26bbbf86d3ac07c1be7456f7dc69582298c7b8482d8fa5ad03d115f395978d6d

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/05/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260518-cejevsa19m
SHA256 26bbbf86d3ac07c1be7456f7dc69582298c7b8482d8fa5ad03d115f395978d6d
MD5 fb542fc09b295bf7c4d90a32c42850f3
SHA1 e483bb42beebf90c6c1e6ab64e70ef33530f7ee7
SHA512 94f54a81f94cb37667cfc6399d0ad4d7f6a66b2e0f3afce7ac5ababe918dccd050183ffc155d83245bd723900a32330eda03be4538454998151d26d538d58c57
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T13434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1244	CP.exe
3052	wrojhbztrm.exe
2072	CP.exe
4620	CP.exe
3964	i_wrojhbztrm.exe
3860	dbwtomgeyw.sys
4852	CP.exe
3900	trljdbvtol.exe
216	CP.exe
3024	CP.exe
2220	i_trljdbvtol.exe
1860	ywqoigbytq.sys
3068	CP.exe
1380	idyvqnigay.exe
3824	CP.exe
768	CP.exe
4800	i_idyvqnigay.exe
2960	lgdyvqoiga.sys
4152	CP.exe
2156	avtnlfdxvi.exe
988	CP.exe
4948	CP.exe
3948	i_avtnlfdxvi.exe
1040	snlfdxvpni.sys
4792	CP.exe
3956	hfaysqkfdx.exe
3368	CP.exe
1848	CP.exe
3860	i_hfaysqkfdx.exe
1052	zxspkhcaus.sys
3568	CP.exe
324	smkfcxvpnh.exe
796	CP.exe
5064	CP.exe
1312	i_smkfcxvpnh.exe
3056	pkhcamkecx.sys
4492	CP.exe
4004	xrpjhzusmk.exe
4896	CP.exe
1764	CP.exe
2932	i_xrpjhzusmk.exe
1328	xrpjhbzurm.sys
3720	CP.exe
5088	mcwuomhezx.exe
3624	CP.exe
3952	CP.exe
5044	i_mcwuomhezx.exe
1028	ecwuomgezw.sys
4552	CP.exe
780	trljezwrpj.exe
1652	CP.exe
116	CP.exe
4420	i_trljezwrpj.exe
1732	trljdbwtom.sys
1860	CP.exe
1736	mgeywqojgb.exe
1704	CP.exe
5048	CP.exe
3828	i_mgeywqojgb.exe
4460	eywqoigbyt.sys
3216	CP.exe
904	tnlgdyvqoi.exe
5012	CP.exe
4668	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupnhcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdxvi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhzusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhzusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idyvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdxvi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mcwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaysqkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idyvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaysqkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mcwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupnhcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljezwrpj.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3616	ipconfig.exe
3612	ipconfig.exe
2672	ipconfig.exe
4704	ipconfig.exe
4640	ipconfig.exe
2712	ipconfig.exe
3676	ipconfig.exe
756	ipconfig.exe
4920	ipconfig.exe
1712	ipconfig.exe
320	ipconfig.exe
3384	ipconfig.exe
4192	ipconfig.exe
1484	ipconfig.exe
5044	ipconfig.exe
3356	ipconfig.exe
1280	ipconfig.exe
4792	ipconfig.exe
2928	ipconfig.exe
5032	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04d0501bde8dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C99CBCB8-54A7-11F1-B05C-F23C4AB2DE8F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2653557453"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015ec7194f8c8944e8e3c279917e59d0e00000000020000000000106600000001000020000000c371d38008033d29a93d739f40883242340ec8ae743e435c981edc44c0e2a8cb000000000e8000000002000020000000770f58904aa49ccbab8774dead10a94c51d258f7c3f380a2f71ad9e84a522b2f2000000071c223d1f6acd883ef1a47cceff76a0245698179f528dd9740e79dd6a66d53064000000091c1d0c86683e7fbc384cfe1226cdb3670f1c92c65f8fd0367c91a29d4349db8db08ba1fc02357e5d91a277ce8c8f48ff92a6aa04171d3cc834c286c4cc4c64f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31254708"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015ec7194f8c8944e8e3c279917e59d0e000000000200000000001066000000010000200000003388178dfd595ae574afd9b70548e5ddbe9132c178b7847b88a9ce7736fdbb06000000000e800000000200002000000010eb819697bf446a2850401ced2a9cfeb692ae39d240c4145ded103357dd04cd200000004a32e1ed2ffae649d302944581d6499965563d4ea95437cbb852e85862ce965840000000b167ccd9ba13900fae8f871718de8020e5d0d957bb63edf41e35bdc8e51be9a815edc95db207b812d6253e988476e02a2f259e34c1ae2830b6b0afda76b9c9a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2659807418"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31254708"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d7fb00bde8dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "486086479"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3964	i_wrojhbztrm.exe
Token: SeDebugPrivilege	2220	i_trljdbvtol.exe
Token: SeDebugPrivilege	4800	i_idyvqnigay.exe
Token: SeDebugPrivilege	3948	i_avtnlfdxvi.exe
Token: SeDebugPrivilege	3860	i_hfaysqkfdx.exe
Token: SeDebugPrivilege	1312	i_smkfcxvpnh.exe
Token: SeDebugPrivilege	2932	i_xrpjhzusmk.exe
Token: SeDebugPrivilege	5044	i_mcwuomhezx.exe
Token: SeDebugPrivilege	4420	i_trljezwrpj.exe
Token: SeDebugPrivilege	3828	i_mgeywqojgb.exe
Token: SeDebugPrivilege	5036	i_tnlgdyvqoi.exe
Token: SeDebugPrivilege	4652	i_igaysqlidb.exe
Token: SeDebugPrivilege	2812	i_fdxvpnifay.exe
Token: SeDebugPrivilege	5008	i_xvpnhfzxsp.exe
Token: SeDebugPrivilege	1044	i_kecxupnhcx.exe
Token: SeDebugPrivilege	3540	i_wuomhezxrp.exe
Token: SeDebugPrivilege	3220	i_rpjhbztrmj.exe
Token: SeDebugPrivilege	4360	i_bwuomgeywr.exe
Token: SeDebugPrivilege	3508	i_jdywqoigay.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 1964	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	85
PID 1964 wrote to memory of 1996	1964	iexplore.exe	86
PID 3884 wrote to memory of 1244	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 3052 wrote to memory of 2072	3052	wrojhbztrm.exe	90
PID 3884 wrote to memory of 4620	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	98
PID 3884 wrote to memory of 4852	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 3900 wrote to memory of 216	3900	trljdbvtol.exe	104
PID 3884 wrote to memory of 3024	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 3884 wrote to memory of 3068	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 1380 wrote to memory of 3824	1380	idyvqnigay.exe	113
PID 3884 wrote to memory of 768	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 3884 wrote to memory of 4152	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 2156 wrote to memory of 988	2156	avtnlfdxvi.exe	122
PID 3884 wrote to memory of 4948	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 3884 wrote to memory of 4792	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 3956 wrote to memory of 3368	3956	hfaysqkfdx.exe	133
PID 3884 wrote to memory of 1848	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 3884 wrote to memory of 3568	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 324 wrote to memory of 796	324	smkfcxvpnh.exe	142
PID 3884 wrote to memory of 5064	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 3884 wrote to memory of 4492	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 4004 wrote to memory of 4896	4004	xrpjhzusmk.exe	151
PID 3884 wrote to memory of 1764	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 3884 wrote to memory of 3720	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 5088 wrote to memory of 3624	5088	mcwuomhezx.exe	160
PID 3884 wrote to memory of 3952	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 3884 wrote to memory of 4552	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 780 wrote to memory of 1652	780	trljezwrpj.exe	172
PID 3884 wrote to memory of 116	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 3884 wrote to memory of 1860	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 1736 wrote to memory of 1704	1736	mgeywqojgb.exe	181
PID 3884 wrote to memory of 5048	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	184
PID 3884 wrote to memory of 3216	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	188
PID 904 wrote to memory of 5012	904	tnlgdyvqoi.exe	190
PID 3884 wrote to memory of 4668	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	193
PID 3884 wrote to memory of 5004	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	197
PID 4432 wrote to memory of 2332	4432	igaysqlidb.exe	199
PID 3884 wrote to memory of 4224	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	202
PID 3884 wrote to memory of 1656	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	206
PID 3496 wrote to memory of 3888	3496	fdxvpnifay.exe	208
PID 3884 wrote to memory of 2712	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	211
PID 3884 wrote to memory of 1752	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	215
PID 4448 wrote to memory of 2556	4448	xvpnhfzxsp.exe	217
PID 3884 wrote to memory of 1572	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	220
PID 3884 wrote to memory of 2452	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	224
PID 2760 wrote to memory of 2588	2760	kecxupnhcx.exe	226
PID 3884 wrote to memory of 1428	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	229
PID 3884 wrote to memory of 3612	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	233
PID 1204 wrote to memory of 4904	1204	wuomhezxrp.exe	235
PID 3884 wrote to memory of 924	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	240
PID 3884 wrote to memory of 368	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	244
PID 1480 wrote to memory of 5108	1480	rpjhbztrmj.exe	246
PID 3884 wrote to memory of 3648	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	249
PID 3884 wrote to memory of 4168	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	253
PID 1556 wrote to memory of 3108	1556	bwuomgeywr.exe	255
PID 3884 wrote to memory of 2488	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	258
PID 3884 wrote to memory of 3352	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	262
PID 1156 wrote to memory of 176	1156	jdywqoigay.exe	264
PID 3884 wrote to memory of 4756	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	267
PID 3884 wrote to memory of 440	3884	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	271
PID 968 wrote to memory of 3768	968	tnlfdyvqni.exe	273

C:\Users\Admin\AppData\Local\Temp\2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1244
- - C:\Temp\wrojhbztrm.exe
    C:\Temp\wrojhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4620
- - C:\Temp\i_wrojhbztrm.exe
    C:\Temp\i_wrojhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbvtol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4852
- - C:\Temp\trljdbvtol.exe
    C:\Temp\trljdbvtol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbvtol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3024
- - C:\Temp\i_trljdbvtol.exe
    C:\Temp\i_trljdbvtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idyvqnigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3068
- - C:\Temp\idyvqnigay.exe
    C:\Temp\idyvqnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idyvqnigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:768
- - C:\Temp\i_idyvqnigay.exe
    C:\Temp\i_idyvqnigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdxvi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4152
- - C:\Temp\avtnlfdxvi.exe
    C:\Temp\avtnlfdxvi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdxvi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4948
- - C:\Temp\i_avtnlfdxvi.exe
    C:\Temp\i_avtnlfdxvi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfaysqkfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4792
- - C:\Temp\hfaysqkfdx.exe
    C:\Temp\hfaysqkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfaysqkfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1848
- - C:\Temp\i_hfaysqkfdx.exe
    C:\Temp\i_hfaysqkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfcxvpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3568
- - C:\Temp\smkfcxvpnh.exe
    C:\Temp\smkfcxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfcxvpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5064
- - C:\Temp\i_smkfcxvpnh.exe
    C:\Temp\i_smkfcxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhzusmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4492
- - C:\Temp\xrpjhzusmk.exe
    C:\Temp\xrpjhzusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhzusmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1764
- - C:\Temp\i_xrpjhzusmk.exe
    C:\Temp\i_xrpjhzusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mcwuomhezx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3720
- - C:\Temp\mcwuomhezx.exe
    C:\Temp\mcwuomhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mcwuomhezx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3952
- - C:\Temp\i_mcwuomhezx.exe
    C:\Temp\i_mcwuomhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljezwrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4552
- - C:\Temp\trljezwrpj.exe
    C:\Temp\trljezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljezwrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:116
- - C:\Temp\i_trljezwrpj.exe
    C:\Temp\i_trljezwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1860
- - C:\Temp\mgeywqojgb.exe
    C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5048
- - C:\Temp\i_mgeywqojgb.exe
    C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgdyvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3216
- - C:\Temp\tnlgdyvqoi.exe
    C:\Temp\tnlgdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgdyvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4668
- - C:\Temp\i_tnlgdyvqoi.exe
    C:\Temp\i_tnlgdyvqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqlidb.exe ups_run
  2⤵
  PID:5004
- - C:\Temp\igaysqlidb.exe
    C:\Temp\igaysqlidb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqlidb.exe ups_ins
  2⤵
  PID:4224
- - C:\Temp\i_igaysqlidb.exe
    C:\Temp\i_igaysqlidb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifay.exe ups_run
  2⤵
  PID:1656
- - C:\Temp\fdxvpnifay.exe
    C:\Temp\fdxvpnifay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifay.exe ups_ins
  2⤵
  PID:2712
- - C:\Temp\i_fdxvpnifay.exe
    C:\Temp\i_fdxvpnifay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfzxsp.exe ups_run
  2⤵
  PID:1752
- - C:\Temp\xvpnhfzxsp.exe
    C:\Temp\xvpnhfzxsp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins
  2⤵
  PID:1572
- - C:\Temp\i_xvpnhfzxsp.exe
    C:\Temp\i_xvpnhfzxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecxupnhcx.exe ups_run
  2⤵
  PID:2452
- - C:\Temp\kecxupnhcx.exe
    C:\Temp\kecxupnhcx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecxupnhcx.exe ups_ins
  2⤵
  PID:1428
- - C:\Temp\i_kecxupnhcx.exe
    C:\Temp\i_kecxupnhcx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhezxrp.exe ups_run
  2⤵
  PID:3612
- - C:\Temp\wuomhezxrp.exe
    C:\Temp\wuomhezxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomhezxrp.exe ups_ins
  2⤵
  PID:924
- - C:\Temp\i_wuomhezxrp.exe
    C:\Temp\i_wuomhezxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbztrmj.exe ups_run
  2⤵
  PID:368
- - C:\Temp\rpjhbztrmj.exe
    C:\Temp\rpjhbztrmj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbztrmj.exe ups_ins
  2⤵
  PID:3648
- - C:\Temp\i_rpjhbztrmj.exe
    C:\Temp\i_rpjhbztrmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomgeywr.exe ups_run
  2⤵
  PID:4168
- - C:\Temp\bwuomgeywr.exe
    C:\Temp\bwuomgeywr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomgeywr.exe ups_ins
  2⤵
  PID:2488
- - C:\Temp\i_bwuomgeywr.exe
    C:\Temp\i_bwuomgeywr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdywqoigay.exe ups_run
  2⤵
  PID:3352
- - C:\Temp\jdywqoigay.exe
    C:\Temp\jdywqoigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdywqoigay.exe ups_ins
  2⤵
  PID:4756
- - C:\Temp\i_jdywqoigay.exe
    C:\Temp\i_jdywqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdyvqni.exe ups_run
  2⤵
  PID:440
- - C:\Temp\tnlfdyvqni.exe
    C:\Temp\tnlfdyvqni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4704

C:\Temp\dbwtomgeyw.sys
C:\Temp\dbwtomgeyw.sys
1⤵
- Executes dropped EXE
PID:3860

C:\Temp\ywqoigbytq.sys
C:\Temp\ywqoigbytq.sys
1⤵
- Executes dropped EXE
PID:1860

C:\Temp\lgdyvqoiga.sys
C:\Temp\lgdyvqoiga.sys
1⤵
- Executes dropped EXE
PID:2960

C:\Temp\snlfdxvpni.sys
C:\Temp\snlfdxvpni.sys
1⤵
- Executes dropped EXE
PID:1040

C:\Temp\zxspkhcaus.sys
C:\Temp\zxspkhcaus.sys
1⤵
- Executes dropped EXE
PID:1052

C:\Temp\pkhcamkecx.sys
C:\Temp\pkhcamkecx.sys
1⤵
- Executes dropped EXE
PID:3056

C:\Temp\xrpjhbzurm.sys
C:\Temp\xrpjhbzurm.sys
1⤵
- Executes dropped EXE
PID:1328

C:\Temp\ecwuomgezw.sys
C:\Temp\ecwuomgezw.sys
1⤵
- Executes dropped EXE
PID:1028

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
- Executes dropped EXE
PID:1732

C:\Temp\eywqoigbyt.sys
C:\Temp\eywqoigbyt.sys
1⤵
- Executes dropped EXE
PID:4460

C:\Temp\yvqoigaysq.sys
C:\Temp\yvqoigaysq.sys
1⤵
PID:1164

C:\Temp\qkidavtnlf.sys
C:\Temp\qkidavtnlf.sys
1⤵
PID:4688

C:\Temp\icausnkfdx.sys
C:\Temp\icausnkfdx.sys
1⤵
PID:2600

C:\Temp\xsmkecxupn.sys
C:\Temp\xsmkecxupn.sys
1⤵
PID:176

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
PID:1484

C:\Temp\eztrmjecwu.sys
C:\Temp\eztrmjecwu.sys
1⤵
PID:2144

C:\Temp\jgbztrljeb.sys
C:\Temp\jgbztrljeb.sys
1⤵
PID:220

C:\Temp\tolgeywqoj.sys
C:\Temp\tolgeywqoj.sys
1⤵
PID:4628

C:\Temp\lgeywqoigb.sys
C:\Temp\lgeywqoigb.sys
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnlfdxvi.exe

Path C:\Temp\avtnlfdxvi.exe
Size 226KB
SHA256 102245a282ebaf427f9837c2e28d90ab386d2f3944cc6b36d43db79be6feb573
MD5 ae65940f8d69c5c12c23042f4a03f421
SHA1 63d0ddf1b824b9b51c58f2ab1a84ffe83adae257
SHA512 1f7ea4f5ac2e8ba3f671bb9629288f7c044b57021bf1126c5e1aca59f2e4530e0a2ca2fdf151e33883db85af9324ba1a538bcbb629c5634d6bfb83e19b9ce20c
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T1FA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtomgeyw.sys

Path C:\Temp\dbwtomgeyw.sys
Size 141KB
SHA256 d9d0a017e36622746d5531ceb3fd006640ccf54206921495b0995167a0e441fe
MD5 7ff5e80e5f4c128d759ae9041dfabac7
SHA1 6abaa63998a5edaa98bd8d410d3087dd963b69ed
SHA512 525e918743b78d0e9b7aefcd5761c0011566bddd34636b9e491d9e1b65a4006f6c0610b7829b777002dc4edb6f45689c5a40adb5dade0c8106abc1c530ef8b48
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaysqkfdx.exe

Path C:\Temp\hfaysqkfdx.exe
Size 226KB
SHA256 5bf4812202a77bef9ba74e4b1e3217c1b75b4fccdd777732ddc53fab0f76af8e
MD5 b9f2102f5027a82d1298a06fbe2cf699
SHA1 164dd1a3a3af7bebfb0bb10df222775e6adf401a
SHA512 fdedd12b9c4325db163e9669e34730e989b7022085e80d6c2befafe3422a50e06ca4c4c265213d01e5cf943f67150e99cb4ae901bd3a157bae90c95466e0c1ab
SSDEEP 3072:pGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:YXY4LK+a3lLNngoqRttA7
TLSH
T11B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avtnlfdxvi.exe

Path C:\Temp\i_avtnlfdxvi.exe
Size 226KB
SHA256 947ae00d7663906712c397fdf7f0c4f0d5083b54849d577e2bb5a6e35eccf27e
MD5 e618016660c819cc1a45ce2449c2612f
SHA1 be7bd82eeec4a56c254349be260d9b43e8a41fcf
SHA512 3d65d99b814e0988aee0ba3699dba2ec305683ff9b59a7a2607574e4a57bc2ef6091e539265255fed856033287ed43d2692c843031e6d53f1abf1ec9d913cb5b
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T13534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfaysqkfdx.exe

Path C:\Temp\i_hfaysqkfdx.exe
Size 226KB
SHA256 ffd734d1ad70a4070a3bce02120a64b7cb339066ab4710523d8bf1f974178a23
MD5 8ecc87259e8feaf193343b095eef8f3c
SHA1 af68d76e6bde1a2f3d74ebd5c8c70677f0530f25
SHA512 b7d978e253509253ca8a58c45d9001a27b12be1afbb57110a98b8614c30d914f54a4d0c7cbc332fdc4fb986beca70fda6a586cc64d15e9744ce3d12e8077b5fe
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T11A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idyvqnigay.exe

Path C:\Temp\i_idyvqnigay.exe
Size 226KB
SHA256 495931132c3b6c907dc96d1ba6840414e44311dcb3bda2d45a8f2a9a60ed839f
MD5 4af7eb9bb4b9e5701270521ea747fd2a
SHA1 a87a30cb46730a35176860e337c16d9bc5f65ef2
SHA512 9df57fa3bccc4acd914ec0edc495e53360b73cf624d903fcb6a147ac58853562cc99dbd171a0078cc8a9c0867b5acb0b8670cd7a0b42eaa4405cf6cd105daaf1
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T1E534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mcwuomhezx.exe

Path C:\Temp\i_mcwuomhezx.exe
Size 226KB
SHA256 00ca6df706ca1f9e20fa67379f4dbfee48fed5f72594d8041994f934bb7c6b7b
MD5 8738d69a9bc48759d54253e235cd62b7
SHA1 668079f40275d7afa44c869735a6ca7a3c852e95
SHA512 7f0e8669e454d2f87c22578971372d8424648cb4b226d5c1ebdfd2a51b60bef931439eb41f2c58f26e517a0694ceecffba4420ad25512c747af44ffc676b5337
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T13934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkfcxvpnh.exe

Path C:\Temp\i_smkfcxvpnh.exe
Size 226KB
SHA256 3200b4ef72747d416c4c63b649ecaf18022b221dfceeb8ee544b5a6a7898e254
MD5 fa7d2a9f1c7b2339a342c2e70c9816db
SHA1 b449d70d57ebc72b45d0af92c30c92f736f18a55
SHA512 8f240d3f8fc9e97bb36bebea96e44e4643cb8a1bc4e81484722f78db0b5f7736b38bab71b58a2455e9e8f24eaa5d0f6a4ffeba63a0b585b61cfb0f42fff93d22
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T12A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbvtol.exe

Path C:\Temp\i_trljdbvtol.exe
Size 226KB
SHA256 2a14f5fe92b2143a28704346c68685df0ceadc5ab7ecaf967d9f5794bd1d0fd1
MD5 b46c95900b6906b6137ff93da596689d
SHA1 7207d009e0de929390b2cf61284810e01e5794c6
SHA512 10eb511f8a211c638a2452e874dbc015730682f1602b4699274db2b6d98425c161d379689078589a9ad8d4cd3885fa50f87cb8908f3d0d4f4c839b17bd225eab
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T1F134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojhbztrm.exe

Path C:\Temp\i_wrojhbztrm.exe
Size 226KB
SHA256 ee1af7dbdbf80a2297484117e6a40b4648a54baae72e16ccf4b4ac471ca3b5ef
MD5 da0f4c1f775387b4382bd2fae7e3e0dd
SHA1 4ab03a2cee2a5621743a22311dd2f24836b047d8
SHA512 616add6f3e4577ca905416ab09ddee53aca062520b38067354d18d7a090933464f95c10109aa6e63f7220ea2b4d64c8a8487decc4e9b88d1c7729e16ac4ce32c
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T1F934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpjhzusmk.exe

Path C:\Temp\i_xrpjhzusmk.exe
Size 226KB
SHA256 8a70d19db265fad9ed15b6fd470e6d854d4e2f12b2cc29411165ed9ec9696946
MD5 366e0c173c8efbdd3fca9ebb1b1f6581
SHA1 2e3ea1e7928eebe97056dd39bf69950969397ee4
SHA512 10d73d984695bfc69c5cca371b97b7225251f29986de74ed7b2c66f9bcaa54fec56294479d2084dcf877f94c22a0283dd0958611c9a51f3c9c0997a95dd61341
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T15934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idyvqnigay.exe

Path C:\Temp\idyvqnigay.exe
Size 226KB
SHA256 868462b653f6f2a9867de04795ee457bda7fc7da339aff48cb73be2fa6a06c29
MD5 9f7b9d0fc42e0af646b43c1d97566b46
SHA1 2b8566dc2f949a7ddec80c57ea6afc4bc183ddab
SHA512 b3bd0af9ccf7a411e7065936afa6bd1acdd134d533895b8fe818a6159d69ccde829e6b87c60055b14e8af03b076604620d70cabe5ceed7dc94c3ea8c0fd2883c
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T1DB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvqoiga.sys

Path C:\Temp\lgdyvqoiga.sys
Size 141KB
SHA256 325cb97a9f99d5fccef0f343158953a9be8b404879a8c43d2c489ac3b8af5c45
MD5 86c80c703e901fdcb5e92128d7ad3194
SHA1 5f1e5518c317fd636a21c78829ffe79eeedec326
SHA512 0504d99f6b55b51ce7f2b8584343c42ff07c00c3f5579b111e640b269e9198b5d4e562406d6b923f40437f13eca0e235509756db026456401594dee79531db52
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BCE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mcwuomhezx.exe

Path C:\Temp\mcwuomhezx.exe
Size 226KB
SHA256 d397ba9161a26bddefc2c8380c2cc8a676707788f2c605029fe2e1e26b59777f
MD5 39520da0d7926d1c50c3708428d070bf
SHA1 c20ea863b83738f8b7c01d0f1cd7f097aa31334a
SHA512 4893f863843918bd870fc854afd38120a101a2d5ee428706490aaa817c8c2b13aa6004f6f957fd64db409cb82d540db2a0cb159cabf76b51f5cd030059b6e3f0
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T10134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcamkecx.sys

Path C:\Temp\pkhcamkecx.sys
Size 141KB
SHA256 cb6b236cfec557fcd8197262bdc68b9ad19f0c54a5e0d0d154d71d17a5ff5fa8
MD5 a1d7d582df054e69baf6e03b5b8aa988
SHA1 63f0c9bdd4eb082b7cedd599f0d0001f90ceb3fb
SHA512 3137073f5bb592a1d5febaf57e5832357b0296c7337dd47802fdf054eec02589df53584feb2d84325c46201f8af07eba0cc1d812bc8f0760ab9352125e1c0d34
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfcxvpnh.exe

Path C:\Temp\smkfcxvpnh.exe
Size 226KB
SHA256 8e776218e7ad0ba3f5003d3dcc9e99bc3985845b6e5d5c8d30a2602d7a8df937
MD5 8a1477b58633d19d8190e38f9b77b72a
SHA1 dc3ff728c23f538590aec13bcb45192042013e5b
SHA512 5f4bc501cd7149d0c5ce1a73b1cb084ca0902fce1a39979cbd02af708caffc7327b0aa7521099fbdd7b630c6722b15a094680436500c640128e66fae3f58dff9
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T1C734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvpni.sys

Path C:\Temp\snlfdxvpni.sys
Size 141KB
SHA256 572b2d5653061c8f75cd9a450dca0c023d40b460e29ec23e60c96c9d1632c1e1
MD5 61b7d9a9185408382640184800c4e448
SHA1 de2e920cd1a5158acb451a19ff2ce13cd2de548d
SHA512 bc4df5af79fd68788ff5abe459692e0def129a8fb256f87ecb428f18d3ad24a02f2b09393b85048a221d90cd2dfe98e13d5c3761499f474b8c5b76c5a71e4fe1
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.exe

Path C:\Temp\trljdbvtol.exe
Size 226KB
SHA256 50ea26e979552565c00762a91f5f669306e1ae55556d1c7a086e2eaa721a943b
MD5 379a6b46ca7ebe7d13279dd1c3f6b799
SHA1 91a0fc87c831ee7533291e533d92837a77c5d77e
SHA512 b6ab67b504d41e67bf0103823d734060d89ff1b8a9cc230b085163ff39ffedd186c815d66339cad83bee76e5270cb7a72f84ae118fe5fbc38c7fe04747386171
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T16C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbztrm.exe

Path C:\Temp\wrojhbztrm.exe
Size 226KB
SHA256 0016e7c8f7a220958764754834bf01b783797ed338bf81a44f2d9d12ef99bdca
MD5 18241514226a4b10abaa182dacb590b8
SHA1 2760d3d5aa044b49b792ab3b862255f546826d90
SHA512 68ecac4f49756dd43b0b8fc3fb7d49d5fba8b2efc13bef8463d4a07a013a9cd4357ad4dccbee7787ca84aa7cb85d600bf6959671c4464444c1375f12b127212f
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T1AF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhbzurm.sys

Path C:\Temp\xrpjhbzurm.sys
Size 141KB
SHA256 42cf7f946f3a2741aa697bc91765bae28b602f8c17ebf1d32f23427ae8a3984c
MD5 6fe5eef64c106c70fb9a8187f23a3bc5
SHA1 2e7cadd51b1689360677f0458d16b4004c2987a7
SHA512 ef9d734191861f89476b70666608ec9f243ed7a9aa932aa8691ed555803b595de915a4764525c1372939d9eb9c7f6c6cdd37bad28cd4a59ebe43aa7e7a16dad4
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11CE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhzusmk.exe

Path C:\Temp\xrpjhzusmk.exe
Size 226KB
SHA256 f8038d0ff2a9e6a38e7c1ee3c95bff638f8225ba5d45bb1600d523dad278f08e
MD5 79345d0014258f2ceaddb1e7a60a4618
SHA1 bee7b0578633adc5feb849af5ad11b50ed712800
SHA512 3b955f64fd9363f5f66ce39f532a28ee94e015d10e3beefa8c7f15aeda5b6ef2bdceba9f9958d951ac0a5d80260b8d3fc837cce2431ac8bc7376405917a721b1
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T13A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigbytq.sys

Path C:\Temp\ywqoigbytq.sys
Size 141KB
SHA256 3602d01c2e5f3e29a7e2353d8f08878e69a37164811f18535094ea7e84f51ef9
MD5 0cb4e784383f200721c30633d388232d
SHA1 147e2d91ae4afdf90a5e60eff945402a48e8cecc
SHA512 6c75376e9c1c0d2fbe55370237e406bb85e3cde42b941a097336894aea27f0b96b21d77830e5086a5a036600fc73b806ba58a8d63eb16d24684fdc2ede271bc5
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxspkhcaus.sys

Path C:\Temp\zxspkhcaus.sys
Size 141KB
SHA256 84b50a6d63b63c73726a4963970e81da360faed613b909180fd91c01d99ce933
MD5 37ae5dbf7dc99433062353d10740c719
SHA1 329b24622f918f0532294a4e33a58729ceb829b8
SHA512 3461be8a04281fd14836bd90dbb6797b6288489877dd16ebfcb5a432b11f65319a707dcd6aafe0d6b5a559507ec4127b9a7ab0d701f3aab4e6546c32341390db
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T146E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7WDI8WC1\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/176-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/220-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1028-113-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1028-101-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1040-52-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1052-66-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1164-121-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1328-90-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1484-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1732-112-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1860-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2144-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2600-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2960-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3056-78-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3800-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3860-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4460-117-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4628-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4688-125-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads