702ea0bf6fbee3ab68f82c999f0106b9b21ca2bb13dcbf4304ec8101b46f2e9f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260421-e5b5kshw6l
SHA256 702ea0bf6fbee3ab68f82c999f0106b9b21ca2bb13dcbf4304ec8101b46f2e9f
MD5 d0a2867c77159dcdb391af1623a52791
SHA1 608d5fe0fb336c05fbf11dd0a8d6e1dddd6fb64b
SHA512 340695eb6c7829850213b7c685e8fd35e1d395e1dc5123b81183a886eeffe215feb05b452f9667abf5b44b46c7cc6616f2b13eb9e36ac307ef4f3fdb5ce8c4f5
SSDEEP 3072:rGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:qXY4LK+a3lLNngoqRttA7
TLSH
T14334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3312	CP.exe
1708	geywrojhbz.exe
4764	CP.exe
3460	CP.exe
2812	i_geywrojhbz.exe
3316	wqoigbytql.sys
3772	CP.exe
2844	ljdbvtolge.exe
4472	CP.exe
4492	CP.exe
1732	i_ljdbvtolge.exe
1656	qoigaysqli.sys
4244	CP.exe
4228	igaytqlidb.exe
2688	CP.exe
816	CP.exe
4932	i_igaytqlidb.exe
4320	vtnlfdxvqn.sys
4604	CP.exe
3608	faxsqkicav.exe
3940	CP.exe
1292	CP.exe
4756	i_faxsqkicav.exe
1628	pnhfaxsqki.sys
1948	CP.exe
896	ifaysqkica.exe
1912	CP.exe
2012	CP.exe
2812	i_ifaysqkica.exe
776	pkfcxvpnhf.sys
4752	CP.exe
4904	fzxrpkhcau.exe
4088	CP.exe
3432	CP.exe
4296	i_fzxrpkhcau.exe
3400	khczusmkec.sys
1188	CP.exe
3008	cwupmhfzxr.exe
2388	CP.exe
2652	CP.exe
4548	i_cwupmhfzxr.exe
2372	jecwuomhez.sys
4320	CP.exe
4512	rojhbztrmj.exe
1980	CP.exe
3448	CP.exe
4800	i_rojhbztrmj.exe
4196	eywrojhbzt.sys
664	CP.exe
772	wrpjhbztrm.exe
3440	CP.exe
3128	CP.exe
2184	i_wrpjhbztrm.exe
5036	eywrojgbzt.sys
2808	CP.exe
4460	trljdbwtom.exe
1700	CP.exe
2152	CP.exe
2932	i_trljdbwtom.exe
1756	ytqljdbvtn.sys
4640	CP.exe
1828	nlgdyvqoig.exe
820	CP.exe
3464	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmherpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmherpjhb.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4904	ipconfig.exe
3844	ipconfig.exe
2780	ipconfig.exe
4068	ipconfig.exe
2436	ipconfig.exe
760	ipconfig.exe
2072	ipconfig.exe
4296	ipconfig.exe
972	ipconfig.exe
3372	ipconfig.exe
3068	ipconfig.exe
3016	ipconfig.exe
1880	ipconfig.exe
1768	ipconfig.exe
1720	ipconfig.exe
3648	ipconfig.exe
464	ipconfig.exe
1488	ipconfig.exe
4668	ipconfig.exe
3148	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01db51d50d1dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3370465968"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31248711"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d1a77838ff140841b607707f2d19fbf40000000002000000000010660000000100002000000019636099aca1f89600944b6076b7df6ef08ecf06e713a9fb7cc11bc0191ab653000000000e800000000200002000000070903740921e370775a27941c6fb62646299a0ea42c60beb328d4d1a18831c6a200000003053b13527ce0183eda1b9cc66468b516bb4739875adae4ac659dba19e41950840000000958f9f4a3a8b57acd7c7986bd7d6d3b7a7bc9a1707321b1d205cd3f9e7a87c127390d216b98774f0a1b15769ca521541f7484e43381eb210487b765090b5e793	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d8b91d50d1dc01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "483510836"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E6B6B4A4-3D3A-11F1-87B0-7AB34D7E7C3E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d1a77838ff140841b607707f2d19fbf4000000000200000000001066000000010000200000000f6eb3af7a7890cc04fee240980927e3788ff6d842968f01c61c305730ac3162000000000e8000000002000020000000700d22153de85a3756d3e0934710f25b05feff54727e7105d718c5b538d32f51200000003d27c2b57a67f64ae875ec458ea8fdcbd7d69e5ea09dd9435398bda0ae482fdf4000000067579f091cf2e2dac61b63827e3f0ea114e9b57d18aed94d58b0f0961e69213ea3dcb8ee8c60f0428b4a610b059ef244cc626eb8b13e7003874624bb0b1d7048	iexplore.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	i_geywrojhbz.exe
Token: SeDebugPrivilege	1732	i_ljdbvtolge.exe
Token: SeDebugPrivilege	4932	i_igaytqlidb.exe
Token: SeDebugPrivilege	4756	i_faxsqkicav.exe
Token: SeDebugPrivilege	2812	i_ifaysqkica.exe
Token: SeDebugPrivilege	4296	i_fzxrpkhcau.exe
Token: SeDebugPrivilege	4548	i_cwupmhfzxr.exe
Token: SeDebugPrivilege	4800	i_rojhbztrmj.exe
Token: SeDebugPrivilege	2184	i_wrpjhbztrm.exe
Token: SeDebugPrivilege	2932	i_trljdbwtom.exe
Token: SeDebugPrivilege	2904	i_nlgdyvqoig.exe
Token: SeDebugPrivilege	4788	i_nifaysqlfd.exe
Token: SeDebugPrivilege	3196	i_snlfdxvpni.exe
Token: SeDebugPrivilege	1064	i_pnhfzxspki.exe
Token: SeDebugPrivilege	2248	i_pkhcausmke.exe
Token: SeDebugPrivilege	2668	i_upmherpjhb.exe
Token: SeDebugPrivilege	3284	i_rmjecwuomg.exe
Token: SeDebugPrivilege	2572	i_mgeywrljeb.exe
Token: SeDebugPrivilege	3916	i_wqoigbytrl.exe
Token: SeDebugPrivilege	4740	i_tnlfdxvqni.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4276	iexplore.exe
4276	iexplore.exe
3776	IEXPLORE.EXE
3776	IEXPLORE.EXE
3776	IEXPLORE.EXE
3776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 4276	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	84
PID 4276 wrote to memory of 3776	4276	iexplore.exe	85
PID 4280 wrote to memory of 3312	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	86
PID 1708 wrote to memory of 4764	1708	geywrojhbz.exe	89
PID 4280 wrote to memory of 3460	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	94
PID 4280 wrote to memory of 3772	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 2844 wrote to memory of 4472	2844	ljdbvtolge.exe	103
PID 4280 wrote to memory of 4492	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	108
PID 4280 wrote to memory of 4244	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	112
PID 4228 wrote to memory of 2688	4228	igaytqlidb.exe	114
PID 4280 wrote to memory of 816	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 4280 wrote to memory of 4604	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 3608 wrote to memory of 3940	3608	faxsqkicav.exe	123
PID 4280 wrote to memory of 1292	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 4280 wrote to memory of 1948	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 896 wrote to memory of 1912	896	ifaysqkica.exe	133
PID 4280 wrote to memory of 2012	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 4280 wrote to memory of 4752	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 4904 wrote to memory of 4088	4904	fzxrpkhcau.exe	142
PID 4280 wrote to memory of 3432	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 4280 wrote to memory of 1188	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 3008 wrote to memory of 2388	3008	cwupmhfzxr.exe	151
PID 4280 wrote to memory of 2652	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 4280 wrote to memory of 4320	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 4512 wrote to memory of 1980	4512	rojhbztrmj.exe	160
PID 4280 wrote to memory of 3448	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 4280 wrote to memory of 664	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 772 wrote to memory of 3440	772	wrpjhbztrm.exe	169
PID 4280 wrote to memory of 3128	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 4280 wrote to memory of 2808	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 4460 wrote to memory of 1700	4460	trljdbwtom.exe	178
PID 4280 wrote to memory of 2152	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 4280 wrote to memory of 4640	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 1828 wrote to memory of 820	1828	nlgdyvqoig.exe	187
PID 4280 wrote to memory of 3464	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 4280 wrote to memory of 4136	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	194
PID 1904 wrote to memory of 4652	1904	nifaysqlfd.exe	196
PID 4280 wrote to memory of 4844	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	199
PID 4280 wrote to memory of 1852	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	203
PID 4196 wrote to memory of 1652	4196	snlfdxvpni.exe	205
PID 4280 wrote to memory of 4256	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	208
PID 4280 wrote to memory of 5040	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	213
PID 1608 wrote to memory of 1884	1608	pnhfzxspki.exe	215
PID 4280 wrote to memory of 828	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	218
PID 4280 wrote to memory of 4524	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	222
PID 452 wrote to memory of 4896	452	pkhcausmke.exe	224
PID 4280 wrote to memory of 4544	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	227
PID 4280 wrote to memory of 1092	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	231
PID 1304 wrote to memory of 1844	1304	upmherpjhb.exe	233
PID 4280 wrote to memory of 2904	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	236
PID 4280 wrote to memory of 3180	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	240
PID 3016 wrote to memory of 4356	3016	rmjecwuomg.exe	242
PID 4280 wrote to memory of 4908	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	245
PID 4280 wrote to memory of 540	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	249
PID 3524 wrote to memory of 3572	3524	mgeywrljeb.exe	251
PID 4280 wrote to memory of 3816	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	254
PID 4280 wrote to memory of 932	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	258
PID 2024 wrote to memory of 3728	2024	wqoigbytrl.exe	260
PID 4280 wrote to memory of 4784	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	263
PID 4280 wrote to memory of 3692	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	267
PID 1756 wrote to memory of 1848	1756	tnlfdxvqni.exe	269
PID 4280 wrote to memory of 3596	4280	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	272

C:\Users\Admin\AppData\Local\Temp\2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4276 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywrojhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3312
- - C:\Temp\geywrojhbz.exe
    C:\Temp\geywrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywrojhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3460
- - C:\Temp\i_geywrojhbz.exe
    C:\Temp\i_geywrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtolge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3772
- - C:\Temp\ljdbvtolge.exe
    C:\Temp\ljdbvtolge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtolge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4492
- - C:\Temp\i_ljdbvtolge.exe
    C:\Temp\i_ljdbvtolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytqlidb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4244
- - C:\Temp\igaytqlidb.exe
    C:\Temp\igaytqlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytqlidb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:816
- - C:\Temp\i_igaytqlidb.exe
    C:\Temp\i_igaytqlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4604
- - C:\Temp\faxsqkicav.exe
    C:\Temp\faxsqkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1292
- - C:\Temp\i_faxsqkicav.exe
    C:\Temp\i_faxsqkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaysqkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1948
- - C:\Temp\ifaysqkica.exe
    C:\Temp\ifaysqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaysqkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2012
- - C:\Temp\i_ifaysqkica.exe
    C:\Temp\i_ifaysqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkhcau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4752
- - C:\Temp\fzxrpkhcau.exe
    C:\Temp\fzxrpkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3432
- - C:\Temp\i_fzxrpkhcau.exe
    C:\Temp\i_fzxrpkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhfzxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1188
- - C:\Temp\cwupmhfzxr.exe
    C:\Temp\cwupmhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2388
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhfzxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2652
- - C:\Temp\i_cwupmhfzxr.exe
    C:\Temp\i_cwupmhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4320
- - C:\Temp\rojhbztrmj.exe
    C:\Temp\rojhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3448
- - C:\Temp\i_rojhbztrmj.exe
    C:\Temp\i_rojhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:664
- - C:\Temp\wrpjhbztrm.exe
    C:\Temp\wrpjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3128
- - C:\Temp\i_wrpjhbztrm.exe
    C:\Temp\i_wrpjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2808
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2152
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdyvqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4640
- - C:\Temp\nlgdyvqoig.exe
    C:\Temp\nlgdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdyvqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3464
- - C:\Temp\i_nlgdyvqoig.exe
    C:\Temp\i_nlgdyvqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaysqlfd.exe ups_run
  2⤵
  PID:4136
- - C:\Temp\nifaysqlfd.exe
    C:\Temp\nifaysqlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaysqlfd.exe ups_ins
  2⤵
  PID:4844
- - C:\Temp\i_nifaysqlfd.exe
    C:\Temp\i_nifaysqlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run
  2⤵
  PID:1852
- - C:\Temp\snlfdxvpni.exe
    C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins
  2⤵
  PID:4256
- - C:\Temp\i_snlfdxvpni.exe
    C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxspki.exe ups_run
  2⤵
  PID:5040
- - C:\Temp\pnhfzxspki.exe
    C:\Temp\pnhfzxspki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxspki.exe ups_ins
  2⤵
  PID:828
- - C:\Temp\i_pnhfzxspki.exe
    C:\Temp\i_pnhfzxspki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhcausmke.exe ups_run
  2⤵
  PID:4524
- - C:\Temp\pkhcausmke.exe
    C:\Temp\pkhcausmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhcausmke.exe ups_ins
  2⤵
  PID:4544
- - C:\Temp\i_pkhcausmke.exe
    C:\Temp\i_pkhcausmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmherpjhb.exe ups_run
  2⤵
  PID:1092
- - C:\Temp\upmherpjhb.exe
    C:\Temp\upmherpjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmherpjhb.exe ups_ins
  2⤵
  PID:2904
- - C:\Temp\i_upmherpjhb.exe
    C:\Temp\i_upmherpjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run
  2⤵
  PID:3180
- - C:\Temp\rmjecwuomg.exe
    C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins
  2⤵
  PID:4908
- - C:\Temp\i_rmjecwuomg.exe
    C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywrljeb.exe ups_run
  2⤵
  PID:540
- - C:\Temp\mgeywrljeb.exe
    C:\Temp\mgeywrljeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywrljeb.exe ups_ins
  2⤵
  PID:3816
- - C:\Temp\i_mgeywrljeb.exe
    C:\Temp\i_mgeywrljeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigbytrl.exe ups_run
  2⤵
  PID:932
- - C:\Temp\wqoigbytrl.exe
    C:\Temp\wqoigbytrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigbytrl.exe ups_ins
  2⤵
  PID:4784
- - C:\Temp\i_wqoigbytrl.exe
    C:\Temp\i_wqoigbytrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdxvqni.exe ups_run
  2⤵
  PID:3692
- - C:\Temp\tnlfdxvqni.exe
    C:\Temp\tnlfdxvqni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdxvqni.exe ups_ins
  2⤵
  PID:3596
- - C:\Temp\i_tnlfdxvqni.exe
    C:\Temp\i_tnlfdxvqni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4740

C:\Temp\wqoigbytql.sys
C:\Temp\wqoigbytql.sys
1⤵
- Executes dropped EXE
PID:3316

C:\Temp\qoigaysqli.sys
C:\Temp\qoigaysqli.sys
1⤵
- Executes dropped EXE
PID:1656

C:\Temp\vtnlfdxvqn.sys
C:\Temp\vtnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:4320

C:\Temp\pnhfaxsqki.sys
C:\Temp\pnhfaxsqki.sys
1⤵
- Executes dropped EXE
PID:1628

C:\Temp\pkfcxvpnhf.sys
C:\Temp\pkfcxvpnhf.sys
1⤵
- Executes dropped EXE
PID:776

C:\Temp\khczusmkec.sys
C:\Temp\khczusmkec.sys
1⤵
- Executes dropped EXE
PID:3400

C:\Temp\jecwuomhez.sys
C:\Temp\jecwuomhez.sys
1⤵
- Executes dropped EXE
PID:2372

C:\Temp\eywrojhbzt.sys
C:\Temp\eywrojhbzt.sys
1⤵
- Executes dropped EXE
PID:4196

C:\Temp\eywrojgbzt.sys
C:\Temp\eywrojgbzt.sys
1⤵
- Executes dropped EXE
PID:5036

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
- Executes dropped EXE
PID:1756

C:\Temp\dbvtnlfdyv.sys
C:\Temp\dbvtnlfdyv.sys
1⤵
PID:2196

C:\Temp\dysqkidavt.sys
C:\Temp\dysqkidavt.sys
1⤵
PID:4964

C:\Temp\ausnkfcxvp.sys
C:\Temp\ausnkfcxvp.sys
1⤵
PID:1712

C:\Temp\fcxupfzxrp.sys
C:\Temp\fcxupfzxrp.sys
1⤵
PID:3316

C:\Temp\fzurpkecwu.sys
C:\Temp\fzurpkecwu.sys
1⤵
PID:3724

C:\Temp\zxrpjhbzur.sys
C:\Temp\zxrpjhbzur.sys
1⤵
PID:2044

C:\Temp\tomgeywqoj.sys
C:\Temp\tomgeywqoj.sys
1⤵
PID:4300

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
PID:4892

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmhfzxr.exe

Path C:\Temp\cwupmhfzxr.exe
Size 226KB
SHA256 053c4812e2c7cee952a785d8f143a053186f570b10c9afde9454023026a14f38
MD5 56eb156e3c896c7e887830e32890d4db
SHA1 e1e599c62ad5b25f8662020046d321a993a592c8
SHA512 fcf4fda56ff11d36f3dcb66cf000296b6b18df923149910d0137964ad28a554769e48bba1243370f121c24a9e8bcf192c6e6e81171b73816bf77d5e3c78eaed6
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T10D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsqkicav.exe

Path C:\Temp\faxsqkicav.exe
Size 226KB
SHA256 c76c25aca90f86727439d6da01ecc064ad7ae346f7ecbbbe7dcb79eac65b612c
MD5 93e52c87a1d4e432a6f9f6c6a0314241
SHA1 107a799cfeaa0993dcf9c30091effc983f468974
SHA512 21689cd454aaf13eb7878fbb36013619833d149b5ec817263dcbfd28e91f3736dedc076da6aa5e68e4738fdf5bd1c54085e1688ae230790e2f0106dbe44dca0b
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T1FF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhcau.exe

Path C:\Temp\fzxrpkhcau.exe
Size 226KB
SHA256 1244fe102aeb817bd4478ee351ee1f7784677ce792d1ac5495d150589459e8e7
MD5 6f5f642533e0be963c24b132073cf55c
SHA1 fc3cc9c6ea2cd8848a32e0c4dc5e4cf6b14343e8
SHA512 3b973c93bb28f67fa523fa7ad76d0dc1c3a3f2a50d4240d2d67dc9b4cc038a14c8d80443bbcea467e75a6a80c438ab139c51f28c11e95c2b2789f26b08822507
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T1D334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojhbz.exe

Path C:\Temp\geywrojhbz.exe
Size 226KB
SHA256 3a88f6fee284bfb068c72470e65c86a69853ab869e34b19bfc8df764b7c8d33d
MD5 b5aafa39f8d92155caa0979622dd5a5b
SHA1 3f4608e6a43182be72049ce1aaf719cbec8e4002
SHA512 065bb9545b3118acae698b24927ab8cf1e204bbc9130ed198ca49e4b46d9fffbc48a640cbf26a2d238286a2af97f20fa8b3ba85d9f4411fef3318ca89b2c1338
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T1A534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwupmhfzxr.exe

Path C:\Temp\i_cwupmhfzxr.exe
Size 226KB
SHA256 4f2800810b87f43b86cb29d49721a46e23f4b823125b46d26a3ece58dbd53616
MD5 52edb91307781c613f7de46cd4926168
SHA1 a31b18acbb83688fe2c04cffd5ddf3b6496ef99c
SHA512 021ea60f1f27061fc23eefcc55549c6955818db58f498185f9bc0bf4bed6245457bc47bc1b1962c5cadbd6f4d1bc73e9eda1b155cc2b476338f32d5bb1b86ffc
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T16734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxsqkicav.exe

Path C:\Temp\i_faxsqkicav.exe
Size 226KB
SHA256 415d183dcffb08229d05356c04e3f462c9bd3f146ae9e333fff2fe4e860db737
MD5 3d0b4e3707785ea86a356dbaceaac13a
SHA1 688dc5b829f0f6dbae507a488d4f72e80b3f8cf2
SHA512 dc106042ecf28e39a478f63b6070e4f641319b494cd0e5ff84926e8bb73ae1e7dad387845b0608c77daa93ef30111faf8a2f500fdf204f4d58916de710580eb0
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T1DF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpkhcau.exe

Path C:\Temp\i_fzxrpkhcau.exe
Size 226KB
SHA256 2038971afac4e44fb712fbdc89689dca854aab8e1bee93b0bed44930cc82031e
MD5 d8f490f2b8fc045f3ab70561c5ea8e8c
SHA1 197bd47355adc1f31c6b1254dca756365ef28340
SHA512 bb6b409fdcfe6354c57d9a4a03b96104e98344e0645ba1ed42fad1fc3d7f09cdc06c530b60cf5be37f66fd76f227331d4de82e7335d984a56cb3e0bd9ea1c717
SSDEEP 3072:ZGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:IXY4LK+a3lLNngoqRttA7
TLSH
T19F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywrojhbz.exe

Path C:\Temp\i_geywrojhbz.exe
Size 226KB
SHA256 853d368701ca737f7a155c5d2a2247bcba21dbcec2ca146b60e1aeba33ea1e6f
MD5 ab596b2deb6f20e542b6a7b46777af8b
SHA1 7733082e09feaadf52c4d8899c68660fb26c5c4a
SHA512 8ac54585de629fa0d138e21927dbd96cd9d98b023858eec3486928da684404e6c1e262f3087b143db12352a61ffa18476552ec0d41cc0811ce9d4c3f89fa253e
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T1A534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaysqkica.exe

Path C:\Temp\i_ifaysqkica.exe
Size 226KB
SHA256 f712e74d074c7fbf4de21d2aa3d4b943995677e00bab98d0c0d29d2f636e8069
MD5 6a1e5e283fa666f97804cff6fe155db3
SHA1 7594ea32c5b82334737408b79b6f5fc33682709f
SHA512 3b2ea21683a8a3daad392d75a421c948cee27134b70919b1aac2e7890067e5d3840de900060a42e21153353b21fdc8794b6d281f5ccc9a51226c63cc582314b8
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T1F834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaytqlidb.exe

Path C:\Temp\i_igaytqlidb.exe
Size 226KB
SHA256 f4675fe8af4eb6e899e6b3503dfdddec9742b682ea9f8122efca4e56348d61c7
MD5 3c98f7d2321254d39d1522a7b7ef23f5
SHA1 44e6ad6709f19fce39ea1c2433474096db425ff0
SHA512 21c4abbabee0ba2a926146b0703e399372bd522a5991c6fd8a91aebcd64813f121f8526bdd9cae8344f45fd50db229e3a9406364b4969fa9fcb2d2554c2895d1
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T18B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtolge.exe

Path C:\Temp\i_ljdbvtolge.exe
Size 226KB
SHA256 54cdd7b6d4e15d0eb81ce86dddc2cde58de2dff484a21bd42ecce7bda00aab7c
MD5 c5ce33f7885d72a0427c6209dca53b0d
SHA1 81dcc3e925df46a05dff0ca2a00faba5bdcd5ad5
SHA512 720b64c6d8039dbe2cf344769a442509ac2a8f309dd76e4902134daae8a670b4a1fbb8086f5a48e82caf8e8f0702a005ebd9e26b88222579c9260ff1377994d8
SSDEEP 3072:pGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:YXY4LK+a3lLNngoqRttA7
TLSH
T1EF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojhbztrmj.exe

Path C:\Temp\i_rojhbztrmj.exe
Size 226KB
SHA256 42eaa361ed92fc83eb44e2783d3cb7bd7176906a5ac05045a6b6aad05add0fd0
MD5 1c71e30f2ad7cab45d19e8e580aff8b4
SHA1 0578ec0a9f503ca89cf1e56adbf957ea87251955
SHA512 77453438c684bb5195c1dd8d0a8d1986739f95e88bd57041a5bef779d353805d86a6de34192c998afb65b167b1efbf6f450d585562e551cfc4ed057ea0bbddeb
SSDEEP 3072:1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:UXY4LK+a3lLNngoqRttA7
TLSH
T18B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkica.exe

Path C:\Temp\ifaysqkica.exe
Size 226KB
SHA256 31e9c5aafc7d666b59c4afde9c5234fad8a2206bb90d33cb434fca81c565bc74
MD5 7ffd7bb5e16fb59c9f5d0089bcfb1a7b
SHA1 3f087870058032f8e4490a46c04bf4547dca81b2
SHA512 0f16dd9bc845b62c346666e9b8821c1b56efe4b413aadcf4ffd10513fea5c36d148e80ee65f43893e19464c90140ed00823adf66ee256eb155d829b3ae6615e6
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T12534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaytqlidb.exe

Path C:\Temp\igaytqlidb.exe
Size 226KB
SHA256 16c374461e31d0dae614edfc81c39f5a5ebcff91fe115978a5519f26bf4f1ed4
MD5 e290994a90743767426235a587890698
SHA1 558be325589c4b7a915b75bb98b071182583d0dd
SHA512 aa334a2a4e30093bb59ff4af22b4c9cb6cca0f82d21b3997b69e9c2898e3db0b4985cdc78262353775098b1349b1c39fe16f13f98460e62e6beeb9cef6c9a2fd
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T1D334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jecwuomhez.sys

Path C:\Temp\jecwuomhez.sys
Size 141KB
SHA256 10c8d08cd91dae71a9862ed1a55673bb0190e71c2d21a2781be54c1df046d3a5
MD5 04a1893c7fc965dc99fc93ccd9fa323f
SHA1 e40263539cc20f5332d1a11b7f868e360f5c7bac
SHA512 ea9792ddae96fe05beb05fb5451e2a92699cfbac880aa49cdadaa8088df49abdb54c93dc3c2c94aad265a6092b0989f266127db3e55f4b41d0158b79defba85b
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khczusmkec.sys

Path C:\Temp\khczusmkec.sys
Size 141KB
SHA256 dea356f4d9efd1e5ec1521ca73ed882b9d6f60d6e995c0aebedd4be6334cca0f
MD5 0380ff4a38e149d94bb1716b269ab1be
SHA1 730b788244b3127e699fcdd6139c099dab70353f
SHA512 33f548c72296aa1a08d0951480392c1ac1d9aa7828989acd6670f22d19f4a6db6f60702dcb263e7c59ad2c320ab9a12fd474871bd431b63ee04cff1e40e92fc1
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T172E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtolge.exe

Path C:\Temp\ljdbvtolge.exe
Size 226KB
SHA256 a113ce04a91b921e9016404ba603e353a74ad2e3fd66b8810b3783f12e978ce1
MD5 b9823ef6a2f5173ab1e95821ee95bf5c
SHA1 60db76f9dca71611b43d13b3c7598d6e5c4c84c8
SHA512 e3412dd3a2e03f308502aaa2faaad933cd08d94766967c2c293f96e5daf146ae67a1cc77d944a743b4af120008080e4990306d325ada6229c42079706b286ed1
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T16034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkfcxvpnhf.sys

Path C:\Temp\pkfcxvpnhf.sys
Size 141KB
SHA256 c929c48a93f26bd29b2fd08e8f0400fa3f58544f5fd9a824f12a084daeeea58a
MD5 80d7d999466275fbe8298a99d9d5b445
SHA1 a8a06caf71384469b88f6fd7333d52cedd5364ef
SHA512 44411335fdba97f24fef5cfa37ca172be3499654d914941cdfde2bacad90e90e5d78f754b5ef3d61b2adf4dd2b5b9adc5fb11348ab90a63166c3ffbaf81b6352
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T147E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfaxsqki.sys

Path C:\Temp\pnhfaxsqki.sys
Size 141KB
SHA256 b344e9fb8a7c68b28f3045303b8430ee19ccbf884a75eab4de5daa8de9b71f57
MD5 440eacb5ac1845c5f9cf531cdc370dce
SHA1 031b4edfc1946289bfba2ff851de4bdd1bc255f5
SHA512 1eafda3a03437d7257b4705c0ce6004488a45afbbeba48942916c068d973a32ad362e9781e570a0b1c99a370ade1e129f1290aabd2d65bb53a7c62e806e86e59
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T160E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysqli.sys

Path C:\Temp\qoigaysqli.sys
Size 141KB
SHA256 e770f0d2d40ac8cd72da681e589dbfbea84886e88027c7fe3e4c49feca504164
MD5 06c9c9ee78bc56ac49ea61544a09ba14
SHA1 99448e4c05303b324fad788add6cd5f92c417181
SHA512 3586e97f446619f5c233fd977376248eae5804c866d35011714dfe772a49c3f68e330a0a4639ac7fcee8d3bb55884859cda619582ae679eabd5bae2165de2056
SSDEEP 1536:1a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:1a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D8E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrmj.exe

Path C:\Temp\rojhbztrmj.exe
Size 226KB
SHA256 4b3383db8267ae4008517d6037c66954ab2e062e2e9e886639588e9569e85ea2
MD5 25fb93524c4bff901ad8d3c0c4bf546f
SHA1 43baf1d1649f136a81663f416f8db4933f733a40
SHA512 dea04f53f5f22a0c9c342159462d224990dc6bd7110e67b7ae44351739dbf4fa04522004788d318855d6e2f1783ca29207e44ce3eecb6ba70c701991730cfc21
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T15434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxvqn.sys

Path C:\Temp\vtnlfdxvqn.sys
Size 141KB
SHA256 0e229f51ad7316948ca158300fd1cdbe6a81f52e88702a3623f5a37378fb92cc
MD5 af3aea9636a9e80d6701ded95a551761
SHA1 b2b5cc751c533f1d850bce066ff7ada2cd314741
SHA512 c1f6b536b1069173e61d8cd78f3e8655a0964752784fc4895f3f0d1c0a842ed189f4833de201dbd3e419a1d06839294ece428bf19bc53fa75cae32e7840c276f
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T184E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigbytql.sys

Path C:\Temp\wqoigbytql.sys
Size 141KB
SHA256 c15d48fb34762c8422d816021dfb35c2615bed83ff67cdae2f363a15a99897a7
MD5 5ff06ee77548f22c04fb4ed70023d251
SHA1 92ceb80f79919697c44e90f361211e89921c1203
SHA512 137ac42893b6c397bcb9bfc59aadc931869c0a071fc7248488cd2cd54b40e49058f8d4068aae741a4728261b567ac5fcde2fe02669a42cd6f1ca08691f236b7d
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T177E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\424V513Z\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/776-64-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1628-50-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1656-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1712-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1756-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2044-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2196-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2372-91-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3316-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3316-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3400-76-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3724-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4196-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4300-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4320-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4736-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4892-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4964-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5036-116-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads