8b9d86887cb9780e725f5794d4024cf58ab107ecc4231c81766f8b7762411b29

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260820-3nefdaxemb
SHA256 8b9d86887cb9780e725f5794d4024cf58ab107ecc4231c81766f8b7762411b29
MD5 a35a1e329180f7dcbaff75be3f4d338c
SHA1 9312d2781adae6e6933fcb435cfee50fadbc02b6
SHA512 4dab65d7ad129ff2f4b0b4affcc1e68a450e72b2f779e3636228bdc062a218f804a0a254990113613c51e9bdbfebe7dd8ce28a7ca8f0035f544add72510505cd
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T1E534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3964	CP.exe
2228	avlfdxvqni.exe
3168	CP.exe
1308	CP.exe
4052	i_avlfdxvqni.exe
4736	kicavsnkfd.sys
4772	CP.exe
2256	dxvpnifays.exe
4800	CP.exe
2924	CP.exe
380	i_dxvpnifays.exe
1112	upnhfzxspk.sys
1708	CP.exe
1652	kicausmkfc.exe
4020	CP.exe
2860	CP.exe
1888	i_kicausmkfc.exe
3116	ezxrpjhczu.sys
4180	CP.exe
3476	usmkecwupm.exe
3648	CP.exe
800	CP.exe
3016	i_usmkecwupm.exe
1660	zuomhezxrp.sys
4404	CP.exe
2104	hbzurmkezw.exe
4092	CP.exe
4484	CP.exe
4660	i_hbzurmkezw.exe
5052	jhbztrmjec.sys
3816	CP.exe
4748	bwrojhbztr.exe
3756	CP.exe
2452	CP.exe
1812	i_bwrojhbztr.exe
384	rljebwtomg.sys
1656	CP.exe
2020	gbytolgeyw.exe
1904	CP.exe
4756	CP.exe
456	i_gbytolgeyw.exe
4680	tolgdywqoi.sys
4896	CP.exe
4252	idbvtnlgdy.exe
4300	CP.exe
2472	CP.exe
4604	i_idbvtnlgdy.exe
848	oidbvtnlfd.sys
4052	CP.exe
2440	vqnidavtnl.exe
2364	CP.exe
5052	CP.exe
3988	i_vqnidavtnl.exe
3572	dxvqnigays.sys
2220	CP.exe
116	snlfdxvpni.exe
2780	CP.exe
936	CP.exe
2764	i_snlfdxvpni.exe
3936	snkfcxvpnh.sys
1976	CP.exe
3604	hfzxspkica.exe
596	CP.exe
4864	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqcausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmkezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqcausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdyvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmkezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdyvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkica.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2612	ipconfig.exe
4128	ipconfig.exe
632	ipconfig.exe
4560	ipconfig.exe
2480	ipconfig.exe
1952	ipconfig.exe
1948	ipconfig.exe
1700	ipconfig.exe
4956	ipconfig.exe
2108	ipconfig.exe
2196	ipconfig.exe
1404	ipconfig.exe
4888	ipconfig.exe
2612	ipconfig.exe
3372	ipconfig.exe
3680	ipconfig.exe
3960	ipconfig.exe
3260	ipconfig.exe
2476	ipconfig.exe
728	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31273213"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f820706274db814494c82adeca0855e100000000020000000000106600000001000020000000fab778af0056c33ebe3709cae50f0a193a663cd5b9f72727f13a0d9914657acb000000000e80000000020000200000006b8bb149f4153b4cc470a0e311173cbfc7ee4d2a95d30a795f78534f0759979c200000003f6971f58a9e2cff22d56540f809ea2ca4453b545ec5d7b41c2492289dffbf6f400000000eddd255eedce06fc34dcedb5a8d2eb6f203eeefd44e5a71b73424a6b18e811db07a504dc59ec6a275d10f76e8882c43bffdb7e1f025a7b82a8306c51cb4388b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5DC12B81-9CF0-11F1-B05C-761C4632812C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "849160257"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0acf7940531dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f820706274db814494c82adeca0855e100000000020000000000106600000001000020000000f3f07706ec6a87f9306ff46d79ce76ce365f404106f88d5d726fbe27b59eb9a7000000000e80000000020000200000008752a48f0b55f779e649fe968b5b3e22c2195d7eae45baa638e8d59aaaa68150200000006a7988305de92616565db06fe84101b1e2300270f62b53538f90660e01f1d5324000000078a42af32ea9d439451318d7a4a5a5fa1200d2d2e2472be6e82a04ba0734fbf5067344ba56daea9f11e710bd3d6598cbafe85a6b3612a4d8e8904c6ac977b767	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "494034136"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d8fe940531dd01	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	i_avlfdxvqni.exe
Token: SeDebugPrivilege	380	i_dxvpnifays.exe
Token: SeDebugPrivilege	1888	i_kicausmkfc.exe
Token: SeDebugPrivilege	3016	i_usmkecwupm.exe
Token: SeDebugPrivilege	4660	i_hbzurmkezw.exe
Token: SeDebugPrivilege	1812	i_bwrojhbztr.exe
Token: SeDebugPrivilege	456	i_gbytolgeyw.exe
Token: SeDebugPrivilege	4604	i_idbvtnlgdy.exe
Token: SeDebugPrivilege	3988	i_vqnidavtnl.exe
Token: SeDebugPrivilege	2764	i_snlfdxvpni.exe
Token: SeDebugPrivilege	4708	i_hfzxspkica.exe
Token: SeDebugPrivilege	3472	i_zxrpjhczus.exe
Token: SeDebugPrivilege	1264	i_pjhczurmke.exe
Token: SeDebugPrivilege	548	i_ojhbzurmje.exe
Token: SeDebugPrivilege	2656	i_jebwtomgey.exe
Token: SeDebugPrivilege	2124	i_oigaytqljd.exe
Token: SeDebugPrivilege	1364	i_fdyvqnigay.exe
Token: SeDebugPrivilege	1948	i_faysqcausn.exe
Token: SeDebugPrivilege	4856	i_vpnhfaxsqk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4992	iexplore.exe
4992	iexplore.exe
4900	IEXPLORE.EXE
4900	IEXPLORE.EXE
4900	IEXPLORE.EXE
4900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 4992	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	85
PID 4992 wrote to memory of 4900	4992	iexplore.exe	86
PID 556 wrote to memory of 3964	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 2228 wrote to memory of 3168	2228	avlfdxvqni.exe	90
PID 556 wrote to memory of 1308	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	93
PID 556 wrote to memory of 4772	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	99
PID 2256 wrote to memory of 4800	2256	dxvpnifays.exe	101
PID 556 wrote to memory of 2924	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 556 wrote to memory of 1708	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	112
PID 1652 wrote to memory of 4020	1652	kicausmkfc.exe	114
PID 556 wrote to memory of 2860	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 556 wrote to memory of 4180	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 3476 wrote to memory of 3648	3476	usmkecwupm.exe	126
PID 556 wrote to memory of 800	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 556 wrote to memory of 4404	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 2104 wrote to memory of 4092	2104	hbzurmkezw.exe	136
PID 556 wrote to memory of 4484	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 556 wrote to memory of 3816	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 4748 wrote to memory of 3756	4748	bwrojhbztr.exe	145
PID 556 wrote to memory of 2452	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 556 wrote to memory of 1656	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 2020 wrote to memory of 1904	2020	gbytolgeyw.exe	154
PID 556 wrote to memory of 4756	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 556 wrote to memory of 4896	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 4252 wrote to memory of 4300	4252	idbvtnlgdy.exe	163
PID 556 wrote to memory of 2472	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 556 wrote to memory of 4052	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 2440 wrote to memory of 2364	2440	vqnidavtnl.exe	172
PID 556 wrote to memory of 5052	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 556 wrote to memory of 2220	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 116 wrote to memory of 2780	116	snlfdxvpni.exe	181
PID 556 wrote to memory of 936	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	184
PID 556 wrote to memory of 1976	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	188
PID 3604 wrote to memory of 596	3604	hfzxspkica.exe	190
PID 556 wrote to memory of 4864	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	193
PID 556 wrote to memory of 4476	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	197
PID 3344 wrote to memory of 4700	3344	zxrpjhczus.exe	199
PID 556 wrote to memory of 3812	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	202
PID 556 wrote to memory of 1668	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	206
PID 4604 wrote to memory of 3996	4604	pjhczurmke.exe	208
PID 556 wrote to memory of 4916	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	211
PID 556 wrote to memory of 4540	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	215
PID 4760 wrote to memory of 2420	4760	ojhbzurmje.exe	217
PID 556 wrote to memory of 4472	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	220
PID 556 wrote to memory of 1048	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	224
PID 4156 wrote to memory of 2764	4156	jebwtomgey.exe	226
PID 556 wrote to memory of 2844	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	229
PID 556 wrote to memory of 2344	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	234
PID 3372 wrote to memory of 1716	3372	oigaytqljd.exe	236
PID 556 wrote to memory of 1212	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	239
PID 556 wrote to memory of 2828	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	243
PID 3424 wrote to memory of 3688	3424	fdyvqnigay.exe	245
PID 556 wrote to memory of 2852	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	248
PID 556 wrote to memory of 2112	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	252
PID 1736 wrote to memory of 4780	1736	faysqcausn.exe	254
PID 556 wrote to memory of 3608	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	257
PID 556 wrote to memory of 1676	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	261
PID 1112 wrote to memory of 4696	1112	vpnhfaxsqk.exe	263
PID 556 wrote to memory of 3048	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	266
PID 556 wrote to memory of 2268	556	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	270
PID 1972 wrote to memory of 4560	1972	pkhczusmke.exe	272

C:\Users\Admin\AppData\Local\Temp\2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4992 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avlfdxvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3964
- - C:\Temp\avlfdxvqni.exe
    C:\Temp\avlfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avlfdxvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1308
- - C:\Temp\i_avlfdxvqni.exe
    C:\Temp\i_avlfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnifays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4772
- - C:\Temp\dxvpnifays.exe
    C:\Temp\dxvpnifays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnifays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2924
- - C:\Temp\i_dxvpnifays.exe
    C:\Temp\i_dxvpnifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausmkfc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1708
- - C:\Temp\kicausmkfc.exe
    C:\Temp\kicausmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausmkfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2860
- - C:\Temp\i_kicausmkfc.exe
    C:\Temp\i_kicausmkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4180
- - C:\Temp\usmkecwupm.exe
    C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:800
- - C:\Temp\i_usmkecwupm.exe
    C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzurmkezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4404
- - C:\Temp\hbzurmkezw.exe
    C:\Temp\hbzurmkezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzurmkezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4484
- - C:\Temp\i_hbzurmkezw.exe
    C:\Temp\i_hbzurmkezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwrojhbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3816
- - C:\Temp\bwrojhbztr.exe
    C:\Temp\bwrojhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwrojhbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2452
- - C:\Temp\i_bwrojhbztr.exe
    C:\Temp\i_bwrojhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytolgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1656
- - C:\Temp\gbytolgeyw.exe
    C:\Temp\gbytolgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytolgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4756
- - C:\Temp\i_gbytolgeyw.exe
    C:\Temp\i_gbytolgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idbvtnlgdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4896
- - C:\Temp\idbvtnlgdy.exe
    C:\Temp\idbvtnlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idbvtnlgdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2472
- - C:\Temp\i_idbvtnlgdy.exe
    C:\Temp\i_idbvtnlgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnidavtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4052
- - C:\Temp\vqnidavtnl.exe
    C:\Temp\vqnidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnidavtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5052
- - C:\Temp\i_vqnidavtnl.exe
    C:\Temp\i_vqnidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2220
- - C:\Temp\snlfdxvpni.exe
    C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:936
- - C:\Temp\i_snlfdxvpni.exe
    C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1976
- - C:\Temp\hfzxspkica.exe
    C:\Temp\hfzxspkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4864
- - C:\Temp\i_hfzxspkica.exe
    C:\Temp\i_hfzxspkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run
  2⤵
  PID:4476
- - C:\Temp\zxrpjhczus.exe
    C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins
  2⤵
  PID:3812
- - C:\Temp\i_zxrpjhczus.exe
    C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczurmke.exe ups_run
  2⤵
  PID:1668
- - C:\Temp\pjhczurmke.exe
    C:\Temp\pjhczurmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczurmke.exe ups_ins
  2⤵
  PID:4916
- - C:\Temp\i_pjhczurmke.exe
    C:\Temp\i_pjhczurmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbzurmje.exe ups_run
  2⤵
  PID:4540
- - C:\Temp\ojhbzurmje.exe
    C:\Temp\ojhbzurmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbzurmje.exe ups_ins
  2⤵
  PID:4472
- - C:\Temp\i_ojhbzurmje.exe
    C:\Temp\i_ojhbzurmje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwtomgey.exe ups_run
  2⤵
  PID:1048
- - C:\Temp\jebwtomgey.exe
    C:\Temp\jebwtomgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwtomgey.exe ups_ins
  2⤵
  PID:2844
- - C:\Temp\i_jebwtomgey.exe
    C:\Temp\i_jebwtomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaytqljd.exe ups_run
  2⤵
  PID:2344
- - C:\Temp\oigaytqljd.exe
    C:\Temp\oigaytqljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaytqljd.exe ups_ins
  2⤵
  PID:1212
- - C:\Temp\i_oigaytqljd.exe
    C:\Temp\i_oigaytqljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdyvqnigay.exe ups_run
  2⤵
  PID:2828
- - C:\Temp\fdyvqnigay.exe
    C:\Temp\fdyvqnigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdyvqnigay.exe ups_ins
  2⤵
  PID:2852
- - C:\Temp\i_fdyvqnigay.exe
    C:\Temp\i_fdyvqnigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysqcausn.exe ups_run
  2⤵
  PID:2112
- - C:\Temp\faysqcausn.exe
    C:\Temp\faysqcausn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysqcausn.exe ups_ins
  2⤵
  PID:3608
- - C:\Temp\i_faysqcausn.exe
    C:\Temp\i_faysqcausn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfaxsqk.exe ups_run
  2⤵
  PID:1676
- - C:\Temp\vpnhfaxsqk.exe
    C:\Temp\vpnhfaxsqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfaxsqk.exe ups_ins
  2⤵
  PID:3048
- - C:\Temp\i_vpnhfaxsqk.exe
    C:\Temp\i_vpnhfaxsqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhczusmke.exe ups_run
  2⤵
  PID:2268
- - C:\Temp\pkhczusmke.exe
    C:\Temp\pkhczusmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:728

C:\Temp\kicavsnkfd.sys
C:\Temp\kicavsnkfd.sys
1⤵
- Executes dropped EXE
PID:4736

C:\Temp\upnhfzxspk.sys
C:\Temp\upnhfzxspk.sys
1⤵
- Executes dropped EXE
PID:1112

C:\Temp\ezxrpjhczu.sys
C:\Temp\ezxrpjhczu.sys
1⤵
- Executes dropped EXE
PID:3116

C:\Temp\zuomhezxrp.sys
C:\Temp\zuomhezxrp.sys
1⤵
- Executes dropped EXE
PID:1660

C:\Temp\jhbztrmjec.sys
C:\Temp\jhbztrmjec.sys
1⤵
- Executes dropped EXE
PID:5052

C:\Temp\rljebwtomg.sys
C:\Temp\rljebwtomg.sys
1⤵
- Executes dropped EXE
PID:384

C:\Temp\tolgdywqoi.sys
C:\Temp\tolgdywqoi.sys
1⤵
- Executes dropped EXE
PID:4680

C:\Temp\oidbvtnlfd.sys
C:\Temp\oidbvtnlfd.sys
1⤵
- Executes dropped EXE
PID:848

C:\Temp\dxvqnigays.sys
C:\Temp\dxvqnigays.sys
1⤵
- Executes dropped EXE
PID:3572

C:\Temp\snkfcxvpnh.sys
C:\Temp\snkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:3936

C:\Temp\kecxupnhfz.sys
C:\Temp\kecxupnhfz.sys
1⤵
PID:64

C:\Temp\ecwupmhfzx.sys
C:\Temp\ecwupmhfzx.sys
1⤵
PID:1664

C:\Temp\wuomgezwrp.sys
C:\Temp\wuomgezwrp.sys
1⤵
PID:2080

C:\Temp\rojhbztrlj.sys
C:\Temp\rojhbztrlj.sys
1⤵
PID:3680

C:\Temp\vtolgdywqo.sys
C:\Temp\vtolgdywqo.sys
1⤵
PID:3036

C:\Temp\ytqljdbnlf.sys
C:\Temp\ytqljdbnlf.sys
1⤵
PID:2812

C:\Temp\qlidavtnlf.sys
C:\Temp\qlidavtnlf.sys
1⤵
PID:4376

C:\Temp\favsnkfdxv.sys
C:\Temp\favsnkfdxv.sys
1⤵
PID:3944

C:\Temp\xupnhfzxrp.sys
C:\Temp\xupnhfzxrp.sys
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avlfdxvqni.exe

Path C:\Temp\avlfdxvqni.exe
Size 226KB
SHA256 6e0c3f67ff5560171111062263eccc95a2d3147301e8ee5ca7c53df8a1f4d568
MD5 6c01cddf4125d5ff4c26d87faecc64f6
SHA1 0327b35bf0cd2e247256f07b5194e3d684fb1528
SHA512 e1738f836f8d36015a792e2d2c4a88ebb03f9c3d72eb4a453f2d72dccd4e29e5df3ffaf5e3063c2bff50bf83ed29d3cb3fa77140b89fab4d5e327378d8bdc08a
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T12134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwrojhbztr.exe

Path C:\Temp\bwrojhbztr.exe
Size 226KB
SHA256 8b116c48e28bfce008c55e04ca6a311ce641d83b8bf07eea807b059143c31acb
MD5 f7d0910c43445fd8653d0e42536d6702
SHA1 c29c23a784363170854e9d4bb2262b9c251a70f6
SHA512 540cf4e8dec97e25704878efcd0f37b036ef1aa1e85b9d73b220f8bcf5cc6b4c8e263959642584e3757f14bba649daaa4cc7a9153c9c649f5678a0fb819dd5d1
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T14034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifays.exe

Path C:\Temp\dxvpnifays.exe
Size 226KB
SHA256 0c9d0618d463545a681607abef222d9210ddd80f26609d915fdc9a73d381bfb8
MD5 737cea7424716459c3358abc382c3fe0
SHA1 8ad1caa0bae57f57d8a0b973b85fea26993bb7dc
SHA512 5d0b4713b2dfe597eecb1ec35b7441a3b268d4e94e051dadbe0988d83afa9804f1b1e1f3ba1cd5f4c5331ab7b1e52fed104799f9c524e480b559ae60f078da03
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T10C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezxrpjhczu.sys

Path C:\Temp\ezxrpjhczu.sys
Size 141KB
SHA256 21b10a13f6a01bf9c893909439bfb0bdbe27894ac867ca880d2ad0a43f42ee34
MD5 48f66d90fdd6bdeb8dd791e8433f1d5c
SHA1 8bd07b62437eab0f1f2182489bee9f12628c802c
SHA512 40d5ab613e339aa1f4344b800b6f393fd678f8b456ae4974770b84241f772839eb634751b07d99ac97ce9cce3c523f936ebf851598d411db8f5bfdcc823b624e
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1ABE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytolgeyw.exe

Path C:\Temp\gbytolgeyw.exe
Size 226KB
SHA256 2810d438af5614566156a19bf7fa8002eddbd0aae1559350161c476a3e0c17f0
MD5 306536fb41fa887257e66353153c6cac
SHA1 dec61732399d4d9384e1c6864f7b2ef311ba23bc
SHA512 e5e428cf39f54d0ab84b7ef9e43f0e5a1767f4d1854453db2a06eff22ae5d4de5c8b4e4d06cf5257db510e39bd4260ef50a3b19e9ea598e5f635de1aac17684b
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T1CE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurmkezw.exe

Path C:\Temp\hbzurmkezw.exe
Size 226KB
SHA256 b05822be857addf6f475a2310073678dce14ad1ad9e9b7c060885c0ad54745ee
MD5 f6370cf8a85a6818f285b86557b50588
SHA1 bc13d6e7b81601282303dcf9da4c7b0195ce9a71
SHA512 3b0fdaac338bce11745dd52be08954dde92f36438797899dea0364d3c228a3465bf485659cd2d4fb2f04f2e80bb48d0ac0b71a793d51cfa54a2e88b0ad8eed05
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T18034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avlfdxvqni.exe

Path C:\Temp\i_avlfdxvqni.exe
Size 226KB
SHA256 868e0a73280929f50ed219cd627a501d90f43e4cf9675e1385f5af5706be9107
MD5 17e253124c05f135c90f504c99d2598f
SHA1 ecdbdb9c8a109af028c4b677da8c3cc5f4219607
SHA512 7dc842b0492d48114a142102652cec0d46ce8a869b4f0652e7f033a8d6c2a6b4d147768ed3bebb57032ac6f4b59e69ed3512d6d70535e37680ae299e863536a5
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T11634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwrojhbztr.exe

Path C:\Temp\i_bwrojhbztr.exe
Size 226KB
SHA256 f6fee728f8804d3e19aa4e5bfe5d8f07eb4a76cdb838dde23ffb02028698817e
MD5 100b0832471c6c79cf1143b7d69a3978
SHA1 a877a3c65792833e9587c2f43a1cbe282134f6e3
SHA512 2384ae3389084356fd345ea0d4159c773eecc8f9f8c2390fb197b7392ce54f2e46ad55e705574ee0af5bf7bc481b9d9d77794f6bb55b1b896768a06e3f05215f
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T11D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvpnifays.exe

Path C:\Temp\i_dxvpnifays.exe
Size 226KB
SHA256 f334be708cd25335decf314aee8dffbda9d2c53d156b34c16540aba6aa3312a6
MD5 3ff3f39b45de6dda655253cbe9945612
SHA1 954930e0a0b0f0571e1d498e66658b6872aa3800
SHA512 016a0a9f15af129cfd6bcdd9409236d2095afc6a57ac33e7d265a32a8490902cb4ec6d058f0b84c0503ee684830e9439fb61076428060d9038f525ccd46b3d9b
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T10B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytolgeyw.exe

Path C:\Temp\i_gbytolgeyw.exe
Size 226KB
SHA256 3d11785f58e1d90b400288244d19c91ae7fbf788f1bb7a8444ecc1c176c50efc
MD5 d6ee7762e7cb18bea8d74665f03dde22
SHA1 87ab3391eef1050c87b0c16ef4b1004ea8761c19
SHA512 e5ff354405c5fbfb0cb5638ba94dbb66fc51913fda3f083d4c4398e61fadc68573418dcddf03de22660b12d60bdd5b303a90ddbf3ee3a0bff18d8bd3706ffca8
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T14F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbzurmkezw.exe

Path C:\Temp\i_hbzurmkezw.exe
Size 226KB
SHA256 20d4a7c6189caad2f16a3df9e66dad175bf10f28429ca46bd571f3350c92cec3
MD5 8651af9932b47817b5a3a6c7221f1925
SHA1 039db78c4606fbc8104504762b7162e2f8499d1c
SHA512 84dc9bd0c849398c09b6e527c7d010770de9d02d3414ecddb313f2a72a92f29ce6acba841eeb171da719013b3b74d95fd9c0c3ebfb2b44cebbb4ab20357c2d99
SSDEEP 3072:fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:+XY4LK+a3lLNngoqRttA7
TLSH
T1F034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicausmkfc.exe

Path C:\Temp\i_kicausmkfc.exe
Size 226KB
SHA256 8cacafece699a38e3ca92ac320bac491428af96df7d6ee31335f5ee45a7f408e
MD5 b6ef22d85d1b41ec1b735535860666c8
SHA1 3d3d5e65d31ff088f5ea95f459de602d6d3f0b68
SHA512 14ed561ffcf53398f596b404c52df050a2eff7006fc09947206654dbbe90bf512cb27cdcdc9374dc6f57c03753f6268618b9225503d19ea7058a7bc239d3bd0d
SSDEEP 3072:0GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:bXY4LK+a3lLNngoqRttA7
TLSH
T16834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkecwupm.exe

Path C:\Temp\i_usmkecwupm.exe
Size 226KB
SHA256 46dbd146bfde6af1bd8f64d0b85eab80ec19b3178d0574efab40753fa51c090c
MD5 efffac7e50e64dddcb81994da439cf1a
SHA1 76ff7fb5cf300826e34747330303fabde2b7d4fb
SHA512 c771b47099322476ec923de0f90d98a9ac8801669c90fd54a8dc256b10526679780eb22cfaa4f4a7ff0136ba9833f5fc247dea4dd014fc7c2ee97ab126cbe237
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T15534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlgdy.exe

Path C:\Temp\idbvtnlgdy.exe
Size 226KB
SHA256 0c2344bc20f6f35369bca3defe771986501866927ce000156673a871cb837ac3
MD5 d16ee1b769db906f64db42f285d2617a
SHA1 b0b5817f28ea13772425ad29a6248fda31658b01
SHA512 f22ef656785ec706e15530a607692b02ba4b483fb63196b634c77024acc06b00cecb46a7d1cfbccf92524ef091e0f566d799cc912c7da22dd26e368fc03d1e9a
SSDEEP 3072:tGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:MXY4LK+a3lLNngoqRttA7
TLSH
T12D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmjec.sys

Path C:\Temp\jhbztrmjec.sys
Size 141KB
SHA256 8e2e4afd327b894ec78af5a7efb1f5e25ca9c4b985ddc56ebbcd982c76bc8807
MD5 6791401227cfe16ed8a9c8c0de7d8463
SHA1 58dd4752e1ff832cec309adf8ccf0e7026ccf56f
SHA512 c4ec9cfbd5b1bf5f37fa32892ee5feae49bf7141b12485b3419f4ae66a873d3bf74eed64a75dc955eaa12c4777eea30b833d0efac2bb68529a5f812954feaf57
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausmkfc.exe

Path C:\Temp\kicausmkfc.exe
Size 226KB
SHA256 dedc6269ec372f96be1405564fb9a97ae6dbdf624623a9a2cb6cacb9553265ca
MD5 f9a729f53a5e7bf3484b463e5f618dd8
SHA1 2fa8a4401066d50e7059d992470e88765af23815
SHA512 14aab4a6478add3b994c7020c10e3604c836c39ec43c7d5a06a8a4e23d3d397261da7b5f10489a693ced78b7cab64fb27caf8ad838779c0cd15c6ee1963f9d96
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T1B634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicavsnkfd.sys

Path C:\Temp\kicavsnkfd.sys
Size 141KB
SHA256 20fce484795186b67671fb905dc863235ab8329ced622f2c1de11821a2051c58
MD5 2fe0ecdf25c747b0cb59c5f61bf60bad
SHA1 dbc01b1c9113eb9a187c780c20e44d15edbfcb78
SHA512 3ae2ba0759b4dd19706f72720e4e1d38736aafa6260db2ae8fa22c7ebfd6209628cc0888703d3f5c01060dffc7e10c2f0c77aeb2ac685a6699dd7fe1f3969079
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwtomg.sys

Path C:\Temp\rljebwtomg.sys
Size 141KB
SHA256 df02e8dcb68081d9cfe0f35434f2aea67887b0fdbe9c5bef8c5ba971dcacf90f
MD5 3a2fd43c1d26b8f6bf00a0475b976161
SHA1 650c01988d422c0b328b76feff730a3b4370b38b
SHA512 b952e847f7a2f39fc3ffab856239278cbb999ff6d62b69df42153cd380f702677a8da70ad7083545c69687e8892eca9596418ce80cf1800868a7ad9132047dc3
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgdywqoi.sys

Path C:\Temp\tolgdywqoi.sys
Size 141KB
SHA256 4fdc8994334b29e4f4d3cff87e156f883c5ea24231cdc14182a456d92213ac4e
MD5 b91bb7c11d65b6bee9d548307d9b1a18
SHA1 243650ea85f0b0a5cc1c795f0a39cfce934e3bbc
SHA512 ebc1a7b8449b9f1f42494eccad80ca20b75b5ec394cc3d65128d276e84f688be3237a1d4bfe43a788f06c951aa03218d4300eeaf5b071c28e1d476365029d8f1
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfzxspk.sys

Path C:\Temp\upnhfzxspk.sys
Size 141KB
SHA256 f7a0210f4a73043e18e1f86b54568e811472aa94f56c26658ae1298a71693859
MD5 f4190d92b4881dee9bc4c5231177caab
SHA1 cb4504189dc7de7b25f8e5dead80a87148fc1e90
SHA512 6d91c84910f4cff07c069d29c36f587a54861aa54a6aecd7d56a94ce790abf129ebdfd8f552c2dcf1c25d49a4f86fac290dd0bd8da36e4c704ebaded83f7ff77
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecwupm.exe

Path C:\Temp\usmkecwupm.exe
Size 226KB
SHA256 bcfbd410c66852dd789ff65f704cfcc9b66839d1102cc9d6f146af74259d9ffd
MD5 b3bfa340044cc0279d2286f0505a02ad
SHA1 629b34b3f6864151c4d067d8bf0158d7d4fe5fdd
SHA512 317fc316b31b1a5c918885eb084910e2b6e7a0459e284fee3c794f613b6a6723ddbe9ef77382e34ee36ce5f3260ce59208ba9690ac36576d65d35df9be51fde3
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T1B134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuomhezxrp.sys

Path C:\Temp\zuomhezxrp.sys
Size 141KB
SHA256 f188cb1ed0b23108d6b8e83297052d60871cd19b505ae1dbdb2ea1e2d0cb5b1f
MD5 1291339d6cae82140a13def7b16c43d4
SHA1 450be894b7f9602b79b52d279ed7d8cce469193d
SHA512 a5316734337606bc9264ae2f8f904ca12b468b75c63dfd912f4ff949f1c9f6bdf18a541b1b81b0b537491197b8438df494a164b978f18fbc3b538920e992b266
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E6E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 88ffbf3feed1535297d3345b7d3d8b8d9a1203ac3933ab69db4c6c2b8675a5f7
MD5 c711ecadcfa250c065db87d43e054342
SHA1 736134a1b1e42614344e633a857512164b22e710
SHA512 aff65cec71b7c392e0c9bd5056cca617444d4fa27369a9f7f3798f9555ae07c170aa46f296aa6e69a42bf5223817c221fd12f277fc65d890008a94af05d84998
TLSH
T1DCF02393007194A1AB10C8DC42D806373129EDEA14E5420AD03D47F41A6B3E8F63F07B
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 12dc360c818798f97ed4264f6c9ebec251e07e4fd5b76f7ee3a52cde6ada11c0
MD5 038b103c7af08362fe8d6855ddd6b658
SHA1 a934e9843eb44584eb8b78ca5537ea024167e413
SHA512 dd43c56d6a9cb9792604db900c09fac301e8eb48b9f3346d0dae965623644340e80caf6b775c7f0de7b414e53d2431253b31ad835a96c406ab844d14be0d6d5c
TLSH
T1B8E0C03421FA515FF0E5D0754BD57421946EF322053D92B429C58B04EB077409C03A29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GI7SXTIE\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/64-130-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/384-84-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/848-105-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1112-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1660-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1664-134-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2080-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2080-138-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2812-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3036-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3116-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3116-163-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3572-122-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3680-142-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3936-126-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3944-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4376-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4680-96-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4736-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5052-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads