a114ca44c702340fb03db5b30b066a07fc04493351656b29ccd441e96dd1929c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260810-vlrnxstdmd
SHA256 a114ca44c702340fb03db5b30b066a07fc04493351656b29ccd441e96dd1929c
MD5 e0efc308532e16d3b41f6cd4bdb0465a
SHA1 af3bd550438d95226cd461059578242030bef9cd
SHA512 e71c3043db9dcc2bd0e816bd74e4d3559f2c9e38b177fbccb0c433d21ed1f3807a2f4ced6f02477c0b77b78cd622550ad5e16416cbc9295c0f48fe2d7bf0753b
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T1BC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1800	CP.exe
1924	mhezwrpjhc.exe
4880	CP.exe
5116	CP.exe
1460	i_mhezwrpjhc.exe
2588	eywrojhbwt.sys
2424	CP.exe
1292	tomgeywroj.exe
4296	CP.exe
3712	CP.exe
2684	i_tomgeywroj.exe
3732	ztolgeywqo.sys
1724	CP.exe
4940	ojdbvtolgd.exe
808	CP.exe
3356	CP.exe
4044	i_ojdbvtolgd.exe
5056	jdbvtnlgdy.sys
3864	CP.exe
4556	toigaytqlg.exe
864	CP.exe
2904	CP.exe
4728	i_toigaytqlg.exe
1448	tnlfdxvqni.sys
740	CP.exe
896	lfdyvqoiga.exe
3976	CP.exe
4052	CP.exe
4540	i_lfdyvqoiga.exe
4264	cavsnlfdxv.sys
3368	CP.exe
1496	vpnifaysql.exe
2636	CP.exe
3784	CP.exe
4916	i_vpnifaysql.exe
5076	nhfaxsqkic.sys
812	CP.exe
3788	causmkfcxv.exe
976	CP.exe
4912	CP.exe
408	i_causmkfcxv.exe
1392	hfzxspkica.sys
4836	CP.exe
5012	pmhfzxrpjh.exe
4160	CP.exe
3332	CP.exe
1180	i_pmhfzxrpjh.exe
1220	xrpjhczusm.sys
1720	CP.exe
4812	mkecwupezw.exe
3428	CP.exe
2784	CP.exe
3260	i_mkecwupezw.exe
2592	jhbztrljeb.sys
1712	CP.exe
3296	ywrojhbztr.exe
392	CP.exe
676	CP.exe
1052	i_ywrojhbztr.exe
4564	qojgbztrlj.sys
1512	CP.exe
228	jebtrljdbw.exe
4368	CP.exe
1748	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlavqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toigaytqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupmhfr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_toigaytqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlavqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupmhfr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebtrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebtrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupnhfzx.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4992	ipconfig.exe
4424	ipconfig.exe
2236	ipconfig.exe
2604	ipconfig.exe
4172	ipconfig.exe
2296	ipconfig.exe
4936	ipconfig.exe
2384	ipconfig.exe
3808	ipconfig.exe
884	ipconfig.exe
3412	ipconfig.exe
3580	ipconfig.exe
3116	ipconfig.exe
2784	ipconfig.exe
3820	ipconfig.exe
432	ipconfig.exe
4100	ipconfig.exe
2952	ipconfig.exe
212	ipconfig.exe
3408	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000994ecf19d48ae9428d4805a6fac82213000000000200000000001066000000010000200000004680bf0f2cdce0ba9c44569cd72ceb59191b48f1dca733ca5a68b67fab5a3867000000000e8000000002000020000000dbc246c757c97bff5a3478e39a8342b2629d87d32d68b11513d5677455c08cc9200000004934ea971b918a21d0a187064248b9381bd2d2b6141813a8cb5cecdb588192484000000077e169b59dbfd69a060b330d273aa9f83153174714b9955169724d635b82a9ed57d7ae481c75d54307d8442deb0a7bbbb977f108cc7f0ddf51386b167acdc7e0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0834ad5f228dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0654fd5f228dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "493146474"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000994ecf19d48ae9428d4805a6fac82213000000000200000000001066000000010000200000001c5d4f7b90354c5ff8bf2a80d476bead527242b69b83cc8470561f3ef060de35000000000e8000000002000020000000860cd14231f10bc3b960c22ccb08674641e44251e365df1125476214d1056cd420000000ec2c8d1661144f3447a34af75c4be1f15d332ad154f25617ebc47cb6fa02d260400000000737713848fc2ab1641e1615e4477413028a0fd5d496eda3815495847adfb31ba52c99c39c3d89bde9f48483897690fa93dd2c0b2d9c471947f6067d2db66f9c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271146"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9E88E2A5-94DD-11F1-AA2C-F23C4AB2DE8F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1933334187"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1460	i_mhezwrpjhc.exe
Token: SeDebugPrivilege	2684	i_tomgeywroj.exe
Token: SeDebugPrivilege	4044	i_ojdbvtolgd.exe
Token: SeDebugPrivilege	4728	i_toigaytqlg.exe
Token: SeDebugPrivilege	4540	i_lfdyvqoiga.exe
Token: SeDebugPrivilege	4916	i_vpnifaysql.exe
Token: SeDebugPrivilege	408	i_causmkfcxv.exe
Token: SeDebugPrivilege	1180	i_pmhfzxrpjh.exe
Token: SeDebugPrivilege	3260	i_mkecwupezw.exe
Token: SeDebugPrivilege	1052	i_ywrojhbztr.exe
Token: SeDebugPrivilege	4104	i_jebtrljdbw.exe
Token: SeDebugPrivilege	4152	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	2604	i_ysqlavqoig.exe
Token: SeDebugPrivilege	1228	i_qnifaysqki.exe
Token: SeDebugPrivilege	4136	i_kicausnkfc.exe
Token: SeDebugPrivilege	3480	i_fcxupnhfzx.exe
Token: SeDebugPrivilege	3912	i_kecxupmhfr.exe
Token: SeDebugPrivilege	1212	i_ezwrpjhbzu.exe
Token: SeDebugPrivilege	1812	i_ztrljdbwto.exe
Token: SeDebugPrivilege	2964	i_tqljdbvtol.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1148	iexplore.exe
1148	iexplore.exe
5008	IEXPLORE.EXE
5008	IEXPLORE.EXE
5008	IEXPLORE.EXE
5008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1148	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	86
PID 1148 wrote to memory of 5008	1148	iexplore.exe	87
PID 4616 wrote to memory of 1800	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 1924 wrote to memory of 4880	1924	mhezwrpjhc.exe	93
PID 4616 wrote to memory of 5116	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	96
PID 4616 wrote to memory of 2424	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	100
PID 1292 wrote to memory of 4296	1292	tomgeywroj.exe	102
PID 4616 wrote to memory of 3712	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 4616 wrote to memory of 1724	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	109
PID 4940 wrote to memory of 808	4940	ojdbvtolgd.exe	111
PID 4616 wrote to memory of 3356	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 4616 wrote to memory of 3864	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 4556 wrote to memory of 864	4556	toigaytqlg.exe	120
PID 4616 wrote to memory of 2904	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 4616 wrote to memory of 740	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 896 wrote to memory of 3976	896	lfdyvqoiga.exe	132
PID 4616 wrote to memory of 4052	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 4616 wrote to memory of 3368	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 1496 wrote to memory of 2636	1496	vpnifaysql.exe	141
PID 4616 wrote to memory of 3784	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	144
PID 4616 wrote to memory of 812	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 3788 wrote to memory of 976	3788	causmkfcxv.exe	150
PID 4616 wrote to memory of 4912	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 4616 wrote to memory of 4836	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 5012 wrote to memory of 4160	5012	pmhfzxrpjh.exe	159
PID 4616 wrote to memory of 3332	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 4616 wrote to memory of 1720	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 4812 wrote to memory of 3428	4812	mkecwupezw.exe	168
PID 4616 wrote to memory of 2784	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 4616 wrote to memory of 1712	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 3296 wrote to memory of 392	3296	ywrojhbztr.exe	179
PID 4616 wrote to memory of 676	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 4616 wrote to memory of 1512	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 228 wrote to memory of 4368	228	jebtrljdbw.exe	193
PID 4616 wrote to memory of 1748	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	196
PID 4616 wrote to memory of 1384	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	200
PID 3708 wrote to memory of 4964	3708	vtnlfdyvqo.exe	202
PID 4616 wrote to memory of 2156	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	205
PID 4616 wrote to memory of 1080	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	209
PID 3504 wrote to memory of 1044	3504	ysqlavqoig.exe	211
PID 4616 wrote to memory of 2900	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	214
PID 4616 wrote to memory of 1920	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	218
PID 3412 wrote to memory of 2712	3412	qnifaysqki.exe	220
PID 4616 wrote to memory of 4116	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	223
PID 4616 wrote to memory of 2832	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	227
PID 2384 wrote to memory of 2960	2384	kicausnkfc.exe	229
PID 4616 wrote to memory of 832	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	232
PID 4616 wrote to memory of 2448	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	236
PID 4232 wrote to memory of 1108	4232	fcxupnhfzx.exe	238
PID 4616 wrote to memory of 440	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	241
PID 4616 wrote to memory of 3204	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	245
PID 2092 wrote to memory of 448	2092	kecxupmhfr.exe	247
PID 4616 wrote to memory of 1668	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	250
PID 4616 wrote to memory of 4064	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	254
PID 4248 wrote to memory of 4272	4248	ezwrpjhbzu.exe	256
PID 4616 wrote to memory of 2228	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	259
PID 4616 wrote to memory of 368	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	264
PID 2816 wrote to memory of 3388	2816	ztrljdbwto.exe	266
PID 4616 wrote to memory of 3892	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	269
PID 4616 wrote to memory of 4260	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	273
PID 4644 wrote to memory of 4488	4644	tqljdbvtol.exe	275
PID 4616 wrote to memory of 3600	4616	2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe	278

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e0efc308532e16d3b41f6cd4bdb0465a_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezwrpjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1800
- - C:\Temp\mhezwrpjhc.exe
    C:\Temp\mhezwrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezwrpjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5116
- - C:\Temp\i_mhezwrpjhc.exe
    C:\Temp\i_mhezwrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2424
- - C:\Temp\tomgeywroj.exe
    C:\Temp\tomgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3712
- - C:\Temp\i_tomgeywroj.exe
    C:\Temp\i_tomgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojdbvtolgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1724
- - C:\Temp\ojdbvtolgd.exe
    C:\Temp\ojdbvtolgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojdbvtolgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3356
- - C:\Temp\i_ojdbvtolgd.exe
    C:\Temp\i_ojdbvtolgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\toigaytqlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3864
- - C:\Temp\toigaytqlg.exe
    C:\Temp\toigaytqlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_toigaytqlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2904
- - C:\Temp\i_toigaytqlg.exe
    C:\Temp\i_toigaytqlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdyvqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:740
- - C:\Temp\lfdyvqoiga.exe
    C:\Temp\lfdyvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdyvqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4052
- - C:\Temp\i_lfdyvqoiga.exe
    C:\Temp\i_lfdyvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnifaysql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3368
- - C:\Temp\vpnifaysql.exe
    C:\Temp\vpnifaysql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnifaysql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3784
- - C:\Temp\i_vpnifaysql.exe
    C:\Temp\i_vpnifaysql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkfcxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:812
- - C:\Temp\causmkfcxv.exe
    C:\Temp\causmkfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkfcxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4912
- - C:\Temp\i_causmkfcxv.exe
    C:\Temp\i_causmkfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4836
- - C:\Temp\pmhfzxrpjh.exe
    C:\Temp\pmhfzxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3332
- - C:\Temp\i_pmhfzxrpjh.exe
    C:\Temp\i_pmhfzxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1720
- - C:\Temp\mkecwupezw.exe
    C:\Temp\mkecwupezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2784
- - C:\Temp\i_mkecwupezw.exe
    C:\Temp\i_mkecwupezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywrojhbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1712
- - C:\Temp\ywrojhbztr.exe
    C:\Temp\ywrojhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywrojhbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:676
- - C:\Temp\i_ywrojhbztr.exe
    C:\Temp\i_ywrojhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebtrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1512
- - C:\Temp\jebtrljdbw.exe
    C:\Temp\jebtrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebtrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1748
- - C:\Temp\i_jebtrljdbw.exe
    C:\Temp\i_jebtrljdbw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqo.exe ups_run
  2⤵
  PID:1384
- - C:\Temp\vtnlfdyvqo.exe
    C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
  2⤵
  PID:2156
- - C:\Temp\i_vtnlfdyvqo.exe
    C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlavqoig.exe ups_run
  2⤵
  PID:1080
- - C:\Temp\ysqlavqoig.exe
    C:\Temp\ysqlavqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlavqoig.exe ups_ins
  2⤵
  PID:2900
- - C:\Temp\i_ysqlavqoig.exe
    C:\Temp\i_ysqlavqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run
  2⤵
  PID:1920
- - C:\Temp\qnifaysqki.exe
    C:\Temp\qnifaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins
  2⤵
  PID:4116
- - C:\Temp\i_qnifaysqki.exe
    C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnkfc.exe ups_run
  2⤵
  PID:2832
- - C:\Temp\kicausnkfc.exe
    C:\Temp\kicausnkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausnkfc.exe ups_ins
  2⤵
  PID:832
- - C:\Temp\i_kicausnkfc.exe
    C:\Temp\i_kicausnkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxupnhfzx.exe ups_run
  2⤵
  PID:2448
- - C:\Temp\fcxupnhfzx.exe
    C:\Temp\fcxupnhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxupnhfzx.exe ups_ins
  2⤵
  PID:440
- - C:\Temp\i_fcxupnhfzx.exe
    C:\Temp\i_fcxupnhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecxupmhfr.exe ups_run
  2⤵
  PID:3204
- - C:\Temp\kecxupmhfr.exe
    C:\Temp\kecxupmhfr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecxupmhfr.exe ups_ins
  2⤵
  PID:1668
- - C:\Temp\i_kecxupmhfr.exe
    C:\Temp\i_kecxupmhfr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbzu.exe ups_run
  2⤵
  PID:4064
- - C:\Temp\ezwrpjhbzu.exe
    C:\Temp\ezwrpjhbzu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhbzu.exe ups_ins
  2⤵
  PID:2228
- - C:\Temp\i_ezwrpjhbzu.exe
    C:\Temp\i_ezwrpjhbzu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljdbwto.exe ups_run
  2⤵
  PID:368
- - C:\Temp\ztrljdbwto.exe
    C:\Temp\ztrljdbwto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3388
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljdbwto.exe ups_ins
  2⤵
  PID:3892
- - C:\Temp\i_ztrljdbwto.exe
    C:\Temp\i_ztrljdbwto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvtol.exe ups_run
  2⤵
  PID:4260
- - C:\Temp\tqljdbvtol.exe
    C:\Temp\tqljdbvtol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvtol.exe ups_ins
  2⤵
  PID:3600
- - C:\Temp\i_tqljdbvtol.exe
    C:\Temp\i_tqljdbvtol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2964

C:\Temp\eywrojhbwt.sys
C:\Temp\eywrojhbwt.sys
1⤵
- Executes dropped EXE
PID:2588

C:\Temp\ztolgeywqo.sys
C:\Temp\ztolgeywqo.sys
1⤵
- Executes dropped EXE
PID:3732

C:\Temp\jdbvtnlgdy.sys
C:\Temp\jdbvtnlgdy.sys
1⤵
- Executes dropped EXE
PID:5056

C:\Temp\tnlfdxvqni.sys
C:\Temp\tnlfdxvqni.sys
1⤵
- Executes dropped EXE
PID:1448

C:\Temp\cavsnlfdxv.sys
C:\Temp\cavsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:4264

C:\Temp\nhfaxsqkic.sys
C:\Temp\nhfaxsqkic.sys
1⤵
- Executes dropped EXE
PID:5076

C:\Temp\hfzxspkica.sys
C:\Temp\hfzxspkica.sys
1⤵
- Executes dropped EXE
PID:1392

C:\Temp\xrpjhczusm.sys
C:\Temp\xrpjhczusm.sys
1⤵
- Executes dropped EXE
PID:1220

C:\Temp\jhbztrljeb.sys
C:\Temp\jhbztrljeb.sys
1⤵
- Executes dropped EXE
PID:2592

C:\Temp\qojgbztrlj.sys
C:\Temp\qojgbztrlj.sys
1⤵
- Executes dropped EXE
PID:4564

C:\Temp\oigbytjdbv.sys
C:\Temp\oigbytjdbv.sys
1⤵
PID:3252

C:\Temp\gdyvqoigay.sys
C:\Temp\gdyvqoigay.sys
1⤵
PID:3272

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
PID:4364

C:\Temp\vpnhfaxsqk.sys
C:\Temp\vpnhfaxsqk.sys
1⤵
PID:2324

C:\Temp\xsmkfcxupf.sys
C:\Temp\xsmkfcxupf.sys
1⤵
PID:3120

C:\Temp\smkecwupmh.sys
C:\Temp\smkecwupmh.sys
1⤵
PID:4656

C:\Temp\mkecwuomhe.sys
C:\Temp\mkecwuomhe.sys
1⤵
PID:4424

C:\Temp\geywrojhbz.sys
C:\Temp\geywrojhbz.sys
1⤵
PID:2708

C:\Temp\mgeywqojgb.sys
C:\Temp\mgeywqojgb.sys
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkfcxv.exe

Path C:\Temp\causmkfcxv.exe
Size 226KB
SHA256 91e808bd2cf2fee96cb5aaca0ded5a8618bd66bae39453ee3909f38b5b6953a4
MD5 395a3558df63d103c3a6821441519b16
SHA1 828b938e6b3ee2dbd42d1d67e9f5f74958068a03
SHA512 931623668972b5ffc328fb9fb49c3ab173102d33452a40ea4e7f2284e24b5fb48aa2e7f5f9f4647f7abe3e9ec6b06ebbdc63b93de7bcc783f5171e9a1d343249
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T16A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsnlfdxv.sys

Path C:\Temp\cavsnlfdxv.sys
Size 141KB
SHA256 7e917ef2573b361f00625471ff5a52be9d0d84cf2bd90c33249a692cf4c67267
MD5 1608a9e9754b650228333967b0d4c0f1
SHA1 bd5d11f4974b563fe591f14a7814be6706b0baa0
SHA512 9141dc019099183225a758e95ecacc563183f571680b22ea37e125609888a1c54521693bc7f0530dbe6cc169d093d9f281a0568cbcdfad09ddca3ffe72f91f6f
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywrojhbwt.sys

Path C:\Temp\eywrojhbwt.sys
Size 141KB
SHA256 e2d48e3c4deb90dbaccb1c77b40cc6ffa8c26f36df638bd2d551cca570a2db58
MD5 5a77e606226a5aac22c7b0f60090ed33
SHA1 ecb9c512b8f98c2756ecbd15fb4be57b6be9279d
SHA512 8e8468dd52e1f523304b11bd5568bd99e347143f77a91106b0e03879a40b7d81020b2da6cc8d99ef3150a284a7ec04de932df6f4eae1d7abac52830760d89afc
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspkica.sys

Path C:\Temp\hfzxspkica.sys
Size 141KB
SHA256 45794b2e93035d7ac396a6b6cd97528a5b73e53478f53ac38347760f5f1b6957
MD5 cfbce785eb6ef9caf24d39c659533e2b
SHA1 1a8ca7b4a9b05836ea52ecdc2fae44e5d4af8fc7
SHA512 bf0436232cacc869b9165d508755bc5a71c16d899e5edaac3979aadfb361d923b95880b223809e33fcff545fb314de3c041b159563fc7cb7ff8be51195d21d79
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causmkfcxv.exe

Path C:\Temp\i_causmkfcxv.exe
Size 226KB
SHA256 7134b9364b01e44c56c884cb324e9d69acb9374cd3da8123b7ba5712f5859b62
MD5 3b5043e0e9a8b07abdac707fcc1f9e0f
SHA1 0e8a60c111ac7f7ef28b7c6bfcb3afc2131e07d6
SHA512 1f5dd272d566fbd23c3b01dc439956828ab50a4d9f8bb88f026f39623e94c8406a5d2d510da9b57c86281f0f6a1c4e6c70449a0148a7265ede4713c7b8e8b231
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T10234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdyvqoiga.exe

Path C:\Temp\i_lfdyvqoiga.exe
Size 226KB
SHA256 3011c497dbc48972f41812302982615bf11944f0a55dc94aeebdd1d713440807
MD5 549d9d90fad876361fe53dc15bb87b1a
SHA1 99c6aa0022f7fcfbfa7493f17a5e365eea17ba10
SHA512 4253b882eecc6227f721ecc9b5c3016bdd06e58d588266bc872335a073ca94d53606e588cea1a5ef04b9339075cd18db1abec33ee876d576c6d9d9491e56c08d
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T1EC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhezwrpjhc.exe

Path C:\Temp\i_mhezwrpjhc.exe
Size 226KB
SHA256 b14f4abb4ecb04f271031851a02b57bea7af575943b8633a1cf47948b0864d86
MD5 2de812ec0cbd4587916d9790640bddfd
SHA1 58e59b88bdee023a6e12520ec7d8911f08f8b385
SHA512 5e4eae667207e2201cfe9361d6d34dcd9285fdb5b6a003cab5ff5bb0a3294c3b4f36393513c2bb716f392cad090cbe405074831422fe25b34c1bd302c98356ba
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T13A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojdbvtolgd.exe

Path C:\Temp\i_ojdbvtolgd.exe
Size 226KB
SHA256 62e1ac00421a1d5a0c0450c769b27ee427bd121d7772610ffb446b24d6774b7b
MD5 1a16232f4a55c3bbcc453fe65ecbbb39
SHA1 60f27264ce78328a9c75c439743920679e93e116
SHA512 6d0122a2ae52694d498a5aee52e3687b935344b0257770f3aa0ba6842e89ee6d198181d9e9e62889dca05b080e8a690e6dcc6ebb1e6f43bb5a1726afb7009aa0
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T13434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmhfzxrpjh.exe

Path C:\Temp\i_pmhfzxrpjh.exe
Size 226KB
SHA256 461fda8530454e2283024a8bd8270d345c30f9e4514ace8e5ff3b0f582a96a80
MD5 6f4e26fdf83dfc27484c60986f950396
SHA1 0b552ec651f05e52c5b3f6215136ef1262d6d800
SHA512 b562b296b9a7dc00099bdfb4dd24d64b8878986243cbf341c788a7a687675475fd59bb4eb2aa84db6c5b8b76c567295dadf944f41a072f58411eaed3ba7c8e81
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T1FC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_toigaytqlg.exe

Path C:\Temp\i_toigaytqlg.exe
Size 226KB
SHA256 bbd87622ec58139f48ef4ff1141761ee475bf3e95d9b78eabeae50acdc4b1377
MD5 ddfc2b18c634a221cac90a4798fc76af
SHA1 c1692a9ce87f846be7d9a6cc05518c0a7aa11f4b
SHA512 1617455c7a7579a9fe1abe97b1876ddfacefe697c5fbd4efaf989e4e1ab911c137f2c09a2a69143a9918b7104b7b4b556a4d920470913333290899390ddab743
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T16D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgeywroj.exe

Path C:\Temp\i_tomgeywroj.exe
Size 226KB
SHA256 7c4dfccb835a323b6e141a2f16527ccdd5e948778461819ec8c70adb919b48f5
MD5 4fb156c8780473c6040c585310d460ff
SHA1 14570ef931867f6c5123c8a90cb7fa9d4e6f7c3f
SHA512 6be27f3407314befaf2bcb5222c0f22568ba7b92e799a7e0b86f5b3c194ea57ff3efbaf0d0650f320130abc4ae34adc551f47dc23ed762c1c8fc7b9919f4c810
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T15534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnifaysql.exe

Path C:\Temp\i_vpnifaysql.exe
Size 226KB
SHA256 13b8755fb6e99457a405f47a55bdfce7f1d5d224978742dec35c8894de617c19
MD5 f0531ea9b50db3a6bd23df6337811708
SHA1 6e6b71ec717079a4dc7bac7338110de9a0d8c1a8
SHA512 4a3b027abfd473c9e1fc3dcab19a826ef7efd6b8677129d95c756cc44cdfd2b924c002211791f76a4cbfbe08dda39df649f291852ed8819b522c63ba6a7c70bb
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T1C834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtnlgdy.sys

Path C:\Temp\jdbvtnlgdy.sys
Size 141KB
SHA256 c2936faf35bbaac890a3750637c8d6d6543084b837506c9df71eb4362a572ced
MD5 4a4e56f664a71d98c01e62bd221c5d48
SHA1 f5a65e3a28c416888e9908a21afcef5618e255b6
SHA512 7d8b76363828d35fb7b69a69410db0f6a749e2ae439ec6b9a771fed032f20472a2d6b07c70f0549f76aa125059e9bba1b9d48fa3aeb31b9eb8e0de9bfaa800eb
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10EE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqoiga.exe

Path C:\Temp\lfdyvqoiga.exe
Size 226KB
SHA256 47c7757be3295b5c8fa0d9946db476c2de1a1b6b3d4a8cab2c147e81a927839e
MD5 6073427ec33a0aaf8e28e3d78041acdc
SHA1 1d7b6e56181a2bb30d51b6ce49da6c29abaaf44a
SHA512 ddb5794a0ee813f4e9af1f319c0cd89cfaf4298498fda565a8057267ad40b7bfc43d8658267226fdae3913451e3da6931191bc7a7d6b5737f6c2be7a0b19a04b
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T19034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezwrpjhc.exe

Path C:\Temp\mhezwrpjhc.exe
Size 226KB
SHA256 a13f1be6a87ac6391552e239998c5e83c8667b79867d5407ec0dae97786d2f42
MD5 8c0c51b0c6b79807c45d524d702faf6d
SHA1 ca411c982e900bd0bfe7c8dcb0e05ca6970f06a6
SHA512 459266bff5fe915f55dbb5dceb7e836902991a87405823fd24a242ef365299d19a039764a74f6b6d5dcce46e5b7c2b65d0bcfe8fbb7cd98b59863c659f86e17d
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T1F234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxsqkic.sys

Path C:\Temp\nhfaxsqkic.sys
Size 141KB
SHA256 37f07a9db972e98357456d94b38eed76fafcef4eaccba9720014128b8e7051a0
MD5 07e4e6ea58be464e51ac92ee163af9ef
SHA1 3227f25a7edd50da1093de45c8767a9bd1937d23
SHA512 2e1d46b3296cdc6f85f41111ef256bca29292bf28ace854d3ff95b65be59eb751b3af23b144055643767e8320c7c054a67486e975029e1b67ba27c161734e64a
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojdbvtolgd.exe

Path C:\Temp\ojdbvtolgd.exe
Size 226KB
SHA256 f449af6c3eb930e5479daf46d7abdcaa7f8767ed8c2eb4324dfe1c6ba175cb65
MD5 c3f73e0d60cca9d9edea1cf7e2c0b045
SHA1 d8d9f0f64a2f49063c5cab65cc23fc510991f320
SHA512 d6f114d19ea7c954268a7e6ee0012fdaba5d4836bf9d1bbb30a8dd94bf1f44465fc3ef569d257723b5a5a12771e5c03062fd5052bc6a36460bfd4f03021c09cd
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T1E934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.exe

Path C:\Temp\pmhfzxrpjh.exe
Size 226KB
SHA256 54c0094bfc639d3716e85eacd8262d5243d1da23aa33e618c3c05965063017c6
MD5 3e77da8722939d5b763c1fa34cc90f48
SHA1 37f88370ad62768eddd0187489ce319a4770753e
SHA512 e01cc9bf890ca5b96717813f4084db31521778d4fee609d805840bb0abe3e16562541cad1588517dbf40203c2ffadbfa9b82c689638dd60d8534d311e6e45538
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T1A634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdxvqni.sys

Path C:\Temp\tnlfdxvqni.sys
Size 141KB
SHA256 76c63c50bb220ec7c646b3669d3504787cd9a353aa9672e8b80afe376344ce12
MD5 73e6668f0b38a1cea0aa7400d353c98c
SHA1 59b25d59d3114a75346acaee701fbdcea5da1dff
SHA512 d734101fca34d7dd065377019275996c7c1df394b7d1e0a779a490a23d8d71c672571276304ca0b39480cd4c3d747d53228c81bb5e02af1b32f48b344258209c
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T172E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toigaytqlg.exe

Path C:\Temp\toigaytqlg.exe
Size 226KB
SHA256 60195ee7f1871da319e0ebba320217694973278fd297e6899498007b1ecf7628
MD5 f66e8d8db6cef2617601c56d462be213
SHA1 dc364538209c17071fbe879bdd7b263cc7277e5d
SHA512 2a8f05a726d11ac5c18cfd12bc840701d7a8259b6a6dc4ab82b5417592db714daa7eb11a9de90dc35cc051ebb54381976c2c1450dd4b6587250ecf241492c01b
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T18934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywroj.exe

Path C:\Temp\tomgeywroj.exe
Size 226KB
SHA256 6f7e3cdecb7ec89a7bec95c708b2e2db8df7616154f6feae3d5e2cc91457bb49
MD5 c7ba35b4172332915a49d792d49d45d7
SHA1 a4a448225281abff8e2d0c129dce878b602e7e5f
SHA512 4e6c00e77dc397da6168d0902d2425f62e35dc3b4268649c120a0660528f8bc19fa315d4a096273d864696b21b6d1cd73cf2b4a75d97ca7695decd65959ff2ed
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T1DC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnifaysql.exe

Path C:\Temp\vpnifaysql.exe
Size 226KB
SHA256 df3a3cbab1b2627069148dc42d0e37716d09c1f60d25afaca9e9adedf61bb62a
MD5 ecaa7720c9483bc7d74ec71549740f5d
SHA1 45369c16b0ee84209b07808d1894e33bb8a8f684
SHA512 6b81fe04295b1896cc111b684d705b4372f9bffaaf670fbcaa4fc190cd55ad47c6b9f14dba7df8bf803f080d5f31d0e82953452a694ec71e7b46111ff998da45
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T15534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztolgeywqo.sys

Path C:\Temp\ztolgeywqo.sys
Size 141KB
SHA256 76f4294cdceebe418600ec9fb7ce0d6948f73274f86c7e19d23d308400f77f44
MD5 09b8fc6013f6371c7660de36f9752be5
SHA1 9b4917d9385fbc6fa8231721f53f06c966addc5f
SHA512 d7710616c4d0597fa51fe933c4710f7d07ba4fa174dd1d671194c3b8f2917429ccf635329d563285714f8f2afda33be4fbfee7fa57e8df5925e22933f53ee183
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T175E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YR08IKJ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1220-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1392-91-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1448-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2324-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2588-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2592-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2708-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3120-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3252-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3272-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3272-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3732-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4264-67-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4340-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4364-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4424-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4564-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4656-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5056-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5076-79-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads