D2B679293E750AD1DC0BB7C0BB1A38716D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 275KB
SHA256 015f1852825526f4814211933128f44f67e9c50d518da09ce69a3d971bf35f70
MD5 27220343b3169c257a6d1dad3cab5e37
SHA1 5d1743d9196c6f4c01ad00f4556d06ad63476174
SHA512 b9e2e5d52b7d0cd4baeb600756a50acbd35c47d90cc4a44c93066eefc009afa95d024f882acba950e2f0bbe71dde1455fb9393695e04cfa0e1cdb3582931d3a2
SSDEEP 6144:P4RywzYmqBml6I7r/7mFUAUlIzFbi9I6KoQU:P4Ryed8I7r/7mFUd6bi9I6SU
TLSH
T1D5543A226A84E02AF29345756938D2B679293E750AD1DC0BB7C0BB1A38716D3F5F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3868-74-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/4332-84-0x0000000000570000-0x00000000005EC000-memory.dmp

Download

memory/4332-273-0x0000000000570000-0x00000000005EC000-memory.dmp

Download

memory/4332-467-0x0000000000570000-0x00000000005EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads