638b2366a424a5931c097e5427fccc16364f6ae4ec05979862812d6a2d3f3973

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260810-sr53dsxtf1
SHA256 638b2366a424a5931c097e5427fccc16364f6ae4ec05979862812d6a2d3f3973
MD5 5a58409ed5e88c03c18a89982a220686
SHA1 8dc85073dd572c0d677dd09cb17b4c1a4cc9a4c7
SHA512 12dd6b79460c08c3be978cb4d86bc0e3bddac320b544d1e6a66815ef4b2cffb9fe6a2ccddb9f03129ed170706c001e83d9f99f353bb707cbbb02ad98316b7dce
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T11034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2284	CP.exe
4564	rljebwuomh.exe
1028	CP.exe
4508	CP.exe
1520	i_rljebwuomh.exe
2548	oigbytrljd.sys
2684	CP.exe
4988	dywqoigayt.exe
3740	CP.exe
3408	CP.exe
4828	i_dywqoigayt.exe
3200	aytqlidbvt.sys
2440	CP.exe
2832	tnlfdyvqoi.exe
3468	CP.exe
628	CP.exe
5056	i_tnlfdyvqoi.exe
2436	ysqlidavlf.sys
1800	CP.exe
2560	fdxvpnifay.exe
1340	CP.exe
1420	CP.exe
3540	i_fdxvpnifay.exe
2968	qkicavsnlf.sys
3824	CP.exe
2432	faysqkausn.exe
548	CP.exe
3676	CP.exe
820	i_faysqkausn.exe
4840	xupnhfzxsp.sys
1316	CP.exe
2700	pkhcausmke.exe
1504	CP.exe
1412	CP.exe
4408	i_pkhcausmke.exe
808	pjhczurmke.sys
1468	CP.exe
2572	hcwupmhfzx.exe
3176	CP.exe
2996	CP.exe
2456	i_hcwupmhfzx.exe
4300	hczusecwuo.sys
2792	CP.exe
4756	omgezwrpjh.exe
1244	CP.exe
3612	CP.exe
4752	i_omgezwrpjh.exe
3540	ztrljebwuo.sys
3520	CP.exe
2320	rmjeuomgey.exe
1436	CP.exe
3424	CP.exe
4620	i_rmjeuomgey.exe
3544	rljdbvtolg.sys
4212	CP.exe
2612	jeywqojgby.exe
1020	CP.exe
4320	CP.exe
3828	i_jeywqojgby.exe
1100	jdbvtolgdy.sys
1804	CP.exe
1180	ywqoigaytq.exe
4228	CP.exe
3096	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jeywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicankfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjeuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjeuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwugeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecxrmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwugeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecxrmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicankfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcwupmhfzx.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1508	ipconfig.exe
988	ipconfig.exe
5116	ipconfig.exe
3296	ipconfig.exe
4704	ipconfig.exe
3704	ipconfig.exe
916	ipconfig.exe
3372	ipconfig.exe
1120	ipconfig.exe
2936	ipconfig.exe
3508	ipconfig.exe
2348	ipconfig.exe
448	ipconfig.exe
1500	ipconfig.exe
2488	ipconfig.exe
980	ipconfig.exe
3568	ipconfig.exe
636	ipconfig.exe
4000	ipconfig.exe
3988	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "600498851"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271132"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00463d86e428dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271132"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108b3886e428dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4F3B31A8-94CF-11F1-B05C-EEAAB15450A7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "603936810"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015ec7194f8c8944e8e3c279917e59d0e00000000020000000000106600000001000020000000263776823020071f6f2db8c4bcdbd48c7be590647ed656cb8403d7ad59d4535f000000000e8000000002000020000000cd56776b8b98a4d15ca49ea475574ae5ffed0af44e153a0312c3eeae9d1024e8200000004c852a64f9c38b7b6afb7e1d470c7c5bb32a03b8a2cc1f4123eadff7fc63ddd6400000008b7e30945b79eff4ba4cf320f4a68d7850e8dcea2749f6e50720760c792506450b180227fd9ef860b433a9ba6098cfc31ffa9784c6f152aca55931d347988232	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "493140329"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015ec7194f8c8944e8e3c279917e59d0e00000000020000000000106600000001000020000000e8a7af2e9491d3c5f6c79a922b0115971b72b305e8517825c627582412592fc0000000000e800000000200002000000037621453a175e9b492c423946aa56e395e05332b422bb208235c463ec3fd0bb420000000d889d954b01381613ddcb2edf6d4b83e8d7d18fdcc1994f3b580ef85bc120eaa400000009506199683d5f41a419712af671875b651d01fdbdd30cfc56f835de3f54a1c586e7b9f04d60a23c71e894035ee2c61a6ee2b59ca3adf215baa4dd32ef02c0f00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	i_rljebwuomh.exe
Token: SeDebugPrivilege	4828	i_dywqoigayt.exe
Token: SeDebugPrivilege	5056	i_tnlfdyvqoi.exe
Token: SeDebugPrivilege	3540	i_fdxvpnifay.exe
Token: SeDebugPrivilege	820	i_faysqkausn.exe
Token: SeDebugPrivilege	4408	i_pkhcausmke.exe
Token: SeDebugPrivilege	2456	i_hcwupmhfzx.exe
Token: SeDebugPrivilege	4752	i_omgezwrpjh.exe
Token: SeDebugPrivilege	4620	i_rmjeuomgey.exe
Token: SeDebugPrivilege	3828	i_jeywqojgby.exe
Token: SeDebugPrivilege	1512	i_ywqoigaytq.exe
Token: SeDebugPrivilege	1140	i_sqkidavsnl.exe
Token: SeDebugPrivilege	3636	i_sqkicankfa.exe
Token: SeDebugPrivilege	1644	i_kfcxvpnhfz.exe
Token: SeDebugPrivilege	1876	i_xupnhfzxrp.exe
Token: SeDebugPrivilege	4296	i_mjecxrmkec.exe
Token: SeDebugPrivilege	4148	i_mjecwugeyw.exe
Token: SeDebugPrivilege	364	i_gbwtomgeyw.exe
Token: SeDebugPrivilege	4652	i_bvtnlgdywq.exe
Token: SeDebugPrivilege	1432	i_vtnlfdyvqn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1252	iexplore.exe
1252	iexplore.exe
4884	IEXPLORE.EXE
4884	IEXPLORE.EXE
4884	IEXPLORE.EXE
4884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1252	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	86
PID 1252 wrote to memory of 4884	1252	iexplore.exe	87
PID 1964 wrote to memory of 2284	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 4564 wrote to memory of 1028	4564	rljebwuomh.exe	93
PID 1964 wrote to memory of 4508	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	98
PID 1964 wrote to memory of 2684	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 4988 wrote to memory of 3740	4988	dywqoigayt.exe	107
PID 1964 wrote to memory of 3408	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	110
PID 1964 wrote to memory of 2440	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 2832 wrote to memory of 3468	2832	tnlfdyvqoi.exe	116
PID 1964 wrote to memory of 628	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 1964 wrote to memory of 1800	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 2560 wrote to memory of 1340	2560	fdxvpnifay.exe	125
PID 1964 wrote to memory of 1420	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 1964 wrote to memory of 3824	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 2432 wrote to memory of 548	2432	faysqkausn.exe	135
PID 1964 wrote to memory of 3676	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 1964 wrote to memory of 1316	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 2700 wrote to memory of 1504	2700	pkhcausmke.exe	144
PID 1964 wrote to memory of 1412	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 1964 wrote to memory of 1468	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 2572 wrote to memory of 3176	2572	hcwupmhfzx.exe	153
PID 1964 wrote to memory of 2996	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 1964 wrote to memory of 2792	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 4756 wrote to memory of 1244	4756	omgezwrpjh.exe	162
PID 1964 wrote to memory of 3612	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 1964 wrote to memory of 3520	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 2320 wrote to memory of 1436	2320	rmjeuomgey.exe	171
PID 1964 wrote to memory of 3424	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 1964 wrote to memory of 4212	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 2612 wrote to memory of 1020	2612	jeywqojgby.exe	180
PID 1964 wrote to memory of 4320	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 1964 wrote to memory of 1804	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 1180 wrote to memory of 4228	1180	ywqoigaytq.exe	189
PID 1964 wrote to memory of 3096	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 1964 wrote to memory of 4008	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	196
PID 1776 wrote to memory of 2312	1776	sqkidavsnl.exe	198
PID 1964 wrote to memory of 3256	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	201
PID 1964 wrote to memory of 4808	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	205
PID 4196 wrote to memory of 4952	4196	sqkicankfa.exe	207
PID 1964 wrote to memory of 4140	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	210
PID 1964 wrote to memory of 5036	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	214
PID 2628 wrote to memory of 4472	2628	kfcxvpnhfz.exe	216
PID 1964 wrote to memory of 2392	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	219
PID 1964 wrote to memory of 3032	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	223
PID 5028 wrote to memory of 964	5028	xupnhfzxrp.exe	225
PID 1964 wrote to memory of 224	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	228
PID 1964 wrote to memory of 1032	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	232
PID 1588 wrote to memory of 2604	1588	mjecxrmkec.exe	234
PID 1964 wrote to memory of 4300	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	239
PID 1964 wrote to memory of 3060	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	243
PID 2868 wrote to memory of 4616	2868	mjecwugeyw.exe	245
PID 1964 wrote to memory of 2932	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	248
PID 1964 wrote to memory of 2136	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	252
PID 4644 wrote to memory of 3568	4644	gbwtomgeyw.exe	254
PID 1964 wrote to memory of 4932	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	257
PID 1964 wrote to memory of 4968	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	259
PID 3088 wrote to memory of 3864	3088	bvtnlgdywq.exe	261
PID 1964 wrote to memory of 2352	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	264
PID 1964 wrote to memory of 808	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	268
PID 3880 wrote to memory of 4528	3880	vtnlfdyvqn.exe	270
PID 1964 wrote to memory of 4112	1964	2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe	273

C:\Users\Admin\AppData\Local\Temp\2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5a58409ed5e88c03c18a89982a220686_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwuomh.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2284
- - C:\Temp\rljebwuomh.exe
    C:\Temp\rljebwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwuomh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4508
- - C:\Temp\i_rljebwuomh.exe
    C:\Temp\i_rljebwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqoigayt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2684
- - C:\Temp\dywqoigayt.exe
    C:\Temp\dywqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqoigayt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3408
- - C:\Temp\i_dywqoigayt.exe
    C:\Temp\i_dywqoigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdyvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2440
- - C:\Temp\tnlfdyvqoi.exe
    C:\Temp\tnlfdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:628
- - C:\Temp\i_tnlfdyvqoi.exe
    C:\Temp\i_tnlfdyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1800
- - C:\Temp\fdxvpnifay.exe
    C:\Temp\fdxvpnifay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1420
- - C:\Temp\i_fdxvpnifay.exe
    C:\Temp\i_fdxvpnifay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysqkausn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3824
- - C:\Temp\faysqkausn.exe
    C:\Temp\faysqkausn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysqkausn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3676
- - C:\Temp\i_faysqkausn.exe
    C:\Temp\i_faysqkausn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhcausmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1316
- - C:\Temp\pkhcausmke.exe
    C:\Temp\pkhcausmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhcausmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1412
- - C:\Temp\i_pkhcausmke.exe
    C:\Temp\i_pkhcausmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcwupmhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1468
- - C:\Temp\hcwupmhfzx.exe
    C:\Temp\hcwupmhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcwupmhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2996
- - C:\Temp\i_hcwupmhfzx.exe
    C:\Temp\i_hcwupmhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2792
- - C:\Temp\omgezwrpjh.exe
    C:\Temp\omgezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3612
- - C:\Temp\i_omgezwrpjh.exe
    C:\Temp\i_omgezwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjeuomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3520
- - C:\Temp\rmjeuomgey.exe
    C:\Temp\rmjeuomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjeuomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3424
- - C:\Temp\i_rmjeuomgey.exe
    C:\Temp\i_rmjeuomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jeywqojgby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4212
- - C:\Temp\jeywqojgby.exe
    C:\Temp\jeywqojgby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jeywqojgby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4320
- - C:\Temp\i_jeywqojgby.exe
    C:\Temp\i_jeywqojgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigaytq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1804
- - C:\Temp\ywqoigaytq.exe
    C:\Temp\ywqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigaytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3096
- - C:\Temp\i_ywqoigaytq.exe
    C:\Temp\i_ywqoigaytq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavsnl.exe ups_run
  2⤵
  PID:4008
- - C:\Temp\sqkidavsnl.exe
    C:\Temp\sqkidavsnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavsnl.exe ups_ins
  2⤵
  PID:3256
- - C:\Temp\i_sqkidavsnl.exe
    C:\Temp\i_sqkidavsnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicankfa.exe ups_run
  2⤵
  PID:4808
- - C:\Temp\sqkicankfa.exe
    C:\Temp\sqkicankfa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicankfa.exe ups_ins
  2⤵
  PID:4140
- - C:\Temp\i_sqkicankfa.exe
    C:\Temp\i_sqkicankfa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxvpnhfz.exe ups_run
  2⤵
  PID:5036
- - C:\Temp\kfcxvpnhfz.exe
    C:\Temp\kfcxvpnhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins
  2⤵
  PID:2392
- - C:\Temp\i_kfcxvpnhfz.exe
    C:\Temp\i_kfcxvpnhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfzxrp.exe ups_run
  2⤵
  PID:3032
- - C:\Temp\xupnhfzxrp.exe
    C:\Temp\xupnhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfzxrp.exe ups_ins
  2⤵
  PID:224
- - C:\Temp\i_xupnhfzxrp.exe
    C:\Temp\i_xupnhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecxrmkec.exe ups_run
  2⤵
  PID:1032
- - C:\Temp\mjecxrmkec.exe
    C:\Temp\mjecxrmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjecxrmkec.exe ups_ins
  2⤵
  PID:4300
- - C:\Temp\i_mjecxrmkec.exe
    C:\Temp\i_mjecxrmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecwugeyw.exe ups_run
  2⤵
  PID:3060
- - C:\Temp\mjecwugeyw.exe
    C:\Temp\mjecwugeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjecwugeyw.exe ups_ins
  2⤵
  PID:2932
- - C:\Temp\i_mjecwugeyw.exe
    C:\Temp\i_mjecwugeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbwtomgeyw.exe ups_run
  2⤵
  PID:2136
- - C:\Temp\gbwtomgeyw.exe
    C:\Temp\gbwtomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbwtomgeyw.exe ups_ins
  2⤵
  PID:4932
- - C:\Temp\i_gbwtomgeyw.exe
    C:\Temp\i_gbwtomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlgdywq.exe ups_run
  2⤵
  PID:4968
- - C:\Temp\bvtnlgdywq.exe
    C:\Temp\bvtnlgdywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlgdywq.exe ups_ins
  2⤵
  PID:2352
- - C:\Temp\i_bvtnlgdywq.exe
    C:\Temp\i_bvtnlgdywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqn.exe ups_run
  2⤵
  PID:808
- - C:\Temp\vtnlfdyvqn.exe
    C:\Temp\vtnlfdyvqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqn.exe ups_ins
  2⤵
  PID:4112
- - C:\Temp\i_vtnlfdyvqn.exe
    C:\Temp\i_vtnlfdyvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1432

C:\Temp\oigbytrljd.sys
C:\Temp\oigbytrljd.sys
1⤵
- Executes dropped EXE
PID:2548

C:\Temp\aytqlidbvt.sys
C:\Temp\aytqlidbvt.sys
1⤵
- Executes dropped EXE
PID:3200

C:\Temp\ysqlidavlf.sys
C:\Temp\ysqlidavlf.sys
1⤵
- Executes dropped EXE
PID:2436

C:\Temp\qkicavsnlf.sys
C:\Temp\qkicavsnlf.sys
1⤵
- Executes dropped EXE
PID:2968

C:\Temp\xupnhfzxsp.sys
C:\Temp\xupnhfzxsp.sys
1⤵
- Executes dropped EXE
PID:4840

C:\Temp\pjhczurmke.sys
C:\Temp\pjhczurmke.sys
1⤵
- Executes dropped EXE
PID:808

C:\Temp\hczusecwuo.sys
C:\Temp\hczusecwuo.sys
1⤵
- Executes dropped EXE
PID:4300

C:\Temp\ztrljebwuo.sys
C:\Temp\ztrljebwuo.sys
1⤵
- Executes dropped EXE
PID:3540

C:\Temp\rljdbvtolg.sys
C:\Temp\rljdbvtolg.sys
1⤵
- Executes dropped EXE
PID:3544

C:\Temp\jdbvtolgdy.sys
C:\Temp\jdbvtolgdy.sys
1⤵
- Executes dropped EXE
PID:1100

C:\Temp\lgdyvqoiys.sys
C:\Temp\lgdyvqoiys.sys
1⤵
PID:652

C:\Temp\cavsnlfdxv.sys
C:\Temp\cavsnlfdxv.sys
1⤵
PID:1124

C:\Temp\spkicausnk.sys
C:\Temp\spkicausnk.sys
1⤵
PID:5004

C:\Temp\ecwupmhfzx.sys
C:\Temp\ecwupmhfzx.sys
1⤵
PID:3016

C:\Temp\fzxrpjhurm.sys
C:\Temp\fzxrpjhurm.sys
1⤵
PID:3276

C:\Temp\wrpjhbzurm.sys
C:\Temp\wrpjhbzurm.sys
1⤵
PID:3796

C:\Temp\omgeywrojh.sys
C:\Temp\omgeywrojh.sys
1⤵
PID:2304

C:\Temp\oigaytqljd.sys
C:\Temp\oigaytqljd.sys
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqlidbvt.sys

Path C:\Temp\aytqlidbvt.sys
Size 141KB
SHA256 ce3a95ee5c4534d9638b9ab53f660fed5545838e6d8192ea5735aa6d5981bbf5
MD5 6d7cdd38f34935200b12811fc61969d2
SHA1 91eb27f39e9a9006c98413a5e6769983af515aa7
SHA512 98b3c9caf242538bda921de78d68245b87dc570d87f8207bb34f9a223ada2aa07085b208770d97a9aec943dd07f3ffc3c963d677bdff0e45fa119a4944e39aa2
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T121E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigayt.exe

Path C:\Temp\dywqoigayt.exe
Size 226KB
SHA256 71654e136cf1e7d18148a620be5faadebb2b46f957c12604ba50d330de2fe2d8
MD5 bb999e2c79f64d762e634a8590c0fe0a
SHA1 137b050602cabb87d5573d7ddf1d6d92bc3566ae
SHA512 254089933fbcd8ba928666885f16b27f93afa732827ad4d46c629196e9f81f4451e58cba1cec9b45482ab0b8000d6b3dd7d85143e2183df5d003a08e841a4177
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T14034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkausn.exe

Path C:\Temp\faysqkausn.exe
Size 226KB
SHA256 006d6bfe8c9f338256997e178b2d9075ec046c199a3a706ae2a49f9b520297f1
MD5 b2429abc3a14c3017e1a541607c68235
SHA1 bb80f7735eb08e95e06da732c39897478aebbffe
SHA512 853763649415ec1e01a48572be95e40b55821aee14bde1433d583ab4ffe36a36327e410640412286d2f38c9a550f2a062b5e1ad6b3220d282f040e7926e6e98e
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T1EC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifay.exe

Path C:\Temp\fdxvpnifay.exe
Size 226KB
SHA256 e332e9feaff82493e09ea96dfb3818be5d87c3af4497e027a0cfecb16a4b4db7
MD5 2f0bb8bbd286af45d22aaa5d5800cc9d
SHA1 bbad993ff425bc8f217082f84b739bd13f656417
SHA512 0e76980301ca0bfc77c815858a963bd02eed511033fa9cf1c0efb53844341a56dcc867608fbbc0aa463a488779df19fa12ef5012669dad2fbc97652f0018403c
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T1FC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcwupmhfzx.exe

Path C:\Temp\hcwupmhfzx.exe
Size 226KB
SHA256 b34516c4e5b43d7988440aa559777d6e2bc4732a7c3eb82ed4dabe3221519143
MD5 95a45cb893ef7f4b5366070a33621ad8
SHA1 1f8be4197df0d3f09658e8532af83f1cff7103a1
SHA512 c4078d1185d08c24789e0bcd63c2fe7fc9c7c6995bed1c6c9963d2f3ec186c68e525fc4f4373b97c5950fe208cc59053db6a440ea79515bfe5ab5e224eca48a5
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T15434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusecwuo.sys

Path C:\Temp\hczusecwuo.sys
Size 141KB
SHA256 7554383baf462337aee181c46ee761484236616ec79d5dbc0fc00e76cd14161e
MD5 8d03b38a317fd696fc120be6824c227b
SHA1 d6909de4039c7f049a53ea5ad9855ae5dc5241fb
SHA512 fee642d437a9863dde2391442bde414aec3041362e0bc4dffac3505fd9a48d72bd746b0544072711d9c4a7999e2dba5aa5f9d92d223098e503f317f1dcda265a
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A3E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dywqoigayt.exe

Path C:\Temp\i_dywqoigayt.exe
Size 226KB
SHA256 d6a0d8a25cb9cb9882ab1ad8e54ea8d8c1cfda889ca0926f6063e6f5d8162165
MD5 2572d2580418d89a9e6d9b62276d7061
SHA1 3e0027d0aaed5a5e33e15858a5cf5ca4c0844ff2
SHA512 e3f5942e92ff5d8c09fd48687e46959fa00d5850be9e8d42bf5280f696c206349604c2574218c5df05f75e2e10a6ad0515ca0e44d64bf8b4534ff2e02f4e85d3
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T13034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faysqkausn.exe

Path C:\Temp\i_faysqkausn.exe
Size 226KB
SHA256 e4e38de2de82fe7e4783bd449f4161b6d344cc7128c6f25c58097a95d47b67e5
MD5 2e1f99a76e3bdbc57a6f0217101c7896
SHA1 7f401b1d1164c94c2d6dd73c99072932e2aa316a
SHA512 da9f7636eef78ed4eea2b733d283c5a2b2d1179e8cedc9aa0fdb91c463bf1c735794f52f175147206434b76c7fdf9850756967cdf23bb436284901244e6e6a90
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T10834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvpnifay.exe

Path C:\Temp\i_fdxvpnifay.exe
Size 226KB
SHA256 415d183dcffb08229d05356c04e3f462c9bd3f146ae9e333fff2fe4e860db737
MD5 3d0b4e3707785ea86a356dbaceaac13a
SHA1 688dc5b829f0f6dbae507a488d4f72e80b3f8cf2
SHA512 dc106042ecf28e39a478f63b6070e4f641319b494cd0e5ff84926e8bb73ae1e7dad387845b0608c77daa93ef30111faf8a2f500fdf204f4d58916de710580eb0
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T1DF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcwupmhfzx.exe

Path C:\Temp\i_hcwupmhfzx.exe
Size 226KB
SHA256 f646a2adf757becc18f18f00b1fea2e3d455db9d3cf656af2570d0ef0e7bd926
MD5 19d3aee5fcb0dc3a28e5f8304a1f6aff
SHA1 c00a9ca2c82940715ff576144e1a099bf39b9fe3
SHA512 0b6295de56d561394505bd704ee5fc81f5c3a48e6cef52f3c8646a9877a31c6f957da1bd1b4dc73db3969f679dc032505708c565b4cbf3c5a54e6d5e6e3a4fcf
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T19F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhcausmke.exe

Path C:\Temp\i_pkhcausmke.exe
Size 226KB
SHA256 5ef692471fceadf58530edeee8445cc9a43d5bb952c0a7d26533dd1886172f68
MD5 5b7815a1e173224055d20decfea423d5
SHA1 deffc06bf211bfee80d6ccc867b10d7e404312a8
SHA512 8f36bcb6279974c410de26db03d12f818ca6810f3b296decc55c74702a46f3f751e5ee1e45206760ffc8e09e516d5323afcde3acf56dc3005f8e94c5eb143855
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T14B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljebwuomh.exe

Path C:\Temp\i_rljebwuomh.exe
Size 226KB
SHA256 e9bf545919c47d8d0a7031c6e781a36bddb77571ba6e9c7860001ebca2c92625
MD5 a9b250cd82029c10a7b7c21eb29680bd
SHA1 5ae3cd4cf2c92cd992e3710bf266c8793cdd1023
SHA512 cfd7b8367b52e874ec3fd1e32eedc7056a322a94733309f5b7768d49ef85a39815d491d91f661d720ff5aeb09ff75fb8ff69057977636f41dc57af8a5b7fbec1
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T1BA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdyvqoi.exe

Path C:\Temp\i_tnlfdyvqoi.exe
Size 226KB
SHA256 c6b17d0c60c335d6c10fd8897bbebe73942627a8d15673b55fa86c55fe5f42f0
MD5 ca8316639f2a9414208f5b3e33d7c7c3
SHA1 29ecaa2710e9a1466cebeec3f25de18ba9750bc4
SHA512 de563582e367d73fecc48f5fd1c3b47c97ab823a6f4083b3fd6668c58a3f499457685f73e9d477a6264bb3e08c50a202c34473f04faa4dc14ef714674c589dea
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T19534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytrljd.sys

Path C:\Temp\oigbytrljd.sys
Size 141KB
SHA256 59cc0d595a095601a506eef2db9e42a60c0b57a0f13d27734574dbb64712f73e
MD5 04fc5e063df344cec3addf7d56077c1d
SHA1 e2094eef0b5c49e941e75d620a04a2e57de3a0aa
SHA512 b936575ce17324822a19ff3cd88fe82870ed025077648e23881b397516ec42ed51eb02a2ebb9a5d43b5603ffad7b099ff41edfdf4d7fe6005a92103abda943cb
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrpjh.exe

Path C:\Temp\omgezwrpjh.exe
Size 226KB
SHA256 e61c59785fc540146a2e46b703d8b318451a4f6e2268d9450bab73cd9e7179b6
MD5 83488846bbf24002d89c8a84a492ae5b
SHA1 720846d5f87381369ac042f60d4c0e85ad27a2fd
SHA512 9113213283401c9a36b53761bd92a0fca3802da93ecaf3ed9b4d12e82a151e9451e356cc090a08cccd19371fc31e7c215d733784e6e16329cad9b8db47bd38de
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T1B434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczurmke.sys

Path C:\Temp\pjhczurmke.sys
Size 141KB
SHA256 1dc735ffa52c4b201e9e91f1b75bf7378f553d5f44f87fc435e462fc0c6b65d2
MD5 8fa77fa472172c9b00367a09ac3d5819
SHA1 f3a90d216bb9e91d5bd5a3693bde75a88df158c6
SHA512 41b6c8eecd47abc733379640a9183d440b581e56facf71e43c0c184848097145efd414a6ee045101aa30dcbe728ce67b81f1cc26abc71a22ad20ce676f387a93
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T155E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmke.exe

Path C:\Temp\pkhcausmke.exe
Size 226KB
SHA256 50442474fac6960bbaa0e8558f96397851efea9a375219f422564df0d98c07a5
MD5 453531f957a73ced3d50ac99084c699e
SHA1 06c336b41b05e6688b6cd36ef0841da6c60fb472
SHA512 670b4ce16063f731cb9053b75834396081ddb65b3fdd73920f29f7628f7239c5c1617675441bb9566bd6d9a93340bbf2a85d6fc2c7b9ab718405d070d803b7bd
SSDEEP 3072:fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:+XY4LK+a3lLNngoqRttA7
TLSH
T15334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnlf.sys

Path C:\Temp\qkicavsnlf.sys
Size 141KB
SHA256 406b8dc7cb0e5e31c48880c43b0b6e0decd7c5974318b2d5a362195b119bbf01
MD5 845d42856786f0a9206ff79f37991e7d
SHA1 6270ad075c6fb59592b7a5555122a133d76df49a
SHA512 96657d3425290bae25f9b754d1f1f9006cea9c3d9348cfc2ee66c20f7b1aaecc0f11b312988c04505a5b3a95d5aaf8053f715b38d913d556539566666c3fc11a
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T157E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwuomh.exe

Path C:\Temp\rljebwuomh.exe
Size 226KB
SHA256 6015ac6400e230d7aca42d1ddba85a1d97aa3faad2127074b8062420ceb5be4e
MD5 e69c9bc89b1e95b889ccfaeb1a132779
SHA1 2ba91df6b98f37e3601c2bc966ce145b5a54a096
SHA512 8b7fcda179fa45df6b84db3713d3263156f87484014f63bfd7bb9a0a1aa83c610df935baab8830c1174f42a3b89bacc3a7f69b2889d2674ea419c8c0a6b56d06
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T1BD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqoi.exe

Path C:\Temp\tnlfdyvqoi.exe
Size 226KB
SHA256 41fb54fa4cbd9040993ad3d93cd79f7ab0934a282ceac944b0e8e879919f8b88
MD5 4a2cb1304aabec1aa04727ee17e7f95d
SHA1 8cf1d589927d9d0ac65ae40ac6956551d55b62d9
SHA512 2479b7308a17a600f1dc31dd1944f7d53aac481b25c823df630a8976a69bc7b227ad15a0785ed6af5c4381e8249516627df972e8ffedc2f2f81fa6608f1865fd
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T13A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfzxsp.sys

Path C:\Temp\xupnhfzxsp.sys
Size 141KB
SHA256 042b92c04a4b56cf496092cef0a9ea4d27867f2b15e94c58e7b554a9087f58ae
MD5 61aa98f8d313db091667ccacbf832b89
SHA1 10294b36fabba3b494fe07a9f016aad6d76dfbed
SHA512 5399d1451e877358349a654c8b53210da0c39203c1fba25421c4d8e2fa8be9126b961b1359a422826fe13fee03b4bcb3e0525166ae0c6f7fe2a07b0d3cf3f39c
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DBE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidavlf.sys

Path C:\Temp\ysqlidavlf.sys
Size 141KB
SHA256 ea6dba193ed9bb2693a8e9c860299e0828012f8840bd7c0dbf80cf7210e1b09f
MD5 a1678634f5c409ef3b825c448bf5332a
SHA1 60834587c686786a279799778b68eee078af060d
SHA512 3ea45078711b3d7e5d42e0f89aead21ae68185d34531dd443b9817ac482932058ae8bf72914a95a93cc36c6a74b0c914960c14f92ebf4a9928300bc2066eb7da
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 c73df79de0408c4f45f50b71afcf825c671e214a9f9c7dea03c2669012759b42
MD5 afba6350e214ae3f96c0c0eb2689c6df
SHA1 3c17e2351c91d2ed0b308bb70e2e0be05dd77202
SHA512 f8029828f4d8c080ccf0995be551341f5c6177e541792c97769eddeae4fb117e103942bec83e0d7add856e997fca4910d52b5f826f8eb8385f12926b2761b70d
TLSH
T191F0DC53AC6EF9F16DC09CD812A4827E3450B67B11940212EC3C87FA0829FADB70A428
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 ad55f34b951e38839dc103d508fb2b4585581572d9c01b12839b59de1c4778d5
MD5 371480f522bab72cc477e8e1c0f6b698
SHA1 dee63b1faff4f1869d75ab37ccf4a5e2628c83d3
SHA512 95ef7cce73f7cbbe1658796c93533f48988ef679711b3a8929263edcd8a7fb2d8223d21c0cd7793cad8410416728b18d307ef14510227c8183777e0ebf0617fe
TLSH
T149E0C03422F6411FF6F4D03887CD752154ADF0221438B2B429C48F04B702A00DC03E29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GI7SXTIE\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/808-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1100-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1124-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1124-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1288-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2304-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2436-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2548-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2968-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3016-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3200-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3276-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3540-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3544-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3796-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4300-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4840-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5004-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads