Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 20:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
- Size 4.1MB
- Sample260808-yrmtpstenh
- SHA256 48b2953da3cbd023d86d40dffd702c7283adc21fe9ccc2858a6afa0025ed63b2
- MD5 e2b43e3d4dbe5b947282b4628c56eb0c
- SHA1 63d540741295c75ceba09c93eb56a8517d055d90
- SHA512 2007e67afffc4f5658325cb00caa94174c06ecd75c7572a5d1aeaf427b17516e1de6f05d08d5c9e083cfe68167dbf141740e056724c04f7f451f400d33479805
- SSDEEP 98304:3aNcqGHkt9hBwnKjRQxFwi8uCLebOhe1ua5J/Wkl89TV:KeqeQ9hoMRupXCLe71/+w+
- TLSH T144163325F112C471E69BD43C55A8EE8523A9F53A012FC6B737D43E3B08F47A01AD93A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Glupteba payload 21 IoCs
resource yara_rule behavioral2/memory/2480-2-0x0000000005460000-0x0000000005D4B000-memory.dmp family_glupteba behavioral2/memory/2480-33-0x0000000005460000-0x0000000005D4B000-memory.dmp family_glupteba behavioral2/memory/2480-35-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/1836-63-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/1836-73-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4696-95-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4176-101-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/5260-125-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/2428-129-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4176-145-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/1796-154-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4176-156-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4176-157-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4176-158-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4176-159-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4176-160-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4176-161-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4176-162-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4176-163-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4176-164-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba behavioral2/memory/4176-165-0x0000000000400000-0x0000000003122000-memory.dmp family_glupteba - Windows security bypass 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Detects Windows executables referencing non-Windows User-Agents 19 IoCs
resource yara_rule behavioral2/memory/2480-35-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1836-63-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1836-73-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4696-95-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4176-101-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/5260-125-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/2428-129-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4176-145-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1796-154-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4176-156-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4176-157-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4176-158-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4176-159-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4176-160-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4176-161-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4176-162-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4176-163-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4176-164-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4176-165-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Detects executables Discord URL observed in first stage droppers 19 IoCs
resource yara_rule behavioral2/memory/2480-35-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/1836-63-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/1836-73-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4696-95-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4176-101-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/5260-125-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/2428-129-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4176-145-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/1796-154-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4176-156-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4176-157-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4176-158-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4176-159-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4176-160-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4176-161-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4176-162-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4176-163-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4176-164-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/4176-165-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL - Detects executables containing URLs to raw contents of a Github gist 19 IoCs
resource yara_rule behavioral2/memory/2480-35-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/1836-63-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/1836-73-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4696-95-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4176-101-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/5260-125-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/2428-129-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4176-145-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/1796-154-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4176-156-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4176-157-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4176-158-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4176-159-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4176-160-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4176-161-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4176-162-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4176-163-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4176-164-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4176-165-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables containing artifacts associated with disabling Widnows Defender 19 IoCs
resource yara_rule behavioral2/memory/2480-35-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/1836-63-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/1836-73-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4696-95-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4176-101-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/5260-125-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/2428-129-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4176-145-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/1796-154-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4176-156-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4176-157-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4176-158-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4176-159-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4176-160-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4176-161-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4176-162-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4176-163-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4176-164-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender behavioral2/memory/4176-165-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender - Detects executables referencing many varying, potentially fake Windows User-Agents 19 IoCs
resource yara_rule behavioral2/memory/2480-35-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/1836-63-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/1836-73-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4696-95-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4176-101-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/5260-125-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/2428-129-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4176-145-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/1796-154-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4176-156-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4176-157-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4176-158-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4176-159-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4176-160-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4176-161-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4176-162-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4176-163-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4176-164-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral2/memory/4176-165-0x0000000000400000-0x0000000003122000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2328 netsh.exe - Executes dropped EXE 6 IoCs
pid Process 4176 csrss.exe 4696 csrss.exe 2428 csrss.exe 5260 csrss.exe 1796 csrss.exe 4104 injector.exe - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe - Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 34 IoCs
description ioc Process File created C:\Windows\SystemTemp\__PSScriptPolicyTest_42qrljpa.typ.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_wcdkjqa0.fml.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_h1hemr3j.hyu.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_hqh3qqwv.fva.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_sbuxtdgb.u3o.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_vfpbdb1y.xrj.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_snipqoq0.sqw.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_grthorw0.fba.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_5bat2ql4.umx.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_kprgjbli.ybi.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ldihmajz.nnu.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_otpll5m1.jcf.psm1 powershell.exe File created C:\Windows\rss\csrss.exe 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_xioy43w3.d1z.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_y3zfw5d5.00g.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_qjwdtptd.vvz.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_j05rgk0r.0aj.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ocw0bsbf.hcg.ps1 powershell.exe File opened for modification C:\Windows\rss 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_0n1laxuv.xb5.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_zyrzbfy1.rj3.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_tyyrfajo.sq1.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_wtmfpiwk.iam.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_x2kftjoi.o0j.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ukfmvdp5.ips.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_wtmmknj2.u45.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_l3tnseol.abq.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_gizhxis1.s4c.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_xpv5a4ym.kb4.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_0c1mrsj2.wxa.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ilxtd1l1.v4l.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_mjihfkv2.4rw.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ui5rrq1h.psh.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_c3ds3quc.1li.ps1 powershell.exe -
pid Process 3948 powershell.exe 4160 powershell.exe 4776 powershell.exe 5356 powershell.exe 3084 powershell.exe 5816 powershell.exe 1132 powershell.exe 4260 powershell.exe 3732 powershell.exe 5656 powershell.exe 4100 powershell.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4504 cmd.exe - Program crash 4 IoCs
pid pid_target Process procid_target 2716 1836 WerFault.exe 95 1712 4696 WerFault.exe 108 4224 5260 WerFault.exe 131 3284 1796 WerFault.exe 137 - System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3332 schtasks.exe 4192 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4100 powershell.exe 4100 powershell.exe 2480 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 2480 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3948 powershell.exe 3948 powershell.exe 3948 powershell.exe 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 3084 powershell.exe 3084 powershell.exe 3084 powershell.exe 5816 powershell.exe 5816 powershell.exe 5816 powershell.exe 4160 powershell.exe 4160 powershell.exe 4776 powershell.exe 4776 powershell.exe 4160 powershell.exe 4776 powershell.exe 4696 csrss.exe 4696 csrss.exe 5356 powershell.exe 5356 powershell.exe 5356 powershell.exe 5356 powershell.exe 1132 powershell.exe 1132 powershell.exe 4260 powershell.exe 4260 powershell.exe 1132 powershell.exe 4260 powershell.exe 5260 csrss.exe 5260 csrss.exe 3732 powershell.exe 3732 powershell.exe 5656 powershell.exe 5656 powershell.exe 3732 powershell.exe 5656 powershell.exe 4104 injector.exe 4104 injector.exe 4104 injector.exe 4104 injector.exe 4104 injector.exe 4104 injector.exe 4176 csrss.exe 4176 csrss.exe 4104 injector.exe 4104 injector.exe 4104 injector.exe 4104 injector.exe 4104 injector.exe 4104 injector.exe 4104 injector.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4100 powershell.exe Token: SeIncreaseQuotaPrivilege 4100 powershell.exe Token: SeSecurityPrivilege 4100 powershell.exe Token: SeTakeOwnershipPrivilege 4100 powershell.exe Token: SeLoadDriverPrivilege 4100 powershell.exe Token: SeSystemProfilePrivilege 4100 powershell.exe Token: SeSystemtimePrivilege 4100 powershell.exe Token: SeProfSingleProcessPrivilege 4100 powershell.exe Token: SeIncBasePriorityPrivilege 4100 powershell.exe Token: SeCreatePagefilePrivilege 4100 powershell.exe Token: SeBackupPrivilege 4100 powershell.exe Token: SeRestorePrivilege 4100 powershell.exe Token: SeShutdownPrivilege 4100 powershell.exe Token: SeDebugPrivilege 4100 powershell.exe Token: SeSystemEnvironmentPrivilege 4100 powershell.exe Token: SeRemoteShutdownPrivilege 4100 powershell.exe Token: SeUndockPrivilege 4100 powershell.exe Token: SeManageVolumePrivilege 4100 powershell.exe Token: 33 4100 powershell.exe Token: 34 4100 powershell.exe Token: 35 4100 powershell.exe Token: 36 4100 powershell.exe Token: SeDebugPrivilege 2480 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeImpersonatePrivilege 2480 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3948 powershell.exe Token: SeAssignPrimaryTokenPrivilege 3948 powershell.exe Token: SeIncreaseQuotaPrivilege 3948 powershell.exe Token: SeSecurityPrivilege 3948 powershell.exe Token: SeTakeOwnershipPrivilege 3948 powershell.exe Token: SeLoadDriverPrivilege 3948 powershell.exe Token: SeSystemtimePrivilege 3948 powershell.exe Token: SeBackupPrivilege 3948 powershell.exe Token: SeRestorePrivilege 3948 powershell.exe Token: SeShutdownPrivilege 3948 powershell.exe Token: SeSystemEnvironmentPrivilege 3948 powershell.exe Token: SeUndockPrivilege 3948 powershell.exe Token: SeManageVolumePrivilege 3948 powershell.exe Token: SeDebugPrivilege 3084 powershell.exe Token: SeAssignPrimaryTokenPrivilege 3084 powershell.exe Token: SeIncreaseQuotaPrivilege 3084 powershell.exe Token: SeSecurityPrivilege 3084 powershell.exe Token: SeTakeOwnershipPrivilege 3084 powershell.exe Token: SeLoadDriverPrivilege 3084 powershell.exe Token: SeSystemtimePrivilege 3084 powershell.exe Token: SeBackupPrivilege 3084 powershell.exe Token: SeRestorePrivilege 3084 powershell.exe Token: SeShutdownPrivilege 3084 powershell.exe Token: SeSystemEnvironmentPrivilege 3084 powershell.exe Token: SeUndockPrivilege 3084 powershell.exe Token: SeManageVolumePrivilege 3084 powershell.exe Token: SeDebugPrivilege 5816 powershell.exe Token: SeAssignPrimaryTokenPrivilege 5816 powershell.exe Token: SeIncreaseQuotaPrivilege 5816 powershell.exe Token: SeSecurityPrivilege 5816 powershell.exe Token: SeTakeOwnershipPrivilege 5816 powershell.exe Token: SeLoadDriverPrivilege 5816 powershell.exe Token: SeSystemtimePrivilege 5816 powershell.exe Token: SeBackupPrivilege 5816 powershell.exe Token: SeRestorePrivilege 5816 powershell.exe Token: SeShutdownPrivilege 5816 powershell.exe Token: SeSystemEnvironmentPrivilege 5816 powershell.exe Token: SeUndockPrivilege 5816 powershell.exe Token: SeManageVolumePrivilege 5816 powershell.exe Token: SeDebugPrivilege 4160 powershell.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2480 wrote to memory of 4100 2480 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 90 PID 1836 wrote to memory of 3948 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 96 PID 1836 wrote to memory of 4504 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 98 PID 4504 wrote to memory of 2328 4504 cmd.exe 100 PID 1836 wrote to memory of 3084 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 101 PID 1836 wrote to memory of 5816 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 103 PID 1836 wrote to memory of 4176 1836 2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe 106 PID 4176 wrote to memory of 4160 4176 csrss.exe 111 PID 4696 wrote to memory of 4776 4696 csrss.exe 113 PID 4176 wrote to memory of 5356 4176 csrss.exe 120 PID 2428 wrote to memory of 1132 2428 csrss.exe 133 PID 5260 wrote to memory of 4260 5260 csrss.exe 135 PID 1796 wrote to memory of 3732 1796 csrss.exe 140 PID 4176 wrote to memory of 5656 4176 csrss.exe 142 PID 4176 wrote to memory of 4104 4176 csrss.exe 145 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_e2b43e3d4dbe5b947282b4628c56eb0c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2328
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5816
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4160
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Scheduled Task/Job: Scheduled Task
PID:3332
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:2096
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5356
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5656
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4104
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Scheduled Task/Job: Scheduled Task
PID:4192
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 8203⤵
- Program crash
PID:2716
-
-
-
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4776
-
-
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1132
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 7922⤵
- Program crash
PID:1712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1836 -ip 18361⤵PID:1572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4696 -ip 46961⤵PID:3352
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4260
-
-
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 9083⤵
- Program crash
PID:3284
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 8082⤵
- Program crash
PID:4224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5260 -ip 52601⤵PID:2956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1796 -ip 17961⤵PID:1876
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 026ab56dc4c2acb1828a5d6e26868b6092afffe1f53a14a6b823e4bd119878c0
- MD5 4e371cb8d382d9c431f8203c39edf561
- SHA1 c49f7e144640ea2bd7a43f7d2146030a97051fc2
- SHA512 5974e7aed83a9451fcd166e6815162a783ae622b55143e9b5f9bb61e780eb62bf90dc28c760b882815423d5cd093f4f519cff8804816a24b5ec7a0bff40b5481
- SSDEEP 384:KSEboT1iBVH16wn2y806zgErr2PsiUDzdC0wIAgl3Mbex564/5SHlObhN2GRYeLW:+0Z6VHYKN8/zgk6pUFC0wIAgl3Mbep/i
- TLSH T152A2D628227F5DC7D8C121B041D10BA6FBE4D046E6E250E9BB9EDE1F5C81E7B4A611F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 22KB
- SHA256 5fa23f91dbe7d149b34a7cdde100973ad8c4deb28d734b15b07a21145b94d9fe
- MD5 d66077d826f25a0664f867a4dbe72a27
- SHA1 c31f82213b8dcfd126d9b79129f8661a2c6c1a6c
- SHA512 04962f33e85f7fb9311533c263e4d7320aa8c4c1d9036655e755fce97dd168905004fcb468a7e8b6bd5c1da8c4c73a678cf1fbe1dcf99837fd15fc82650d01c5
- SSDEEP 384:n1eBImaI1iBVNGH14bLCfjTh+geCr8apPnlIArlZF4R9LXeqWDcRRx5ocJNg6rKj:1eVaY6VIHiHCfPh+cXdIArTFQbe1crxC
- TLSH T1A0A2C778213F6DC7D8D222B051D202F7FBE4D4499AB555D8FF2BDA2F0C90EB64AA0524
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
- Size 281KB
- SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
- MD5 d98e33b66343e7c96158444127a117f6
- SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
- SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
- SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
- TLSH T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 161f7c64cd94a8f3cc52b8bb0506b7ca0b8467c8c7a2b14da659dfda96fbfa48
- MD5 9951fdc8a35b47ce4ad9ad283ff360b5
- SHA1 090b8cbd9f3e22e25e81f11c7e8554ee038c58d2
- SHA512 33cf8479946a9a6840d62477607072556e8f91c5f7130db382953f493d949f42b19485da88161ec95711ecc958771d24eba8dc4684b7324431f5691accb2d4d8
- SSDEEP 384:c1eBaoT1iBV4J+fOo0O/h2Bl/r2PHWOEkNIAgl3M6pd4EnGAzV3Pk6BbR5/BXEjt:YexZ6V4J+Wof/hWZ6+NqIAgl3M6pd/Xq
- TLSH T120A2F72C26AF5DCBD49161A814814393FBE8D158E2E651EFEF0BC91F2845A7E5F500E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 239afafb80368a6277adec4497d81f0bd5daf71685a32c343e6a2a647b3636f3
- MD5 0f3b3664a8b472b93614e02cace0c8b9
- SHA1 7da21a6bac6796442857959d3accc0ab11179c09
- SHA512 8abea213739b567021568d3de0c631409fb4907dd38ecb4d6577f5e053c9bfa490195174665bd53885b84bc71b34de635d693e7ba57f0c8d2746719ce65a5cb7
- SSDEEP 384:H1eBaoT1iBGM5y5eb0+9xteCmrKOWOEPiUDzdC0BWIAq3M6FsloyBAQrXkN6BbR2:VexZ6GM5y4T9xoYN6UFC0BWIAq3M6FZ7
- TLSH T158A2D52C26EF8DCBC99020B900C14796E7F4D165A3E152DBAB8FDD1F28496BD9A501FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 71297af1038c7afcdd558c0aab64e6c39b01fd33b649e9b18178c5d83d3741f4
- MD5 fc17ea6008022d964c828e08a0fff9af
- SHA1 f055128fb292095310633f67825d382cf895ca25
- SHA512 e920f4cadf388bf00c44a6d510ebf3a6b5b0e78dfd5f9d568bd3887729821ac8d957d194e909ef2f3398f0a69c135cce42ede96b52ac81ab481d18117b806dbe
- SSDEEP 384:y1eBaoT1iBVaGW14bY5fOtLgg7CeD2PnZIArlZO5d4Pstd35S1KJJ6bhNBUpDYeS:yexZ6VBWikfOtLgoyRIArTK8sHDobhN/
- TLSH T126A2C678203F6DC7D8C216B411D10AE7FBE4D4499AB651D4BF2FDE2F4C90ABB4A60524
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 c61ad64888d80d41612273327601833e0f15732d84e67a9900fc2b47b2b33961
- MD5 9111d564af31e6ec6b63837c8f84882c
- SHA1 5b4848d96889d79999272d92fb45c77745420932
- SHA512 a4aee98053f916525a0164c74a2bf71d836b7ae738a218a72417c40cb905d4d0429598b8703c732e78986d7e578a0a98f1ff21b4d99031a30e57bc62d617f377
- SSDEEP 384:e1eBaoT1iBG2bTy6BPueozCgcaWOEk4C0BWIAgl3MG5Ilor35SmArXk56BXRX4jX:OexZ6G2PXBPuDcrNjC0BWIAgl3MGdjHn
- TLSH T197A2E72D26AF4DCBC49060B514C14383EBE8D168A3E652EBAF5FD91F2C45A7E4E501F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 11ea0f313e456c527b6e553fd3bcba8aa16a8e15ac564471e6f756ef5350f99a
- MD5 a304de737b9bb9adc20fa33f1073d04a
- SHA1 0ec7455cc132ad8dd19dfce774de7589347aaab3
- SHA512 76423e786447f55dbc9818df9bae16336b89dda70c9854a963287f30cf201e83d990e53944e3978122850bfa4542b852cda9eee7aea29998f026f456285660eb
- SSDEEP 384:c1eBaoT1iBG8bDoE4/yD+geCar0PtWOEfzdC0AIAq3M6Jt4kvf35Bor9kb6RRX4z:YexZ6G8voEPD+xoUNZC0AIAq3M6Jt3v7
- TLSH T1E8A2072D26BB4DCAEA9061F414814386FBE4D152E1E642DBEF5FC91F2842A7E5E500FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 21KB
- SHA256 d7b61b09f6b59efb6469f407fa336e54c2336b0066b27fcfb248ae3f0d007654
- MD5 864453a55c221f1bcd4871c5ed581eba
- SHA1 e001c8b810e8fa48b33f17d4a755932867a56c61
- SHA512 8079b2934fdcb37741cb748dc7a98180866257e9dff0c4111e42d9fe9d2e6a0403b47d6e2fff5f2c716b6793886397574d560f63b5b05a627185bd4bfa5f3739
- SSDEEP 384:Z1eBaoT1iBVHGVULEobelpl28+gsfor2P5YOEkY8Il3M61Yl4t4BAfVXxm6BppRa:DexZ6VmeLHbclZ+c6SNftl3M61NLfV45
- TLSH T145A2D72C26AF9DCBD491216900C14393EBE8D558A7F152DBAF0FDD1F2845ABD8E601EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\__PSScriptPolicyTest_ldihmajz.nnu.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\rss\csrss.exe
- Size 4.1MB
- SHA256 48b2953da3cbd023d86d40dffd702c7283adc21fe9ccc2858a6afa0025ed63b2
- MD5 e2b43e3d4dbe5b947282b4628c56eb0c
- SHA1 63d540741295c75ceba09c93eb56a8517d055d90
- SHA512 2007e67afffc4f5658325cb00caa94174c06ecd75c7572a5d1aeaf427b17516e1de6f05d08d5c9e083cfe68167dbf141740e056724c04f7f451f400d33479805
- SSDEEP 98304:3aNcqGHkt9hBwnKjRQxFwi8uCLebOhe1ua5J/Wkl89TV:KeqeQ9hoMRupXCLe71/+w+
- TLSH T144163325F112C471E69BD43C55A8EE8523A9F53A012FC6B737D43E3B08F47A01AD93A6
- MD5 SHA1 SHA512 SSDEEP TLSH