778976110d59bc415adeb014c448c552f7ca78c604649a73981b11f50d4d9908

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/05/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260530-ssamwagy6w
SHA256 778976110d59bc415adeb014c448c552f7ca78c604649a73981b11f50d4d9908
MD5 d30196dde83f09c75ac406dfddcb9887
SHA1 06ab63d28f98e1458951b530da6caaac11911a2f
SHA512 3cb5a92daecd42f96e882f06b21beefd1f7b7028938af73a21967448d811ffc7dc1fb74285d574f252933ddaa92b68c64521ca378f9b3c190d624d2c518aedd0
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T16034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
880	CP.exe
5968	igbytrljdb.exe
2840	CP.exe
5576	CP.exe
4888	i_igbytrljdb.exe
1172	gaytqljdbv.sys
2196	CP.exe
792	bvtnlgdywq.exe
1656	CP.exe
1848	CP.exe
5512	i_bvtnlgdywq.exe
5776	aysqlidbvt.sys
2348	CP.exe
2148	tnlfdxvqni.exe
4524	CP.exe
4072	CP.exe
1648	i_tnlfdxvqni.exe
6056	vqkicavsnl.sys
3480	CP.exe
4852	lfdxvqnifa.exe
3924	CP.exe
996	CP.exe
3264	i_lfdxvqnifa.exe
2812	xvpnifaxsq.sys
1668	CP.exe
4892	icaupnhfzx.exe
2120	CP.exe
4560	CP.exe
2288	i_icaupnhfzx.exe
4568	spkhcausmk.sys
5476	CP.exe
6108	kecxupnhfz.exe
2688	CP.exe
4108	CP.exe
2060	i_kecxupnhfz.exe
436	pjhczurmke.sys
316	CP.exe
3916	ecwuomhezx.exe
3748	CP.exe
4556	CP.exe
5844	i_ecwuomhezx.exe
4496	kezwrpjhbz.sys
752	CP.exe
1080	ztrmgeywro.exe
2436	CP.exe
5920	CP.exe
2132	i_ztrmgeywro.exe
5744	jebwuomgey.sys
5956	CP.exe
1548	qojgbztrlj.exe
3704	CP.exe
1836	CP.exe
3680	i_qojgbztrlj.exe
908	dbvtolgeyw.sys
2184	CP.exe
6008	wtomgeywqo.exe
4464	CP.exe
2808	CP.exe
5964	i_wtomgeywqo.exe
4848	dbvtnlfdyv.sys
5952	CP.exe
1604	vtnlgdywqo.exe
5412	CP.exe
4888	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnkf.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1604	ipconfig.exe
5476	ipconfig.exe
4192	ipconfig.exe
3084	ipconfig.exe
3736	ipconfig.exe
5184	ipconfig.exe
6088	ipconfig.exe
4876	ipconfig.exe
1904	ipconfig.exe
3636	ipconfig.exe
5916	ipconfig.exe
5212	ipconfig.exe
5852	ipconfig.exe
4208	ipconfig.exe
872	ipconfig.exe
6136	ipconfig.exe
3740	ipconfig.exe
4732	ipconfig.exe
2480	ipconfig.exe
5228	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a5b5a450f0dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6E0237E0-5C3B-11F1-92B0-761C4632812C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000049a593bfc1a93b4c90d42fa23be0011f000000000200000000001066000000010000200000004b8f1b19f3f1a51484c8e6fd3e06e386ca92952c0cacabe6f61e55f13b5ed2bb000000000e8000000002000020000000506718837f9fccb7a681d88255797dea4003d623ba9c86924b11b576907d783620000000936d14f53bac43079f1c6f4552af3d916a705aabfd736fa11f12bc43cc0b5cd540000000f1fef469b203be0d01c81164d51d2a5094a5eef7a1cf9956169cea8e7d70163c635815deaa5185f2810d5e13be94560979c3e47420991b5f9fbb1118b1b5ef7e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80efb7a450f0dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31256648"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000049a593bfc1a93b4c90d42fa23be0011f00000000020000000000106600000001000020000000373d64069076440117c821b291beac42ab784b13b048af9368edc689d5b3bb87000000000e8000000002000020000000bba36f006db8b6dae2beb0665c78303627370d0e74337d9ffcd1e6ef29cf0a0b200000005f836b7aa9b5eb910366faab725aae166418fd65ed66a58bef60de37c1da55f940000000d5ad0151f468663c6a6a7ab08338bc2f5501d288c84ac264bf038754365a3d63ae907fc760338cb3f99219b9aac9f42dd3acc4a2675cc88672964b4ae9f9870a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1119358616"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "486919549"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	i_igbytrljdb.exe
Token: SeDebugPrivilege	5512	i_bvtnlgdywq.exe
Token: SeDebugPrivilege	1648	i_tnlfdxvqni.exe
Token: SeDebugPrivilege	3264	i_lfdxvqnifa.exe
Token: SeDebugPrivilege	2288	i_icaupnhfzx.exe
Token: SeDebugPrivilege	2060	i_kecxupnhfz.exe
Token: SeDebugPrivilege	5844	i_ecwuomhezx.exe
Token: SeDebugPrivilege	2132	i_ztrmgeywro.exe
Token: SeDebugPrivilege	3680	i_qojgbztrlj.exe
Token: SeDebugPrivilege	5964	i_wtomgeywqo.exe
Token: SeDebugPrivilege	4008	i_vtnlgdywqo.exe
Token: SeDebugPrivilege	1700	i_sqkidavsnl.exe
Token: SeDebugPrivilege	2160	i_qkicausnkf.exe
Token: SeDebugPrivilege	2496	i_snkfdxvpnh.exe
Token: SeDebugPrivilege	4844	i_pjhczusmke.exe
Token: SeDebugPrivilege	4216	i_mkecwuomhe.exe
Token: SeDebugPrivilege	5468	i_jdbwtomgey.exe
Token: SeDebugPrivilege	4652	i_rljdbwtolg.exe
Token: SeDebugPrivilege	6044	i_rljdbvtolg.exe
Token: SeDebugPrivilege	4236	i_kidavtnlfd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
732	iexplore.exe
732	iexplore.exe
5100	IEXPLORE.EXE
5100	IEXPLORE.EXE
5100	IEXPLORE.EXE
5100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 732	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	86
PID 732 wrote to memory of 5100	732	iexplore.exe	87
PID 4752 wrote to memory of 880	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	91
PID 5968 wrote to memory of 2840	5968	igbytrljdb.exe	94
PID 4752 wrote to memory of 5576	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	100
PID 4752 wrote to memory of 2196	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 792 wrote to memory of 1656	792	bvtnlgdywq.exe	107
PID 4752 wrote to memory of 1848	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 4752 wrote to memory of 2348	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 2148 wrote to memory of 4524	2148	tnlfdxvqni.exe	121
PID 4752 wrote to memory of 4072	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 4752 wrote to memory of 3480	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 4852 wrote to memory of 3924	4852	lfdxvqnifa.exe	136
PID 4752 wrote to memory of 996	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 4752 wrote to memory of 1668	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 4892 wrote to memory of 2120	4892	icaupnhfzx.exe	148
PID 4752 wrote to memory of 4560	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 4752 wrote to memory of 5476	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 6108 wrote to memory of 2688	6108	kecxupnhfz.exe	158
PID 4752 wrote to memory of 4108	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 4752 wrote to memory of 316	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 3916 wrote to memory of 3748	3916	ecwuomhezx.exe	167
PID 4752 wrote to memory of 4556	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 4752 wrote to memory of 752	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 1080 wrote to memory of 2436	1080	ztrmgeywro.exe	176
PID 4752 wrote to memory of 5920	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 4752 wrote to memory of 5956	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 1548 wrote to memory of 3704	1548	qojgbztrlj.exe	185
PID 4752 wrote to memory of 1836	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	188
PID 4752 wrote to memory of 2184	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	193
PID 6008 wrote to memory of 4464	6008	wtomgeywqo.exe	195
PID 4752 wrote to memory of 2808	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	198
PID 4752 wrote to memory of 5952	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	202
PID 1604 wrote to memory of 5412	1604	vtnlgdywqo.exe	204
PID 4752 wrote to memory of 4888	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	208
PID 4752 wrote to memory of 4828	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	212
PID 5128 wrote to memory of 4672	5128	sqkidavsnl.exe	214
PID 4752 wrote to memory of 336	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	217
PID 4752 wrote to memory of 220	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	221
PID 5512 wrote to memory of 2752	5512	qkicausnkf.exe	223
PID 4752 wrote to memory of 6004	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	226
PID 4752 wrote to memory of 4148	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	230
PID 3152 wrote to memory of 2416	3152	snkfdxvpnh.exe	232
PID 4752 wrote to memory of 4424	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	235
PID 4752 wrote to memory of 2420	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	239
PID 2368 wrote to memory of 3872	2368	pjhczusmke.exe	241
PID 4752 wrote to memory of 5996	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	244
PID 4752 wrote to memory of 4288	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	249
PID 5932 wrote to memory of 4276	5932	mkecwuomhe.exe	251
PID 4752 wrote to memory of 5208	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	254
PID 4752 wrote to memory of 1500	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	258
PID 4824 wrote to memory of 2812	4824	jdbwtomgey.exe	260
PID 4752 wrote to memory of 1288	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	263
PID 4752 wrote to memory of 3276	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	267
PID 2088 wrote to memory of 1600	2088	rljdbwtolg.exe	269
PID 4752 wrote to memory of 5184	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	272
PID 4752 wrote to memory of 4620	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	276
PID 3412 wrote to memory of 5728	3412	rljdbvtolg.exe	278
PID 4752 wrote to memory of 5424	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	281
PID 4752 wrote to memory of 3528	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	285
PID 2800 wrote to memory of 6068	2800	kidavtnlfd.exe	287
PID 4752 wrote to memory of 3204	4752	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	290

C:\Users\Admin\AppData\Local\Temp\2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:732 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:5100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytrljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:880
- - C:\Temp\igbytrljdb.exe
    C:\Temp\igbytrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytrljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5576
- - C:\Temp\i_igbytrljdb.exe
    C:\Temp\i_igbytrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlgdywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2196
- - C:\Temp\bvtnlgdywq.exe
    C:\Temp\bvtnlgdywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlgdywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1848
- - C:\Temp\i_bvtnlgdywq.exe
    C:\Temp\i_bvtnlgdywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdxvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2348
- - C:\Temp\tnlfdxvqni.exe
    C:\Temp\tnlfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4524
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdxvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4072
- - C:\Temp\i_tnlfdxvqni.exe
    C:\Temp\i_tnlfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvqnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3480
- - C:\Temp\lfdxvqnifa.exe
    C:\Temp\lfdxvqnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvqnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:996
- - C:\Temp\i_lfdxvqnifa.exe
    C:\Temp\i_lfdxvqnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icaupnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1668
- - C:\Temp\icaupnhfzx.exe
    C:\Temp\icaupnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icaupnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4560
- - C:\Temp\i_icaupnhfzx.exe
    C:\Temp\i_icaupnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecxupnhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5476
- - C:\Temp\kecxupnhfz.exe
    C:\Temp\kecxupnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecxupnhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4108
- - C:\Temp\i_kecxupnhfz.exe
    C:\Temp\i_kecxupnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomhezx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:316
- - C:\Temp\ecwuomhezx.exe
    C:\Temp\ecwuomhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomhezx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4556
- - C:\Temp\i_ecwuomhezx.exe
    C:\Temp\i_ecwuomhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmgeywro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:752
- - C:\Temp\ztrmgeywro.exe
    C:\Temp\ztrmgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmgeywro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5920
- - C:\Temp\i_ztrmgeywro.exe
    C:\Temp\i_ztrmgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qojgbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5956
- - C:\Temp\qojgbztrlj.exe
    C:\Temp\qojgbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qojgbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1836
- - C:\Temp\i_qojgbztrlj.exe
    C:\Temp\i_qojgbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtomgeywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2184
- - C:\Temp\wtomgeywqo.exe
    C:\Temp\wtomgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtomgeywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2808
- - C:\Temp\i_wtomgeywqo.exe
    C:\Temp\i_wtomgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlgdywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5952
- - C:\Temp\vtnlgdywqo.exe
    C:\Temp\vtnlgdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlgdywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4888
- - C:\Temp\i_vtnlgdywqo.exe
    C:\Temp\i_vtnlgdywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavsnl.exe ups_run
  2⤵
  PID:4828
- - C:\Temp\sqkidavsnl.exe
    C:\Temp\sqkidavsnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavsnl.exe ups_ins
  2⤵
  PID:336
- - C:\Temp\i_sqkidavsnl.exe
    C:\Temp\i_sqkidavsnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicausnkf.exe ups_run
  2⤵
  PID:220
- - C:\Temp\qkicausnkf.exe
    C:\Temp\qkicausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicausnkf.exe ups_ins
  2⤵
  PID:6004
- - C:\Temp\i_qkicausnkf.exe
    C:\Temp\i_qkicausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpnh.exe ups_run
  2⤵
  PID:4148
- - C:\Temp\snkfdxvpnh.exe
    C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
  2⤵
  PID:4424
- - C:\Temp\i_snkfdxvpnh.exe
    C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczusmke.exe ups_run
  2⤵
  PID:2420
- - C:\Temp\pjhczusmke.exe
    C:\Temp\pjhczusmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczusmke.exe ups_ins
  2⤵
  PID:5996
- - C:\Temp\i_pjhczusmke.exe
    C:\Temp\i_pjhczusmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwuomhe.exe ups_run
  2⤵
  PID:4288
- - C:\Temp\mkecwuomhe.exe
    C:\Temp\mkecwuomhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwuomhe.exe ups_ins
  2⤵
  PID:5208
- - C:\Temp\i_mkecwuomhe.exe
    C:\Temp\i_mkecwuomhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtomgey.exe ups_run
  2⤵
  PID:1500
- - C:\Temp\jdbwtomgey.exe
    C:\Temp\jdbwtomgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtomgey.exe ups_ins
  2⤵
  PID:1288
- - C:\Temp\i_jdbwtomgey.exe
    C:\Temp\i_jdbwtomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbwtolg.exe ups_run
  2⤵
  PID:3276
- - C:\Temp\rljdbwtolg.exe
    C:\Temp\rljdbwtolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbwtolg.exe ups_ins
  2⤵
  PID:5184
- - C:\Temp\i_rljdbwtolg.exe
    C:\Temp\i_rljdbwtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbvtolg.exe ups_run
  2⤵
  PID:4620
- - C:\Temp\rljdbvtolg.exe
    C:\Temp\rljdbvtolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbvtolg.exe ups_ins
  2⤵
  PID:5424
- - C:\Temp\i_rljdbvtolg.exe
    C:\Temp\i_rljdbvtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kidavtnlfd.exe ups_run
  2⤵
  PID:3528
- - C:\Temp\kidavtnlfd.exe
    C:\Temp\kidavtnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kidavtnlfd.exe ups_ins
  2⤵
  PID:3204
- - C:\Temp\i_kidavtnlfd.exe
    C:\Temp\i_kidavtnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4236

C:\Temp\gaytqljdbv.sys
C:\Temp\gaytqljdbv.sys
1⤵
- Executes dropped EXE
PID:1172

C:\Temp\aysqlidbvt.sys
C:\Temp\aysqlidbvt.sys
1⤵
- Executes dropped EXE
PID:5776

C:\Temp\vqkicavsnl.sys
C:\Temp\vqkicavsnl.sys
1⤵
- Executes dropped EXE
PID:6056

C:\Temp\xvpnifaxsq.sys
C:\Temp\xvpnifaxsq.sys
1⤵
- Executes dropped EXE
PID:2812

C:\Temp\spkhcausmk.sys
C:\Temp\spkhcausmk.sys
1⤵
- Executes dropped EXE
PID:4568

C:\Temp\pjhczurmke.sys
C:\Temp\pjhczurmke.sys
1⤵
- Executes dropped EXE
PID:436

C:\Temp\kezwrpjhbz.sys
C:\Temp\kezwrpjhbz.sys
1⤵
- Executes dropped EXE
PID:4496

C:\Temp\jebwuomgey.sys
C:\Temp\jebwuomgey.sys
1⤵
- Executes dropped EXE
PID:5744

C:\Temp\dbvtolgeyw.sys
C:\Temp\dbvtolgeyw.sys
1⤵
- Executes dropped EXE
PID:908

C:\Temp\dbvtnlfdyv.sys
C:\Temp\dbvtnlfdyv.sys
1⤵
- Executes dropped EXE
PID:4848

C:\Temp\dxvqnigays.sys
C:\Temp\dxvqnigays.sys
1⤵
PID:2680

C:\Temp\idxvqnifay.sys
C:\Temp\idxvqnifay.sys
1⤵
PID:2452

C:\Temp\causnkfdxv.sys
C:\Temp\causnkfdxv.sys
1⤵
PID:5024

C:\Temp\aupnhfzxrp.sys
C:\Temp\aupnhfzxrp.sys
1⤵
PID:2132

C:\Temp\urmjecwuom.sys
C:\Temp\urmjecwuom.sys
1⤵
PID:6052

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
PID:5352

C:\Temp\ywqojgbztr.sys
C:\Temp\ywqojgbztr.sys
1⤵
PID:4364

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
PID:5600

C:\Temp\dyoigaysql.sys
C:\Temp\dyoigaysql.sys
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqlidbvt.sys

Path C:\Temp\aysqlidbvt.sys
Size 141KB
SHA256 349c9ee3774bde7b67f03fcb14341bd9e29d3c0bfdb3757526ce3bc1ffc96380
MD5 fc04d31bec2c1a03dc9731908ecde96c
SHA1 dfe6a1f8dd7f462598fc0ee1d3e9d5c0a30489bd
SHA512 29903554fbccbb6bbb99c11f63891610e80cd24482029d40dada01e3244d4bcecd5c6e0aaac250e10f53d076f4ef58bf1b58376b3dcfbc9281ad68722a9d782e
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdywq.exe

Path C:\Temp\bvtnlgdywq.exe
Size 226KB
SHA256 f8b3c0e7fa651897332d1559d9ff4969a3d5979afa0624a06434ee90f4319704
MD5 df0774f169de82ef6eaa13c011bf6e54
SHA1 c5568bc089c0d1fe17d064c68a7f74937746d056
SHA512 4abfca34d65782993c5b027ead6d86e89565eaad2b87fbfe88569b623a911ed6166bedae7903ac91d469847aa18d2627d0bb6cb5cbe5565765e28c1c0474df66
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T10434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomhezx.exe

Path C:\Temp\ecwuomhezx.exe
Size 226KB
SHA256 7ec2474568518ca2b9387890c84d45f393255d710a9220a592a1bbbec089ccf4
MD5 db0ebb547d51aa25b328ce4c96a880ee
SHA1 2de8aeda23e274ab5c8c7e7272839bb23c142ed9
SHA512 f39993548d8f84e0d694ea3c938c42fc5303c8de3171ac22c8175a2dbfbcb942f8c30335b7b0ea8c0ee97a86238e08f3d29c3561000c83493a3b4aed8e0f7d0e
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T10934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljdbv.sys

Path C:\Temp\gaytqljdbv.sys
Size 141KB
SHA256 b5fa8ab388483e754393f2464da294f942318c1bb1d794154e69dc12b22df7dc
MD5 ef85bb1f9697063ebdc960770094c000
SHA1 7da0fe31f299b92054dc8d1a7fdbca6be1909a5a
SHA512 5df984222bceae6377633d46d3e417243a603614dbaf154ebb7cd991b77b6fb96f39859c5052eafa2e2ff1f9b90430366c7606e2e30f22b977531067b8146da0
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T106E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlgdywq.exe

Path C:\Temp\i_bvtnlgdywq.exe
Size 226KB
SHA256 0fa0001212b4cb54df8ef08d1b503e71c9f380c6920738e38c266a2b94f52e6c
MD5 64eac5fc45b978b094577418a649d3a0
SHA1 8828a43cc78c1774e8bbde7b86e520a075cf5eec
SHA512 22aa7d3fdc9be6df9a10a8159ae55cdf16ddc2c8793ff406896847595b4c3d655c78fbb4c83b74cf03e367c9449503b4c20cf47b573675a549869f10c45a68a7
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T16934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomhezx.exe

Path C:\Temp\i_ecwuomhezx.exe
Size 226KB
SHA256 0c76f8bc275e378c73c3946e51b1ce73894677b3669a361ea77512af71a7e939
MD5 88a40b5daf1c558f1b7262e4f7b6c17d
SHA1 369e4f2ac37d6fc55d73bdde3639be21afcb4fc1
SHA512 6c18ee0830fe27b6bf0fbb1420aca5051cb38633b89825384cd7f81c62f6837900d0c8df75bb37fccfab2f6defae6ea4f509a0932cfad98db2ee0e338f2e9e1b
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T12E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icaupnhfzx.exe

Path C:\Temp\i_icaupnhfzx.exe
Size 226KB
SHA256 8b64632804bfa4c01f189461186fabd790c262d72e462ebb88c0a9d60688a26a
MD5 0916d4e3411bc4fe9316d37fa0d5953e
SHA1 e80d79bf5dc66872c62cebd0edf69c5cfb996b97
SHA512 08d021b5e879879876598f40393986ceb7ba43b00261b3e0fded032bd95e0644b340fa473853b3be31f7a839bc0f4a7d7dac48d429ddf9dabd0cbbdd8ef96192
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T17634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igbytrljdb.exe

Path C:\Temp\i_igbytrljdb.exe
Size 226KB
SHA256 e09ac607052d0ab54c1ce1fc3d69761cd1b52f37b1f8ddd4865d394bbb65b223
MD5 a8dc5ab5086e55252984bf0e1407aa62
SHA1 40635b51172e9e477efc84204729563f3b948b5a
SHA512 21b2d53274223262088f49ce11f284a79d3252fcac22162af807b1cc54b83ebe009e439fe98787655095dee62586c4381c3d10c4dc8f1bbdeaa5c4af452c071e
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T17E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kecxupnhfz.exe

Path C:\Temp\i_kecxupnhfz.exe
Size 226KB
SHA256 ed4ddac0b1ce0eace399cc71e587e44c2e193a416adca9b2a0422a19407e0593
MD5 2b02f453ae8dc0c199af6aa498271074
SHA1 378056c40b0dcb86b58bd1729351f1630c62b2c1
SHA512 0cbbf482bc98a85ea2eae2c5781601e19e4fbf6dfcf97c95b9fdcc614269bac3b1b386280409bd9ea94bb639e4ac3c98012991d307974fb5eba472e69e463418
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T10634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvqnifa.exe

Path C:\Temp\i_lfdxvqnifa.exe
Size 226KB
SHA256 0cfdc8970ec9e8b6b5d34e51b98c5b0c27f6f549f587cfe9719dafaaf778e283
MD5 411b52c63f99dba1a8c187314eb26683
SHA1 5ba567ada973ca3d442f83201019ae4ebd9cc7e5
SHA512 1e88ff3e3cc886863399b1583d779c74b1c7eeb1017ebf73521f7eae921f6f674347cff9b6abd02f29999841c016d539463f96489bffd8737abc82977339aab3
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T17934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdxvqni.exe

Path C:\Temp\i_tnlfdxvqni.exe
Size 226KB
SHA256 3c3e03370631925b279bc9bbb851c7bd753397fa6bec1c3e8202e86af22b5caf
MD5 44bbc7e71e89db44e39bb7c9b0156442
SHA1 027d77bc15ddb8b47b4e288e61acb3263971a9e5
SHA512 1c39f13c353d5a5b11590974807cfe21dc23af792738c3efc9f17c9efe49aed2699786a6a32c890ba013fdbe1291553530dccad433db48c300f045cff1ab3db7
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T18634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrmgeywro.exe

Path C:\Temp\i_ztrmgeywro.exe
Size 226KB
SHA256 ae2bba88b80089c9456f239c2d30d7979195164ff147147b89acde881658c448
MD5 97f80a9fac533703ad0711468650af9a
SHA1 26272fb56e5d6d30cef0f72e302fdcc93bd3e7a7
SHA512 d01be5728ed691bb459b875b6ecdbf7123ddfecb81bc9877d2f575214fcece14cb5c25de99d8b23e44ab6cbe69cd8dff6aebd5a6c8e530496765c06ef87dd9bb
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T12634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icaupnhfzx.exe

Path C:\Temp\icaupnhfzx.exe
Size 226KB
SHA256 1630a4505be437f8fe170e1f1f9df223f7f77f0eda2609fce464057b489955c8
MD5 0eed3206cb0d5a8509d9580e8b50e713
SHA1 3aa79182d631cd48f431661e4717351d66a39430
SHA512 f6101b448763bfe814307fb64cde952418319639e100ab0c5ae7d9a100598aeb136fd36e1a7bdbb3bfa6bf82b48cab01e53416b387472264a5fd5e56ff62a3ed
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T1C434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbytrljdb.exe

Path C:\Temp\igbytrljdb.exe
Size 226KB
SHA256 65ce73a5ad90eba44839ed351a6298f177702e085c2a20accccea82dd8e47928
MD5 01ccd1bdc3fdee6420d1427802545e81
SHA1 110e066a6a8e5a850d247328a3b2ab2e331d670a
SHA512 b57fe7102bf4bf056f48376a8b1eb3c12df30e5e5eb9f54f67ed5c4ad35ececdc4380097d3406c1e77b57dd43a4384ce6595b2ba9bc7839a6f39e7217c0684d1
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T14A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxupnhfz.exe

Path C:\Temp\kecxupnhfz.exe
Size 226KB
SHA256 45e4b3d044d0f3f3f839c7c2f5c3c93d9288e082c1c885a14bb3dd89b816c814
MD5 1fa84a68a8f8f1786630056cbf7ca3e8
SHA1 ce37ad32124f8433bf1ddb3886b4d337dc2c5739
SHA512 34a9f5d70c226216f8041e3fe3339dca023194caa79e25ac09133a30578906ea73d940de21ebc59bfe6871a485c6639b8a6e505c339264bff86247d838171462
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T1DF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kezwrpjhbz.sys

Path C:\Temp\kezwrpjhbz.sys
Size 141KB
SHA256 a2a8a9fe4e0cfe3807dae9699bedadc5a2b303e3c4334d33e8442a641ad1eee2
MD5 428b99fe675e3cc71cddb32604812db1
SHA1 1c0954bc4bbab5de707b27b250543658ba7ac765
SHA512 d8189529efe0805f35ee880782b99c3e36dfb85a799b48a866a842706da094a313ec54329ad0151153b57e1480e42c9671f5a0371f447741f9ff98ac80cd328e
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T106E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvqnifa.exe

Path C:\Temp\lfdxvqnifa.exe
Size 226KB
SHA256 246121170bb2c31cfef0a5b73d9c1c024a7f5dc135dd69dde59b715d4bfb595c
MD5 10d813811c2928e1b7daec7c5c8a5bc9
SHA1 60853b48e03cbd623c8cc6b212a00bc7d6ff7b48
SHA512 62c116aad730eab80272ff3b1f943b1ba244242eb0e88849e59f1ee736b61804cb25e2c753e93ee3a7f3b6febf9fbbe64cc6f615fc1a58aef01662f3a932a548
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T12134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczurmke.sys

Path C:\Temp\pjhczurmke.sys
Size 141KB
SHA256 c43df90769ee3cb144c88e82d040a644721e63dc9cdd1e8dd50983174c523f93
MD5 4ca13d5db280a24d1b5e684fb9604705
SHA1 84fc2e7ceb69af4116e80438b42c98f58f5571c1
SHA512 e427469a1d10dcd2633a8427e869aca8cfe81f9cf555badd04128a98ef0bca9ca2ff6835ae7527df423b2526ea05fbe7a06e533855ebf80e36cc509f5df2e8ec
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhcausmk.sys

Path C:\Temp\spkhcausmk.sys
Size 141KB
SHA256 2463e677b6059da324077e908712ed2fd3264a11fa0d3cd1215eb922e6f7d454
MD5 d6d4c941ab0337d3d380304048096443
SHA1 a650a568fe81fdf8283172ccb3a4160f04609644
SHA512 4109ee02cf55eca779487efd3e980adf950025e3160181511795f5ab2d409703a373faed4af5326dd1057d1490188e0e352492b9481f174cc47bec831b9c416d
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BEE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdxvqni.exe

Path C:\Temp\tnlfdxvqni.exe
Size 226KB
SHA256 8e52c2b7819370ab4b7fffe212955824b40cd6220f511fc00e2e6517523cc81a
MD5 8f78623ff1cbef83a18e8e359170a2d0
SHA1 45fe4be6cc77d64394449b711fd1ea58f0757397
SHA512 674bce522693ae726bc72e90a10231af42e93b1143c67bf50c73d1d5b6ac452e77fa503a3cb2c9c8aa4820d6afcfe7c7d70d8ef983796f7569fc18a2ecf7b865
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T1B434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqkicavsnl.sys

Path C:\Temp\vqkicavsnl.sys
Size 141KB
SHA256 443d64db994a9a505e0048a13778445dad5fe4a000634a2c8f7496daa0f42872
MD5 9d65c38fb1d8ea4c24e6848f4b546a5b
SHA1 29bb1c85122c8217bd8e995f82f5608cffefa0d4
SHA512 d8762d8318b5ef4c764264041c554e8431b0f3f7d0b06919b3f6648a1b803d1c02bc3e6f0e4fcfbe2b58395839e413e2cd40c563f030a3216b9d105ba02e762c
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T154E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifaxsq.sys

Path C:\Temp\xvpnifaxsq.sys
Size 141KB
SHA256 20c956ebf7ab369b7bffda184923fe059708768c49eb1d7b32082d5f2c6d6107
MD5 930ce27b8a40022ea0c71ee94f8356c7
SHA1 1854f234c0de8ec6b0ed72b0ef6688edc595fc6a
SHA512 0c5bcc3cbc052a525a5d47bb35b266636332d1d4d6466e21d1002d25207111757256f31f58b731de3a74d1c4cfedec38e04efaf0f8ccab171ad1b22f9644c0bf
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmgeywro.exe

Path C:\Temp\ztrmgeywro.exe
Size 226KB
SHA256 924747e4a606e59fea2a0c131841d260e15a485ffce0faf0b5716812bd1c5d8e
MD5 22d769542ee9768889c4bd428c266dda
SHA1 6520e7d783a96f137206c8973e407b0fb3cfed5e
SHA512 a15e8c8c45fec5d2d693c62bfd905d58a0e836418a17449dd4d8894d26b28cae65e9a618a3556aa834ac789b90a0e9839ab065c604527393d7abb522e69260a3
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T17034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q21GBDYU\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-79-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/904-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/908-116-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1172-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2132-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2452-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2680-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2812-53-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4364-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4496-91-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4568-67-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4848-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5024-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5352-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5600-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5744-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5776-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6052-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6056-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads