11410c1744c8066cd4b7e71b5a29a6821829def692878bc095529d2e4da927a6

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260821-s89f5sshjb
SHA256 11410c1744c8066cd4b7e71b5a29a6821829def692878bc095529d2e4da927a6
MD5 948587b466fcab61dcd60ff86e532fe0
SHA1 5f518f7ccecf68088598c4c4e34b7bb6ea14f33c
SHA512 c32ed29553f56975bb7c28dab9dfd72d65c69756334ed7436732668f2d829ef6457c9219e56ba8fa79812ea3c7c81646a95db15cf29189efa995a0dafc649e4e
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T1FC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4668	CP.exe
2500	wrojhbztrl.exe
3816	CP.exe
1900	CP.exe
888	i_wrojhbztrl.exe
3980	eywrojhbzt.sys
4944	CP.exe
2532	tomgeywqoj.exe
4128	CP.exe
3268	CP.exe
2404	i_tomgeywqoj.exe
4548	trljdbvtol.sys
4444	CP.exe
2276	lgdywqoiga.exe
4552	CP.exe
1496	CP.exe
4644	i_lgdywqoiga.exe
1708	igaytqlidb.sys
4708	CP.exe
4460	yvqnigaytq.exe
4136	CP.exe
4964	CP.exe
4960	i_yvqnigaytq.exe
1176	idavtnlfdx.sys
4312	CP.exe
908	pnifaxsqki.exe
428	CP.exe
2968	CP.exe
3748	i_pnifaxsqki.exe
2036	ysnkfdxvpn.sys
3552	CP.exe
2496	kicavsnlfa.exe
4728	CP.exe
3680	CP.exe
4844	i_kicavsnlfa.exe
3196	kfcxvpnhfz.sys
4024	CP.exe
4740	zxrpkhcaus.exe
1688	CP.exe
2064	CP.exe
4904	i_zxrpkhcaus.exe
3272	zusmkecxup.sys
1356	CP.exe
4108	pmhfzxrpjh.exe
748	CP.exe
4428	CP.exe
4852	i_pmhfzxrpjh.exe
3392	urmkecwupm.sys
1988	CP.exe
4992	ezwrpjhbzt.exe
2540	CP.exe
3356	CP.exe
3992	i_ezwrpjhbzt.exe
2036	ojhbztrlje.sys
3908	CP.exe
4636	hbwuomgezw.exe
4372	CP.exe
4484	CP.exe
1416	i_hbwuomgezw.exe
3672	dywqojgbyt.sys
888	CP.exe
2232	trljdbvtol.exe
4652	CP.exe
4688	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqkicav.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3736	ipconfig.exe
1820	ipconfig.exe
4232	ipconfig.exe
2432	ipconfig.exe
4456	ipconfig.exe
4472	ipconfig.exe
212	ipconfig.exe
4972	ipconfig.exe
5000	ipconfig.exe
3832	ipconfig.exe
3636	ipconfig.exe
4168	ipconfig.exe
2372	ipconfig.exe
3004	ipconfig.exe
3788	ipconfig.exe
3016	ipconfig.exe
3352	ipconfig.exe
1552	ipconfig.exe
2764	ipconfig.exe
1812	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ed77088d31dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e008c25436f27c4d825c09cd08d97b4b0000000002000000000010660000000100002000000057217f5250dda1f2118923175c877e53b074b7f35e5a450875a5df01ef663c53000000000e8000000002000020000000b501b6e2ae78f567a7dcd33c4f21cd1a73a138dd954e0c92dfbf4241a86ca64020000000b23c95c13af43302ffb7b7484f3542dccf1a3c4550e49be0f3447dd3bf224ab9400000002deb0767cf3bfca3f71f97b8aa471b83d30776055d6a00a67eef37ddab8604e67cfd50f9f20b1b3782d201b334bbff26f7bd53baf1e1743c5299d2d6d42aced0	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D14FC58E-9D77-11F1-B40A-F23C4AB2DE8F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2945541713"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "494092326"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31273348"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31273348"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80197f088d31dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e008c25436f27c4d825c09cd08d97b4b00000000020000000000106600000001000020000000bbb14c06c3e9c431904b82134e90a4f88b4ab3cc018c00dd7c43cca673f4b824000000000e80000000020000200000004c80d51de39dd911b5189f19231b8916ae8fb9f444425d9ab225e52679770a2620000000030c2953d9e61463842361739798b54a4b698ee419826858eb7ca3d1e409364d40000000a53796d2f37900b09268816e5cf9e6f0e747806814a4cad334cb70de85eea29fcdbe37dbee6d62299b6de3b8c259844d6f2915cd1f24f04df69ee5d201d8206c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2936322903"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	888	i_wrojhbztrl.exe
Token: SeDebugPrivilege	2404	i_tomgeywqoj.exe
Token: SeDebugPrivilege	4644	i_lgdywqoiga.exe
Token: SeDebugPrivilege	4960	i_yvqnigaytq.exe
Token: SeDebugPrivilege	3748	i_pnifaxsqki.exe
Token: SeDebugPrivilege	4844	i_kicavsnlfa.exe
Token: SeDebugPrivilege	4904	i_zxrpkhcaus.exe
Token: SeDebugPrivilege	4852	i_pmhfzxrpjh.exe
Token: SeDebugPrivilege	3992	i_ezwrpjhbzt.exe
Token: SeDebugPrivilege	1416	i_hbwuomgezw.exe
Token: SeDebugPrivilege	3192	i_trljdbvtol.exe
Token: SeDebugPrivilege	3848	i_lidbvtnlfd.exe
Token: SeDebugPrivilege	940	i_fdxvqnigay.exe
Token: SeDebugPrivilege	2872	i_fdxvqkicav.exe
Token: SeDebugPrivilege	2224	i_ausmkfcxvp.exe
Token: SeDebugPrivilege	1992	i_smkecwupnh.exe
Token: SeDebugPrivilege	4928	i_jhbzurmkec.exe
Token: SeDebugPrivilege	3360	i_mhezwrpjhb.exe
Token: SeDebugPrivilege	960	i_bwtomgeywq.exe
Token: SeDebugPrivilege	3024	i_lgeywqoigb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1996	iexplore.exe
1996	iexplore.exe
5024	IEXPLORE.EXE
5024	IEXPLORE.EXE
5024	IEXPLORE.EXE
5024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 1996	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	85
PID 1996 wrote to memory of 5024	1996	iexplore.exe	86
PID 4408 wrote to memory of 4668	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 2500 wrote to memory of 3816	2500	wrojhbztrl.exe	90
PID 4408 wrote to memory of 1900	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	93
PID 4408 wrote to memory of 4944	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	97
PID 2532 wrote to memory of 4128	2532	tomgeywqoj.exe	99
PID 4408 wrote to memory of 3268	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 4408 wrote to memory of 4444	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	106
PID 2276 wrote to memory of 4552	2276	lgdywqoiga.exe	108
PID 4408 wrote to memory of 1496	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 4408 wrote to memory of 4708	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 4460 wrote to memory of 4136	4460	yvqnigaytq.exe	117
PID 4408 wrote to memory of 4964	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 4408 wrote to memory of 4312	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 908 wrote to memory of 428	908	pnifaxsqki.exe	128
PID 4408 wrote to memory of 2968	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 4408 wrote to memory of 3552	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 2496 wrote to memory of 4728	2496	kicavsnlfa.exe	137
PID 4408 wrote to memory of 3680	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 4408 wrote to memory of 4024	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 4740 wrote to memory of 1688	4740	zxrpkhcaus.exe	148
PID 4408 wrote to memory of 2064	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 4408 wrote to memory of 1356	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4108 wrote to memory of 748	4108	pmhfzxrpjh.exe	161
PID 4408 wrote to memory of 4428	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 4408 wrote to memory of 1988	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 4992 wrote to memory of 2540	4992	ezwrpjhbzt.exe	170
PID 4408 wrote to memory of 3356	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 4408 wrote to memory of 3908	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 4636 wrote to memory of 4372	4636	hbwuomgezw.exe	179
PID 4408 wrote to memory of 4484	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 4408 wrote to memory of 888	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 2232 wrote to memory of 4652	2232	trljdbvtol.exe	189
PID 4408 wrote to memory of 4688	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 4408 wrote to memory of 4452	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	196
PID 3280 wrote to memory of 1760	3280	lidbvtnlfd.exe	198
PID 4408 wrote to memory of 1120	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	201
PID 4408 wrote to memory of 2216	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	205
PID 4736 wrote to memory of 3456	4736	fdxvqnigay.exe	207
PID 4408 wrote to memory of 1796	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	210
PID 4408 wrote to memory of 2760	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	214
PID 1532 wrote to memory of 3608	1532	fdxvqkicav.exe	216
PID 4408 wrote to memory of 2508	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	219
PID 4408 wrote to memory of 3372	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	223
PID 868 wrote to memory of 3284	868	ausmkfcxvp.exe	225
PID 4408 wrote to memory of 5108	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	228
PID 4408 wrote to memory of 1008	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	232
PID 4172 wrote to memory of 4340	4172	smkecwupnh.exe	234
PID 4408 wrote to memory of 1592	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	237
PID 4408 wrote to memory of 632	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	241
PID 3336 wrote to memory of 4008	3336	jhbzurmkec.exe	243
PID 4408 wrote to memory of 2984	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	246
PID 4408 wrote to memory of 3864	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	250
PID 4932 wrote to memory of 1764	4932	mhezwrpjhb.exe	252
PID 4408 wrote to memory of 4616	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	255
PID 4408 wrote to memory of 4204	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	259
PID 2228 wrote to memory of 3796	2228	bwtomgeywq.exe	261
PID 4408 wrote to memory of 404	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	264
PID 4408 wrote to memory of 1776	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	268
PID 4884 wrote to memory of 3512	4884	lgeywqoigb.exe	270
PID 4408 wrote to memory of 60	4408	2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe	273

C:\Users\Admin\AppData\Local\Temp\2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_948587b466fcab61dcd60ff86e532fe0_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:5024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4668
- - C:\Temp\wrojhbztrl.exe
    C:\Temp\wrojhbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1900
- - C:\Temp\i_wrojhbztrl.exe
    C:\Temp\i_wrojhbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeywqoj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4944
- - C:\Temp\tomgeywqoj.exe
    C:\Temp\tomgeywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeywqoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3268
- - C:\Temp\i_tomgeywqoj.exe
    C:\Temp\i_tomgeywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdywqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4444
- - C:\Temp\lgdywqoiga.exe
    C:\Temp\lgdywqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdywqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1496
- - C:\Temp\i_lgdywqoiga.exe
    C:\Temp\i_lgdywqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnigaytq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4708
- - C:\Temp\yvqnigaytq.exe
    C:\Temp\yvqnigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnigaytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4964
- - C:\Temp\i_yvqnigaytq.exe
    C:\Temp\i_yvqnigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaxsqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4312
- - C:\Temp\pnifaxsqki.exe
    C:\Temp\pnifaxsqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaxsqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2968
- - C:\Temp\i_pnifaxsqki.exe
    C:\Temp\i_pnifaxsqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavsnlfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3552
- - C:\Temp\kicavsnlfa.exe
    C:\Temp\kicavsnlfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavsnlfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3680
- - C:\Temp\i_kicavsnlfa.exe
    C:\Temp\i_kicavsnlfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpkhcaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4024
- - C:\Temp\zxrpkhcaus.exe
    C:\Temp\zxrpkhcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpkhcaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2064
- - C:\Temp\i_zxrpkhcaus.exe
    C:\Temp\i_zxrpkhcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1356
- - C:\Temp\pmhfzxrpjh.exe
    C:\Temp\pmhfzxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4428
- - C:\Temp\i_pmhfzxrpjh.exe
    C:\Temp\i_pmhfzxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1988
- - C:\Temp\ezwrpjhbzt.exe
    C:\Temp\ezwrpjhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3356
- - C:\Temp\i_ezwrpjhbzt.exe
    C:\Temp\i_ezwrpjhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbwuomgezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3908
- - C:\Temp\hbwuomgezw.exe
    C:\Temp\hbwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbwuomgezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4484
- - C:\Temp\i_hbwuomgezw.exe
    C:\Temp\i_hbwuomgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbvtol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:888
- - C:\Temp\trljdbvtol.exe
    C:\Temp\trljdbvtol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbvtol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4688
- - C:\Temp\i_trljdbvtol.exe
    C:\Temp\i_trljdbvtol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbvtnlfd.exe ups_run
  2⤵
  PID:4452
- - C:\Temp\lidbvtnlfd.exe
    C:\Temp\lidbvtnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbvtnlfd.exe ups_ins
  2⤵
  PID:1120
- - C:\Temp\i_lidbvtnlfd.exe
    C:\Temp\i_lidbvtnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnigay.exe ups_run
  2⤵
  PID:2216
- - C:\Temp\fdxvqnigay.exe
    C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnigay.exe ups_ins
  2⤵
  PID:1796
- - C:\Temp\i_fdxvqnigay.exe
    C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqkicav.exe ups_run
  2⤵
  PID:2760
- - C:\Temp\fdxvqkicav.exe
    C:\Temp\fdxvqkicav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqkicav.exe ups_ins
  2⤵
  PID:2508
- - C:\Temp\i_fdxvqkicav.exe
    C:\Temp\i_fdxvqkicav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkfcxvp.exe ups_run
  2⤵
  PID:3372
- - C:\Temp\ausmkfcxvp.exe
    C:\Temp\ausmkfcxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkfcxvp.exe ups_ins
  2⤵
  PID:5108
- - C:\Temp\i_ausmkfcxvp.exe
    C:\Temp\i_ausmkfcxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecwupnh.exe ups_run
  2⤵
  PID:1008
- - C:\Temp\smkecwupnh.exe
    C:\Temp\smkecwupnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecwupnh.exe ups_ins
  2⤵
  PID:1592
- - C:\Temp\i_smkecwupnh.exe
    C:\Temp\i_smkecwupnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmkec.exe ups_run
  2⤵
  PID:632
- - C:\Temp\jhbzurmkec.exe
    C:\Temp\jhbzurmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmkec.exe ups_ins
  2⤵
  PID:2984
- - C:\Temp\i_jhbzurmkec.exe
    C:\Temp\i_jhbzurmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezwrpjhb.exe ups_run
  2⤵
  PID:3864
- - C:\Temp\mhezwrpjhb.exe
    C:\Temp\mhezwrpjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezwrpjhb.exe ups_ins
  2⤵
  PID:4616
- - C:\Temp\i_mhezwrpjhb.exe
    C:\Temp\i_mhezwrpjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomgeywq.exe ups_run
  2⤵
  PID:4204
- - C:\Temp\bwtomgeywq.exe
    C:\Temp\bwtomgeywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtomgeywq.exe ups_ins
  2⤵
  PID:404
- - C:\Temp\i_bwtomgeywq.exe
    C:\Temp\i_bwtomgeywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeywqoigb.exe ups_run
  2⤵
  PID:1776
- - C:\Temp\lgeywqoigb.exe
    C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeywqoigb.exe ups_ins
  2⤵
  PID:60
- - C:\Temp\i_lgeywqoigb.exe
    C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3024

C:\Temp\eywrojhbzt.sys
C:\Temp\eywrojhbzt.sys
1⤵
- Executes dropped EXE
PID:3980

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:4548

C:\Temp\igaytqlidb.sys
C:\Temp\igaytqlidb.sys
1⤵
- Executes dropped EXE
PID:1708

C:\Temp\idavtnlfdx.sys
C:\Temp\idavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:1176

C:\Temp\ysnkfdxvpn.sys
C:\Temp\ysnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:2036

C:\Temp\kfcxvpnhfz.sys
C:\Temp\kfcxvpnhfz.sys
1⤵
- Executes dropped EXE
PID:3196

C:\Temp\zusmkecxup.sys
C:\Temp\zusmkecxup.sys
1⤵
- Executes dropped EXE
PID:3272

C:\Temp\urmkecwupm.sys
C:\Temp\urmkecwupm.sys
1⤵
- Executes dropped EXE
PID:3392

C:\Temp\ojhbztrlje.sys
C:\Temp\ojhbztrlje.sys
1⤵
- Executes dropped EXE
PID:2036

C:\Temp\dywqojgbyt.sys
C:\Temp\dywqojgbyt.sys
1⤵
- Executes dropped EXE
PID:3672

C:\Temp\wqoigaytql.sys
C:\Temp\wqoigaytql.sys
1⤵
PID:3984

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
PID:2024

C:\Temp\qkidavtnlf.sys
C:\Temp\qkidavtnlf.sys
1⤵
PID:4980

C:\Temp\kfaxspkica.sys
C:\Temp\kfaxspkica.sys
1⤵
PID:1504

C:\Temp\zxrpkhcaus.sys
C:\Temp\zxrpkhcaus.sys
1⤵
PID:2844

C:\Temp\cxupmhfzxr.sys
C:\Temp\cxupmhfzxr.sys
1⤵
PID:4212

C:\Temp\wrmjecwuom.sys
C:\Temp\wrmjecwuom.sys
1⤵
PID:2420

C:\Temp\jgbztrljeb.sys
C:\Temp\jgbztrljeb.sys
1⤵
PID:5008

C:\Temp\trljdbwtol.sys
C:\Temp\trljdbwtol.sys
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywrojhbzt.sys

Path C:\Temp\eywrojhbzt.sys
Size 141KB
SHA256 0bf4a64720ce498b5576f303e8bc4a0e9dbf9fe76defbfaa4aa4da2386949cb7
MD5 7b66bf32dcfa3cc66b42f0e9d8042e82
SHA1 d3de6891ad7675b4c47b73b70e56424a1e774495
SHA512 fbfb886550e12449deb1939291b14abcb06828846206ca5a18ac968e94d4718379bc33f877d87413e95dc4ebe1c9af4d731d1f8900a12abb103cfcea81bc40d8
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicavsnlfa.exe

Path C:\Temp\i_kicavsnlfa.exe
Size 226KB
SHA256 88d36076afd80f785d514aad212d245e471e9664235ea7f09b8b8c2442d68536
MD5 109353c8fa9023768db065c337f1ad9d
SHA1 db864f547943d01c47f86bcd6c2eae537c014b8e
SHA512 2650b91be45298c13ddfe9a3fb36d693875368f3e030b705068cb0ff97f12c0ee95026f778e55eea66f3f3ab982429475b1fee611dd7d49877e8afad182f7023
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T16734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdywqoiga.exe

Path C:\Temp\i_lgdywqoiga.exe
Size 226KB
SHA256 3472beac865cb9011bb963ae83032cc678ed31faa088e64f27843a05a408692e
MD5 fa80a434ef3b280040dfbe98cbc78ef9
SHA1 972e09942b12cbcb109e704c9b4c892d1942a895
SHA512 5dac4cf2c303115e78612b2551a6953c77e72052cd64f7a6ee20d63013e2425b2274b95e1e91ee195ebe8e14c9ae92e271ea8ee9c16b58471708feb4e73193e8
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T11034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnifaxsqki.exe

Path C:\Temp\i_pnifaxsqki.exe
Size 226KB
SHA256 a58f48890efa21c9ba378d1ab628439568b626347df9c8a3495723a2f5199f37
MD5 2e0b62abca7e14ddde0cd9dd32bb8426
SHA1 015a319a58fa2538f0496e4ff16db878256f7ccf
SHA512 55f95c05edf242a39dc6695124980d435d141ccc716d13aad8a19643ac290f7003b6083f3c40cc7894934936a5ab22df390a27384c2fffd4fea8bf29fd85f5d7
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T1A734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgeywqoj.exe

Path C:\Temp\i_tomgeywqoj.exe
Size 226KB
SHA256 8c09ed37a93199d6ce7c48b5e43d6a578f3ed36312a8ce931f544c2dca6d075a
MD5 daee1b5c72eb644259dae9f797149c23
SHA1 d20fb885935f2ff0cab675a033c534e683c9e640
SHA512 3d61cb73876c11561410ab95765d3eebd927cfd8bdf9e1fca35cb3cda90b6466cfd49ccb77ed4b9bae33eedd7d087338d502f310274396840509d22a57b66f5d
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T15734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojhbztrl.exe

Path C:\Temp\i_wrojhbztrl.exe
Size 226KB
SHA256 c2aa304a86b2802f34e4ed9ea8150a812626822243d2a906c9481c24b32621b9
MD5 33122fd4daed03983596941370e9a45e
SHA1 032bc29954cdba3ed8367729f1ec9ac447860bf0
SHA512 7b416b3f54157e20d57b18d802eea64289563ad1469f9d2210f2766195e85e1ec0d1da6be4ca90215e684d84c0d7671c7d366fcf6735d621d7f27c227985422f
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T18634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqnigaytq.exe

Path C:\Temp\i_yvqnigaytq.exe
Size 226KB
SHA256 c0b1a34c7f0cd94771771ffc589323b78c848e691e32fea2ec6697532b55bb34
MD5 d542a89e9a4c8d696d951ad7e3066778
SHA1 f4c6e431cfc09ef09071a4cc570b35ce4681ffea
SHA512 619ede5f7b4b54199f5b21eb3ae423ad07c44c53c9eee2282c188ac179ebd54d8f50841cbc43be79959eef3685a17e6265a217923a60df12955c229a3ba92ec9
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T12734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpkhcaus.exe

Path C:\Temp\i_zxrpkhcaus.exe
Size 226KB
SHA256 47e3e2b260a90ede7d03fb420ff738b3b7f83047d25a7dedabd2a4d05324fb56
MD5 52def949c85c6585c3dcb10fb2a74f4e
SHA1 181d86d53766ac2c69acf0d55f2ae17cb785a367
SHA512 a220bc9bd153983e5f1a7db9b38e5139f7a15e4135eefdf861f6c139ccba9a8fe1c1f80407db7798e460acf7bfe6fa74bce803c422fe0ce548e862cb4e678fc9
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T14834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfdx.sys

Path C:\Temp\idavtnlfdx.sys
Size 141KB
SHA256 5c686c9542aabd0b76977cf145974322028db355a0953dabd25f81ace0fda5c0
MD5 925fabee5278cf680f9c322d5605cdd3
SHA1 8dc7180b15e5c426e26eaf04d8916b192f6908e4
SHA512 9ce6c2ed7bb8d342a638e1eab7fb45f6f8bd4f82efde161477c433434a4d38d81a918e98d875aa34cf1abcbcd4a6e08c5c12f15d9ee1c4ddc66de90539895076
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltg:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaytqlidb.sys

Path C:\Temp\igaytqlidb.sys
Size 141KB
SHA256 ddde32f7972f9d117709856a185b9427fa48e2c265b89414e054c88909f1b2fa
MD5 682ee9805348201b762951c2f1d19167
SHA1 f9035edc8cefc47d4cdc8ee1d5c6e5d9310b60d6
SHA512 7d9d9d3deb23d7d58d26d0fe57794752034aabc77364f4b43080a0515e90f6f54120a0a58f6b13a9e0fabaac53f94764f2fa7a35640ed43ad81eaf0eff1a34ec
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T101E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfz.sys

Path C:\Temp\kfcxvpnhfz.sys
Size 141KB
SHA256 920c1643a4e63db8a007528bab05fa9397f3f3c7aaccf7c6c414ea9ff177c391
MD5 b544b78ff5350a7ee77104604eb53343
SHA1 33e7a07a7700dadf8b3f618071168eb42a6ca622
SHA512 072fe7a29fce996f4d8c3a447319f9de6677d463f06a49a164402595e3aab128b3ec08d3411fe8bb85a346ded8723b15b193b4bbf9d2b94feef0185c1424fdfe
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicavsnlfa.exe

Path C:\Temp\kicavsnlfa.exe
Size 226KB
SHA256 21d84a9b22940cac3e259632b2c161fa4ab60799833746a8633ca64a39461ef6
MD5 5750bef39234f2eab17274a75a4263a5
SHA1 4d722d5f8625b7628527cbcc1a325b1f5f782e56
SHA512 4f3821536c3cae4b22b3b9cf22d81fb276e99cd0992ea10085fb5c9c1c7e13fc3f5adfb20b5957bd457060816a035619d0157a8b65384223e8e85cd33a8692a3
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T1A434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqoiga.exe

Path C:\Temp\lgdywqoiga.exe
Size 226KB
SHA256 07d676dbfa92bb34f008ef7d05909459959142cc68d329b4c92bc20465311065
MD5 43a1d8e788622d6a130d3f3218117933
SHA1 8061af21e4e4b71a56a7ae8366bcd2b78072afb5
SHA512 b1b85eb36a1bee3eea43fe8a68057301a2a40fd4f3a0d887a4bb6075527f92d62cb02069d924c66b1ee4a3b2704f97533b426ea5f9f5b18a11276e7b4ed0bbfb
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T17634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.exe

Path C:\Temp\pmhfzxrpjh.exe
Size 226KB
SHA256 1c1c17f29969da040f52490cc220b0d445da888316a26016c3b929d34c178b2a
MD5 a8babdb7f6b27dc8c5ebc436cd939635
SHA1 32a70f9a673afb9359cf4908a5edfc99ce708544
SHA512 dabfe25d58cf887eb6e59bff7045c3abe55990de7572f226b00ee8d2050fcb7c2854b4db131d6cd74dcf95db3f260f6495f55faadeec94f07963dd1b1e30ca40
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T19934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnifaxsqki.exe

Path C:\Temp\pnifaxsqki.exe
Size 226KB
SHA256 1710bb714ce2a77738a20d960c727c671dda072beda893e7a2b90e274455a330
MD5 6b441c824c301a87714c2e07e793a3b8
SHA1 177461553e0cbdf2e14a46da3cae53fc5777a42b
SHA512 cfc8177e62ddce53a6c5c3fa425e99022ce95477d1476cc16e7ed9d4bca73416dc23779533feb0382902b6d827c444367a85727633bd7158855e74ff0ecde222
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T11F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywqoj.exe

Path C:\Temp\tomgeywqoj.exe
Size 226KB
SHA256 c09cd0c664fd9b473fdef2a61cbfc3256f389c9690c1b8a423c16cd3e2e5b657
MD5 5a2f0312cfb9c10914ca815e99986f97
SHA1 aa3917bd033ab4c8013902170e2d348c59de8fa0
SHA512 b45f12928c9f727c2dd32a164180d30aad01abe18bfeb034b933c92054d6defc7ace95bfb0f7ef0e40b9e620e3363980a64d548cf0af87c3af8d1cc51811b3ee
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T1F234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.sys

Path C:\Temp\trljdbvtol.sys
Size 141KB
SHA256 4e3663a032468e8c89c2b2e53b22ab90b6abdcb3a1b4675ac61cd5f1aeebab1c
MD5 8c0cc83276cd78133998c6337ede4ac0
SHA1 235a88041e58440bdbeb80849e979556bc6ccb66
SHA512 1518fb3343cd794669a8b948bb9e4e1786a41f76b37d497ecef8209b40fb12555584c26998208334b4752007b992da6c5800655dfad7fd481400d2323412c344
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BCE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbztrl.exe

Path C:\Temp\wrojhbztrl.exe
Size 226KB
SHA256 7576f9c511de9055f55284c87959a66a924581a15e46d60d7ae019b576efdc33
MD5 081b1f0eb1520719db5efcb550250c73
SHA1 7fafbe37623885c2bdb81b9fd17221744635f2cd
SHA512 53753080ef49534cbcb3577b2b668448e3a34c96b300249759f38959faf14b337378de6524ae43ca15f7cc11d4701c169c63b27ff049c5bee45af1c80784913b
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T19834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysnkfdxvpn.sys

Path C:\Temp\ysnkfdxvpn.sys
Size 141KB
SHA256 beb7d32ae80b465ec626e71ad21b00627b64aa8631036fdb20ac2c5a858385d3
MD5 06477a3ef72d0529465d69ea08627ddc
SHA1 99cf651dc096d7cf061d6ac1e78b92cca650784b
SHA512 f97806e171e0fa0bf83f33a36dd959afc5918d2f9372d75e119ba302eaa012338aa70aed4a733b6719aebc96308e8f2a487e22618b051b375db805cb0bc723d1
SSDEEP 1536:1a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:1a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnigaytq.exe

Path C:\Temp\yvqnigaytq.exe
Size 226KB
SHA256 87807a48114e0b4e42267980845866578de2e9b932809e1e2233b95847fcb5c9
MD5 5ccb32beabc4b6f7499b7d79a03219d4
SHA1 2f839d331b45f4d62de8f212d7a45ee92d6bc9ff
SHA512 76d32f752fdec06cbc4bc4bae77ee544734055e4d3f62c1cf0775a5b792f5ec6020e30b67edf5b25e97da3432980dc05020a7be6ddfd042c777b932255548b88
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T17A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkecxup.sys

Path C:\Temp\zusmkecxup.sys
Size 141KB
SHA256 0fdf345caab15dfc204b385a71be2cc2b7d6f53aae51c8fab707368df85a2eba
MD5 04ca412ba2be24a24bbb3df17c082ad9
SHA1 b7bfca0755f81c9121a40a9a95323de20dec9019
SHA512 83993489dbbda331ca294ee3a99628283f33dd0f6184be5f1fafd279650f16b7272b062b3ad336ec132d7d7eee3ef28258c041bda59a3483158eca542620f063
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhcaus.exe

Path C:\Temp\zxrpkhcaus.exe
Size 226KB
SHA256 d352f4feb749bb9b96009a9b5bb267b37b466ff146dd986f2e13171c191921e0
MD5 ca0603edc1713a8d7b7a88ce07e82429
SHA1 2259862028c7f1c36bb29da349f6295fcbdbc7ff
SHA512 b9eb0b2585469ffb9a2a09065588a094ba097f83a2b5a38d5d3749b271e33f72c9612be04e3462a47285ca5f7676c465a0d9cd921838254076d6e3e217686e4c
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T1EF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8A7891822FCFF127E4EADADE9757112B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B
Size 2KB
SHA256 2b70242a91a4b14da60c7ae9a33e7bf6059e910069fd6b6a0198f815fdf33aa3
MD5 88ad9e714df72c005c680d8c08b7ef18
SHA1 bd4a2d0bcc88ec9a2acfae109ba81d8f4cbbb928
SHA512 42a12c068e6295e34d1c3981f030179dcf76a504da067238a7349d8fba0ab5bccf878488086b53425755572b2c3efdba28abd74775e55bb9be01f6bd6edccae3
TLSH
T1E841532D1E8834A3B04A2E34E9CAAD838CF1956217D0D48ED1144A461571FCE9FCF4F3
MD5 SHA1 SHA512 TLSH

Submit Download

8A7891822FCFF127E4EADADE9757112B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B
Size 246B
SHA256 04b0335e5f861e288dc0823ba1b88ef37c0c992caf60539787052a3efd648488
MD5 f9ea6011a3b021192e0d707b6e0828af
SHA1 87fa8426dc78f8bcfc462e5cd2ad6c1006965f9b
SHA512 c45c588fbb531440207d6fd8d3329ff8cf7c0c4206dfffb1873d8849d40ddffeede13be870ad25536e722f23c32f71898450585eded6dba0209abaf0292ebc53
TLSH
T196D01230DFB9630BF8FA127AADA811C1BB24AF15B003CF044AB5120C0868F801960B2F
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D6NN03DP\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1176-50-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1504-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1708-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2024-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2036-109-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2036-64-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2420-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2844-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3196-84-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3272-96-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3392-105-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3672-113-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3980-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3984-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4212-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4548-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4980-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5008-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads