sality | 35503c9da56c3d7dd88f5468806deeb5b9de351ae2445697cbbb00c4a7ea1a80

Analysis

max time kernel
121s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 168KB
Sample261023-pcxwpach45
SHA256 35503c9da56c3d7dd88f5468806deeb5b9de351ae2445697cbbb00c4a7ea1a80
MD5 553f957c57fa23b909845f3fc7002cc1
SHA1 cd0378e18444640441d86982a407d4383c190c6f
SHA512 79a6cd066cee6f6a03da93b3061920b65a70c7a3a2b6d681b123692d67485b85fca6a62b84e3332412d606473a30a0e52ae8d7ce44fd9953b072b0033a89911c
SSDEEP 3072:AhR8v6hD7EyQIrZhbSJK1q0KkX3c4XuVP27drGggmPcD:AhR8v6lgY51mLs7xgmPcD
TLSH
T154F3CF137752D032C82148720456C7967B2EFD265B76ED9373923F7B2E323D1AB2A606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery sality trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif

Signatures

Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

Modifies firewall policy service 3 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 40 IoCs

resource	yara_rule
behavioral1/memory/5388-1-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-6-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-9-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-17-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-20-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-18-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-10-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-8-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-7-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-3-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-22-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-23-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-24-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-25-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-26-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-28-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-29-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-30-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-31-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-36-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-38-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-39-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-42-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-46-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-47-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-50-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-49-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-51-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-53-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-56-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-57-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-59-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-61-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-63-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-65-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-67-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-77-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-80-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-83-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/5388-84-0x0000000002240000-0x00000000032FA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 41 IoCs

resource	yara_rule
behavioral1/memory/5388-1-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-6-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-9-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-17-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-20-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-18-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-10-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-8-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-7-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-3-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-22-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-23-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-24-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-25-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-26-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-28-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-29-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-30-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-31-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-36-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-38-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-39-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-42-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-46-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-47-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-50-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-49-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-51-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-53-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-56-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-57-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-59-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-61-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-63-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-65-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-67-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-77-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-80-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-83-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-84-0x0000000002240000-0x00000000032FA000-memory.dmp	UPX
behavioral1/memory/5388-87-0x0000000000400000-0x000000000042E000-memory.dmp	UPX

Windows security modification 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\R:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\V:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\Y:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\O:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\P:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\E:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\K:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\L:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\N:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\S:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\T:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\W:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\Z:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\G:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\J:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\Q:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\U:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\X:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\H:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\I:	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\autorun.inf	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

UPX packed file 40 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5388-1-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-6-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-9-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-17-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-20-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-18-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-10-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-8-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-7-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-3-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-22-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-23-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-24-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-25-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-26-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-28-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-29-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-30-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-31-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-36-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-38-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-39-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-42-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-46-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-47-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-50-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-49-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-51-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-53-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-56-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-57-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-59-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-61-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-63-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-65-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-67-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-77-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-80-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-83-0x0000000002240000-0x00000000032FA000-memory.dmp	upx
behavioral1/memory/5388-84-0x0000000002240000-0x00000000032FA000-memory.dmp	upx

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\e589287	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\SYSTEM.INI	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5388 wrote to memory of 780	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	8
PID 5388 wrote to memory of 788	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	9
PID 5388 wrote to memory of 508	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	14
PID 5388 wrote to memory of 2104	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	51
PID 5388 wrote to memory of 2580	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	52
PID 5388 wrote to memory of 1072	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	53
PID 5388 wrote to memory of 3288	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	56
PID 5388 wrote to memory of 3416	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	57
PID 5388 wrote to memory of 3604	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	58
PID 5388 wrote to memory of 3700	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	59
PID 5388 wrote to memory of 3764	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	60
PID 5388 wrote to memory of 3852	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	61
PID 5388 wrote to memory of 4040	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	62
PID 5388 wrote to memory of 5016	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	66
PID 5388 wrote to memory of 2116	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	78
PID 5388 wrote to memory of 5780	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	83
PID 5388 wrote to memory of 780	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	8
PID 5388 wrote to memory of 788	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	9
PID 5388 wrote to memory of 508	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	14
PID 5388 wrote to memory of 2104	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	51
PID 5388 wrote to memory of 2580	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	52
PID 5388 wrote to memory of 1072	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	53
PID 5388 wrote to memory of 3288	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	56
PID 5388 wrote to memory of 3416	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	57
PID 5388 wrote to memory of 3604	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	58
PID 5388 wrote to memory of 3700	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	59
PID 5388 wrote to memory of 3764	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	60
PID 5388 wrote to memory of 3852	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	61
PID 5388 wrote to memory of 4040	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	62
PID 5388 wrote to memory of 5016	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	66
PID 5388 wrote to memory of 2116	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	78
PID 5388 wrote to memory of 5780	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	83
PID 5388 wrote to memory of 780	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	8
PID 5388 wrote to memory of 788	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	9
PID 5388 wrote to memory of 508	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	14
PID 5388 wrote to memory of 2104	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	51
PID 5388 wrote to memory of 2580	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	52
PID 5388 wrote to memory of 1072	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	53
PID 5388 wrote to memory of 3288	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	56
PID 5388 wrote to memory of 3416	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	57
PID 5388 wrote to memory of 3604	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	58
PID 5388 wrote to memory of 3700	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	59
PID 5388 wrote to memory of 3764	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	60
PID 5388 wrote to memory of 3852	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	61
PID 5388 wrote to memory of 4040	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	62
PID 5388 wrote to memory of 5016	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	66
PID 5388 wrote to memory of 2116	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	78
PID 5388 wrote to memory of 5780	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	83
PID 5388 wrote to memory of 780	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	8
PID 5388 wrote to memory of 788	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	9
PID 5388 wrote to memory of 508	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	14
PID 5388 wrote to memory of 2104	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	51
PID 5388 wrote to memory of 2580	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	52
PID 5388 wrote to memory of 1072	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	53
PID 5388 wrote to memory of 3288	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	56
PID 5388 wrote to memory of 3416	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	57
PID 5388 wrote to memory of 3604	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	58
PID 5388 wrote to memory of 3700	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	59
PID 5388 wrote to memory of 3764	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	60
PID 5388 wrote to memory of 3852	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	61
PID 5388 wrote to memory of 4040	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	62
PID 5388 wrote to memory of 5016	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	66
PID 5388 wrote to memory of 2116	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	78
PID 5388 wrote to memory of 5780	5388	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	83

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:508

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2580

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:1072

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3288
- C:\Users\Admin\AppData\Local\Temp\2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_553f957c57fa23b909845f3fc7002cc1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3416

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3604

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3700

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3764

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3852

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5016

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2116

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:5780

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fpqoo.exe

Path C:\Users\Admin\AppData\Local\Temp\fpqoo.exe
Size 65KB
SHA256 ce55192c6797ac0123590cf4a2945349fcb0b65688eb26f01eea54544795f2f2
MD5 6e6e59156ffdca6419b75dc1bb01adaa
SHA1 b4c2c17ac2fff1f08249013c4261b6858229da7b
SHA512 e5867ce9fc4c985d0ad1ddda1b9473420124bffecd3dfb806a01b92a46cbc93dbab2aacf08642092004b1986483a73325138623e9397da836695e5c91fd0753f
SSDEEP 1536:0iSIGnKotV7blJdJN2/zpN+wIj8ZOqkSOE7l+w0m+GDccMwJ3Te74hW7JPrW:YnKotVnda/zq+JlOPw0mGcxDelW
TLSH
T1545301B62D5B40F6E614247BB88EFA55B32D646E168C3D008F9EBADF19D3A40141F12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlhe.pif

Path C:\nlhe.pif
Size 97KB
SHA256 8efd4ef6551290a35e0e0f0b3cfa6e8df6b6ffa814c76a76bdbdde1d44fce870
MD5 d8f06f3e08b51fe172268d8d352aa6a4
SHA1 766dcfb50aa79404a3f4c03f49db1fd9250fa6f0
SHA512 7bf1f5881d851c1adf6884fcbebc447bc48b9b1e1ec7435b26e199e2e2499949ad8f968b127836ff40df4832d438584a12732b6305f539cff713cc48670f77d0
SSDEEP 3072:hQzme9xxLaxd8aa4vlVr638ygDWMMq0+77PAPGq:i99LLaxKaa4vljDWMb0+77PAPGq
TLSH
T168A31229C2B4BEC7D2B8107308BC45D98714DDE5A7BD131A9DE097FA47212935E224BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5388-31-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-19-0x0000000000490000-0x0000000000492000-memory.dmp

Download

memory/5388-17-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-21-0x0000000000490000-0x0000000000492000-memory.dmp

Download

memory/5388-20-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-18-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-10-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-8-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-7-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-6-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-12-0x0000000002110000-0x0000000002111000-memory.dmp

Download

memory/5388-11-0x0000000000490000-0x0000000000492000-memory.dmp

Download

memory/5388-37-0x0000000000490000-0x0000000000492000-memory.dmp

Download

memory/5388-3-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-22-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-23-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-24-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-25-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-26-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-28-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-29-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-30-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-9-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5388-49-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-38-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-39-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-42-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-46-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-47-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-50-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-36-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-51-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-53-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-56-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-57-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-59-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-61-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-63-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-65-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-1-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-67-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-77-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-80-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-83-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-84-0x0000000002240000-0x00000000032FA000-memory.dmp

Download

memory/5388-87-0x0000000000400000-0x000000000042E000-memory.dmp

Download