41e302eb26504b1258d37fc9157db102061db0e4e37b9ec5df064ed113cf8a4a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260910-agjgjaeb87
SHA256 41e302eb26504b1258d37fc9157db102061db0e4e37b9ec5df064ed113cf8a4a
MD5 110d2647806c746a65932f17e27973e0
SHA1 e8a0e60aa19c1bfc14e53c6cd7305c350d4f7135
SHA512 1740f442e0d700940e86d7978b9539c5a7f2108966d96787e46a01e0c42456586e592c37d6ea638829bfea3c92cc26a29f44616d8d244755a81531c9f0096c19
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T14834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1656	CP.exe
4224	hcwuojhbzu.exe
5160	CP.exe
2676	CP.exe
5560	i_hcwuojhbzu.exe
5132	mhbztrljeb.sys
384	CP.exe
924	bwuomgezwr.exe
4936	CP.exe
4388	CP.exe
5316	i_bwuomgezwr.exe
1376	eywrojgbzt.sys
1644	CP.exe
5148	ljdbvtolge.exe
1800	CP.exe
5848	CP.exe
1604	i_ljdbvtolge.exe
5028	olgeywqoig.sys
5024	CP.exe
5604	gbvtnigbyt.exe
5776	CP.exe
3228	CP.exe
5036	i_gbvtnigbyt.exe
5752	dyvqoigays.sys
3672	CP.exe
364	sqlidavtnl.exe
5692	CP.exe
1984	CP.exe
3396	i_sqlidavtnl.exe
6124	qkicavsnlf.sys
1088	CP.exe
3200	fdxvpnifax.exe
3416	CP.exe
4164	CP.exe
3780	i_fdxvpnifax.exe
1036	qkicavsnkf.sys
5404	CP.exe
5472	xvpnhfzxsp.exe
5532	CP.exe
4784	CP.exe
4652	i_xvpnhfzxsp.exe
1404	causmkfcxu.sys
1612	CP.exe
1184	vpnhfzxsph.exe
2084	CP.exe
3828	CP.exe
1424	i_vpnhfzxsph.exe
4148	pjhczusmke.sys
1900	CP.exe
4052	ezxrpjhbzu.exe
4092	CP.exe
2456	CP.exe
4088	i_ezxrpjhbzu.exe
1920	hezxrpjhbz.sys
2672	CP.exe
5920	zuomgezwrp.exe
5340	CP.exe
4428	CP.exe
3056	i_zuomgezwrp.exe
644	ezwrpjhbzt.sys
4140	CP.exe
1528	ljebwtomge.exe
2480	CP.exe
3308	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcwuojhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxsph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxsph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoigav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfcxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfcxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcwuojhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbvtnigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbvtnigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausn.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1968	ipconfig.exe
2472	ipconfig.exe
5188	ipconfig.exe
6096	ipconfig.exe
2348	ipconfig.exe
5896	ipconfig.exe
860	ipconfig.exe
5260	ipconfig.exe
1612	ipconfig.exe
5784	ipconfig.exe
4616	ipconfig.exe
4032	ipconfig.exe
5956	ipconfig.exe
2292	ipconfig.exe
6104	ipconfig.exe
2456	ipconfig.exe
2508	ipconfig.exe
3500	ipconfig.exe
5164	ipconfig.exe
988	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e23ed4c8d5593c429dc5a7164309ec3700000000020000000000106600000001000020000000d74c436cc69a6425b868c610b4ff67c49163a0fe7f166e13d70f22fb1daff02c000000000e80000000020000200000008841e4345cc5abc573ce864f87e2441ed34aeae828e33c7a5020f1d7cad61c70200000005a95e636314621576ddfdf87ebd40195dc23fb7e8a4f6d8e72843475985983e240000000d45b00e99055d6d2a96a075a7f0e13129fa7f715d0dee3ce25896f0c0ec3465fedce25b24bf919d3d948d97348b1317e4a8ecd3f79be6330f11530363ef63db8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409bd04fc140dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "495764033"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3991437177"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e23ed4c8d5593c429dc5a7164309ec3700000000020000000000106600000001000020000000c95fbee5fc8ab2c241d0bac5855aefb9c02a2d11ae5ae451fcfc5d4c11b0bb81000000000e8000000002000020000000e81345a360ae177e5c7d2c5a39a0c08e1b42b7415d0c20c928d158dd76e7d4f22000000003e81da59eb0f2f1c41362d2872af0892780b4299e046dc15c12cbf7def1368840000000b902fe684d7326fcd0b69094669dfcf130fc8d55d3540d09404cc3b657753210fd5071bee028f15047bc5cb4a8c603a31fe0b139f13997041c51a8dcabe8ee02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{18AAC2D2-ACAC-11F1-92B0-EEAAB15450A7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31277240"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4268938083"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31277240"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c7d74fc140dd01	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5560	i_hcwuojhbzu.exe
Token: SeDebugPrivilege	5316	i_bwuomgezwr.exe
Token: SeDebugPrivilege	1604	i_ljdbvtolge.exe
Token: SeDebugPrivilege	5036	i_gbvtnigbyt.exe
Token: SeDebugPrivilege	3396	i_sqlidavtnl.exe
Token: SeDebugPrivilege	3780	i_fdxvpnifax.exe
Token: SeDebugPrivilege	4652	i_xvpnhfzxsp.exe
Token: SeDebugPrivilege	1424	i_vpnhfzxsph.exe
Token: SeDebugPrivilege	4088	i_ezxrpjhbzu.exe
Token: SeDebugPrivilege	3056	i_zuomgezwrp.exe
Token: SeDebugPrivilege	5208	i_ljebwtomge.exe
Token: SeDebugPrivilege	4116	i_rljdbwtolg.exe
Token: SeDebugPrivilege	624	i_gdyvqoigav.exe
Token: SeDebugPrivilege	5228	i_aysqkicavs.exe
Token: SeDebugPrivilege	4576	i_xspkicausn.exe
Token: SeDebugPrivilege	1896	i_ausnkfcxsm.exe
Token: SeDebugPrivilege	3272	i_rpjhczusmk.exe
Token: SeDebugPrivilege	1420	i_pjhbztrmje.exe
Token: SeDebugPrivilege	5872	i_gbztrljdbw.exe
Token: SeDebugPrivilege	5436	i_mgeywqojgb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4420	iexplore.exe
4420	iexplore.exe
6000	IEXPLORE.EXE
6000	IEXPLORE.EXE
6000	IEXPLORE.EXE
6000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4420	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	85
PID 4420 wrote to memory of 6000	4420	iexplore.exe	86
PID 4780 wrote to memory of 1656	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 4224 wrote to memory of 5160	4224	hcwuojhbzu.exe	90
PID 4780 wrote to memory of 2676	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	93
PID 4780 wrote to memory of 384	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	99
PID 924 wrote to memory of 4936	924	bwuomgezwr.exe	101
PID 4780 wrote to memory of 4388	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 4780 wrote to memory of 1644	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	108
PID 5148 wrote to memory of 1800	5148	ljdbvtolge.exe	110
PID 4780 wrote to memory of 5848	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	113
PID 4780 wrote to memory of 5024	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 5604 wrote to memory of 5776	5604	gbvtnigbyt.exe	119
PID 4780 wrote to memory of 3228	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 4780 wrote to memory of 3672	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 364 wrote to memory of 5692	364	sqlidavtnl.exe	131
PID 4780 wrote to memory of 1984	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 4780 wrote to memory of 1088	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 3200 wrote to memory of 3416	3200	fdxvpnifax.exe	140
PID 4780 wrote to memory of 4164	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 4780 wrote to memory of 5404	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 5472 wrote to memory of 5532	5472	xvpnhfzxsp.exe	152
PID 4780 wrote to memory of 4784	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 4780 wrote to memory of 1612	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 1184 wrote to memory of 2084	1184	vpnhfzxsph.exe	165
PID 4780 wrote to memory of 3828	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 4780 wrote to memory of 1900	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 4052 wrote to memory of 4092	4052	ezxrpjhbzu.exe	174
PID 4780 wrote to memory of 2456	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 4780 wrote to memory of 2672	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 5920 wrote to memory of 5340	5920	zuomgezwrp.exe	183
PID 4780 wrote to memory of 4428	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	186
PID 4780 wrote to memory of 4140	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 1528 wrote to memory of 2480	1528	ljebwtomge.exe	192
PID 4780 wrote to memory of 3308	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	195
PID 4780 wrote to memory of 2408	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	199
PID 888 wrote to memory of 4624	888	rljdbwtolg.exe	201
PID 4780 wrote to memory of 4680	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	204
PID 4780 wrote to memory of 6140	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	209
PID 6008 wrote to memory of 3644	6008	gdyvqoigav.exe	211
PID 4780 wrote to memory of 988	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	214
PID 4780 wrote to memory of 4940	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	218
PID 2280 wrote to memory of 2068	2280	aysqkicavs.exe	220
PID 4780 wrote to memory of 4196	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	223
PID 4780 wrote to memory of 4136	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	227
PID 3632 wrote to memory of 4596	3632	xspkicausn.exe	229
PID 4780 wrote to memory of 5416	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	232
PID 4780 wrote to memory of 5544	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	236
PID 1824 wrote to memory of 2020	1824	ausnkfcxsm.exe	238
PID 4780 wrote to memory of 5996	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	241
PID 4780 wrote to memory of 5244	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	245
PID 2840 wrote to memory of 2844	2840	rpjhczusmk.exe	247
PID 4780 wrote to memory of 6088	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	250
PID 4780 wrote to memory of 3628	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	254
PID 3108 wrote to memory of 1376	3108	pjhbztrmje.exe	256
PID 4780 wrote to memory of 1192	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	259
PID 4780 wrote to memory of 2904	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	263
PID 4156 wrote to memory of 5916	4156	gbztrljdbw.exe	265
PID 4780 wrote to memory of 5360	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	268
PID 4780 wrote to memory of 1712	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	272
PID 1708 wrote to memory of 5832	1708	mgeywqojgb.exe	274
PID 4780 wrote to memory of 180	4780	2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe	277

C:\Users\Admin\AppData\Local\Temp\2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_110d2647806c746a65932f17e27973e0_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4420 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:6000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcwuojhbzu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1656
- - C:\Temp\hcwuojhbzu.exe
    C:\Temp\hcwuojhbzu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcwuojhbzu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2676
- - C:\Temp\i_hcwuojhbzu.exe
    C:\Temp\i_hcwuojhbzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomgezwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:384
- - C:\Temp\bwuomgezwr.exe
    C:\Temp\bwuomgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomgezwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4388
- - C:\Temp\i_bwuomgezwr.exe
    C:\Temp\i_bwuomgezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtolge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1644
- - C:\Temp\ljdbvtolge.exe
    C:\Temp\ljdbvtolge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtolge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5848
- - C:\Temp\i_ljdbvtolge.exe
    C:\Temp\i_ljdbvtolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbvtnigbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5024
- - C:\Temp\gbvtnigbyt.exe
    C:\Temp\gbvtnigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbvtnigbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3228
- - C:\Temp\i_gbvtnigbyt.exe
    C:\Temp\i_gbvtnigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlidavtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3672
- - C:\Temp\sqlidavtnl.exe
    C:\Temp\sqlidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlidavtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1984
- - C:\Temp\i_sqlidavtnl.exe
    C:\Temp\i_sqlidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1088
- - C:\Temp\fdxvpnifax.exe
    C:\Temp\fdxvpnifax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4164
- - C:\Temp\i_fdxvpnifax.exe
    C:\Temp\i_fdxvpnifax.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfzxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5404
- - C:\Temp\xvpnhfzxsp.exe
    C:\Temp\xvpnhfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4784
- - C:\Temp\i_xvpnhfzxsp.exe
    C:\Temp\i_xvpnhfzxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfzxsph.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1612
- - C:\Temp\vpnhfzxsph.exe
    C:\Temp\vpnhfzxsph.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfzxsph.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3828
- - C:\Temp\i_vpnhfzxsph.exe
    C:\Temp\i_vpnhfzxsph.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhbzu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1900
- - C:\Temp\ezxrpjhbzu.exe
    C:\Temp\ezxrpjhbzu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2456
- - C:\Temp\i_ezxrpjhbzu.exe
    C:\Temp\i_ezxrpjhbzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zuomgezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2672
- - C:\Temp\zuomgezwrp.exe
    C:\Temp\zuomgezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zuomgezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4428
- - C:\Temp\i_zuomgezwrp.exe
    C:\Temp\i_zuomgezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebwtomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4140
- - C:\Temp\ljebwtomge.exe
    C:\Temp\ljebwtomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebwtomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3308
- - C:\Temp\i_ljebwtomge.exe
    C:\Temp\i_ljebwtomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbwtolg.exe ups_run
  2⤵
  PID:2408
- - C:\Temp\rljdbwtolg.exe
    C:\Temp\rljdbwtolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbwtolg.exe ups_ins
  2⤵
  PID:4680
- - C:\Temp\i_rljdbwtolg.exe
    C:\Temp\i_rljdbwtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdyvqoigav.exe ups_run
  2⤵
  PID:6140
- - C:\Temp\gdyvqoigav.exe
    C:\Temp\gdyvqoigav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdyvqoigav.exe ups_ins
  2⤵
  PID:988
- - C:\Temp\i_gdyvqoigav.exe
    C:\Temp\i_gdyvqoigav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkicavs.exe ups_run
  2⤵
  PID:4940
- - C:\Temp\aysqkicavs.exe
    C:\Temp\aysqkicavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkicavs.exe ups_ins
  2⤵
  PID:4196
- - C:\Temp\i_aysqkicavs.exe
    C:\Temp\i_aysqkicavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicausn.exe ups_run
  2⤵
  PID:4136
- - C:\Temp\xspkicausn.exe
    C:\Temp\xspkicausn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicausn.exe ups_ins
  2⤵
  PID:5416
- - C:\Temp\i_xspkicausn.exe
    C:\Temp\i_xspkicausn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfcxsm.exe ups_run
  2⤵
  PID:5544
- - C:\Temp\ausnkfcxsm.exe
    C:\Temp\ausnkfcxsm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfcxsm.exe ups_ins
  2⤵
  PID:5996
- - C:\Temp\i_ausnkfcxsm.exe
    C:\Temp\i_ausnkfcxsm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczusmk.exe ups_run
  2⤵
  PID:5244
- - C:\Temp\rpjhczusmk.exe
    C:\Temp\rpjhczusmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczusmk.exe ups_ins
  2⤵
  PID:6088
- - C:\Temp\i_rpjhczusmk.exe
    C:\Temp\i_rpjhczusmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbztrmje.exe ups_run
  2⤵
  PID:3628
- - C:\Temp\pjhbztrmje.exe
    C:\Temp\pjhbztrmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbztrmje.exe ups_ins
  2⤵
  PID:1192
- - C:\Temp\i_pjhbztrmje.exe
    C:\Temp\i_pjhbztrmje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run
  2⤵
  PID:2904
- - C:\Temp\gbztrljdbw.exe
    C:\Temp\gbztrljdbw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins
  2⤵
  PID:5360
- - C:\Temp\i_gbztrljdbw.exe
    C:\Temp\i_gbztrljdbw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run
  2⤵
  PID:1712
- - C:\Temp\mgeywqojgb.exe
    C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins
  2⤵
  PID:180
- - C:\Temp\i_mgeywqojgb.exe
    C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5436

C:\Temp\mhbztrljeb.sys
C:\Temp\mhbztrljeb.sys
1⤵
- Executes dropped EXE
PID:5132

C:\Temp\eywrojgbzt.sys
C:\Temp\eywrojgbzt.sys
1⤵
- Executes dropped EXE
PID:1376

C:\Temp\olgeywqoig.sys
C:\Temp\olgeywqoig.sys
1⤵
- Executes dropped EXE
PID:5028

C:\Temp\dyvqoigays.sys
C:\Temp\dyvqoigays.sys
1⤵
- Executes dropped EXE
PID:5752

C:\Temp\qkicavsnlf.sys
C:\Temp\qkicavsnlf.sys
1⤵
- Executes dropped EXE
PID:6124

C:\Temp\qkicavsnkf.sys
C:\Temp\qkicavsnkf.sys
1⤵
- Executes dropped EXE
PID:1036

C:\Temp\causmkfcxu.sys
C:\Temp\causmkfcxu.sys
1⤵
- Executes dropped EXE
PID:1404

C:\Temp\pjhczusmke.sys
C:\Temp\pjhczusmke.sys
1⤵
- Executes dropped EXE
PID:4148

C:\Temp\hezxrpjhbz.sys
C:\Temp\hezxrpjhbz.sys
1⤵
- Executes dropped EXE
PID:1920

C:\Temp\ezwrpjhbzt.sys
C:\Temp\ezwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:644

C:\Temp\ywqojgbztr.sys
C:\Temp\ywqojgbztr.sys
1⤵
PID:4380

C:\Temp\qljdbvtnlg.sys
C:\Temp\qljdbvtnlg.sys
1⤵
PID:2812

C:\Temp\lfdxvqniga.sys
C:\Temp\lfdxvqniga.sys
1⤵
PID:5112

C:\Temp\qlfdxvpnif.sys
C:\Temp\qlfdxvpnif.sys
1⤵
PID:5992

C:\Temp\hfaxsqkica.sys
C:\Temp\hfaxsqkica.sys
1⤵
PID:1100

C:\Temp\cxupmhfzxr.sys
C:\Temp\cxupmhfzxr.sys
1⤵
PID:4608

C:\Temp\huomhezxrp.sys
C:\Temp\huomhezxrp.sys
1⤵
PID:1204

C:\Temp\wuomgezwrp.sys
C:\Temp\wuomgezwrp.sys
1⤵
PID:5420

C:\Temp\trljebwtom.sys
C:\Temp\trljebwtom.sys
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomgezwr.exe

Path C:\Temp\bwuomgezwr.exe
Size 226KB
SHA256 931da303c80fa31190657fdedc95e291dade083abfbd3ed7418a3e554edffeff
MD5 45648102c73c87342fa4bd045b282417
SHA1 4a6055695dc9a373c24c232291ec9cfc606955ec
SHA512 7249a164d4f87bc2300426a68740be38c2c8fa5d4fc3e1729f0c199f7dc2869141df3bba1832da518fabcc0a7ffebf9c4cdf8122a37f9356a02719a9254eb437
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T1D034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkfcxu.sys

Path C:\Temp\causmkfcxu.sys
Size 141KB
SHA256 9993586f41149578c78ed64db0f10e5eadbd616dec76928a40857658a70bcd21
MD5 4667ab85d109405444132a564ba31677
SHA1 40d0f6e957b88284f0414654002d1d5876fa90ed
SHA512 4de95eea2e7014f51dfb51fa77ae5d657e18b2dbbac71cbcc6eed5672c8677e1baf80319231d3c1475c3bbe62ca4334dd51a7ab25d8454d731ee547d3d2a9873
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CEE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigays.sys

Path C:\Temp\dyvqoigays.sys
Size 141KB
SHA256 1d4d56bb6151b3d94d9a8cde54cb6d77c7707ffb099e04aae8874d8ec21d5ed9
MD5 9d831c1d8914d999dd364373bce6d348
SHA1 219929fb03e3bd5e497ea7fa7e859966444efa3c
SHA512 194fbcce29574d153ab86026106aa4b59146dd849520a158e8358199942bea6301ff3bf40f3ab69273a37159e286357e83deb532dfef663d92efe0af632d7bb3
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T103E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywrojgbzt.sys

Path C:\Temp\eywrojgbzt.sys
Size 141KB
SHA256 8ed432565b1b181c2f03b750fca6fa8893af85f121be57219d6f26b9945fb7ee
MD5 c379e1f366abe96fa04a9b7aa8552fb2
SHA1 fba8b41d379200f6b56ce871650e71577b9bbe97
SHA512 1619714751210eb775a622f089ac83267b37fc509a0115d01652e8b3df4cb7e34ce2f7b3c4e14d7c8fb17f12c6f986d5e15a13be468716b242f8e9b27feb01fc
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifax.exe

Path C:\Temp\fdxvpnifax.exe
Size 226KB
SHA256 a58f48890efa21c9ba378d1ab628439568b626347df9c8a3495723a2f5199f37
MD5 2e0b62abca7e14ddde0cd9dd32bb8426
SHA1 015a319a58fa2538f0496e4ff16db878256f7ccf
SHA512 55f95c05edf242a39dc6695124980d435d141ccc716d13aad8a19643ac290f7003b6083f3c40cc7894934936a5ab22df390a27384c2fffd4fea8bf29fd85f5d7
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T1A734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbvtnigbyt.exe

Path C:\Temp\gbvtnigbyt.exe
Size 226KB
SHA256 3472beac865cb9011bb963ae83032cc678ed31faa088e64f27843a05a408692e
MD5 fa80a434ef3b280040dfbe98cbc78ef9
SHA1 972e09942b12cbcb109e704c9b4c892d1942a895
SHA512 5dac4cf2c303115e78612b2551a6953c77e72052cd64f7a6ee20d63013e2425b2274b95e1e91ee195ebe8e14c9ae92e271ea8ee9c16b58471708feb4e73193e8
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T11034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcwuojhbzu.exe

Path C:\Temp\hcwuojhbzu.exe
Size 226KB
SHA256 bfee1bb46d3b1639b67080cf86304a7a1f4a7f828f431abd9c660cd492e010bb
MD5 06ce67a78ad3a9bbadf88c4436ae10d9
SHA1 abb38fa19b0bc04d13e41cb57a8abb9cd146a8ca
SHA512 4f2d12ea2254c6ab752c5c2796165385cb0a12f727add04378765416b6b98d98e5f97b7a242fe46fa0a3b5e9e68d39dd243b04aca5faacc36b0296b92bf0b6df
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T1AC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwuomgezwr.exe

Path C:\Temp\i_bwuomgezwr.exe
Size 226KB
SHA256 0d891e66f14493191160a1df23c1d488246815fabc7f78275994f0422b9caf6d
MD5 4b7ab008e31694ed7940ae6ff2b62a1d
SHA1 b84f56395206d200b7beb48d527fcf4c9537a6df
SHA512 4d1b35e3403ba61c3641adad23d8fb6e893ce928557e542c3d572692e361f7741bba8a09ef211356890a46b26666a77b07af01a04600b9ee729dc2a72d5af070
SSDEEP 3072:fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:+XY4LK+a3lLNngoqRttA7
TLSH
T11A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvpnifax.exe

Path C:\Temp\i_fdxvpnifax.exe
Size 226KB
SHA256 b94b2e38615060ba87b1648ec5ac3baa14f2f469caeb0c82682da1fb67fe41c2
MD5 f92308301b91cd3ecb3830294228e310
SHA1 17f2788a8a147714fb17db7e2c57b4690ce94305
SHA512 274b0e654efffd7e90b537da20cd076c2248497a7e4558a2dc9e0012a06690c4d231c626f646b2848632e29321aded792b27a17c1a489c6092b1fdf54483aeef
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T13634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbvtnigbyt.exe

Path C:\Temp\i_gbvtnigbyt.exe
Size 226KB
SHA256 865f2f33b314d2bf8a2a8afc0bfac68a1ef94ab950d8f568093423b2bb005eef
MD5 837a98764ff726da9f67aa28b0104083
SHA1 3d44d6d15862a7fb9baa7626c5c0d765d8e33e1e
SHA512 f74519d8df5102b7cc2b974116c0a07dae76780720bcc0c8051acfa354175e19d939ae6ca093661a2f5c032cf42f1d783312f2706af7c1a21bfe8edeed10e996
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T12934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcwuojhbzu.exe

Path C:\Temp\i_hcwuojhbzu.exe
Size 226KB
SHA256 d4372b96a282f6a4a6df729766eb2f1ce779833c2391f25c493a83799dcf4d02
MD5 f058155b6a8e1ce1fe8986497e782167
SHA1 0ee3eeaea2ae7adab4b7ce4113b8f5399c1e63f4
SHA512 8a5eaf6ac3b9b9bf5fd459ed321567a63944f8ed7a64bea009e50efff1fe52ddae6d1bc57d06432c0b39265c8d63332cf42bd41fdfbd1362e6a8735cc358dd4b
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T1AC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtolge.exe

Path C:\Temp\i_ljdbvtolge.exe
Size 226KB
SHA256 ea6b83145cb47c0ca43849add415c4c01b7af28234c8fc1142600ba155e06fe4
MD5 cd70f50b55d2ff9ac3270404386cbab6
SHA1 fa3fb5beced07f6fec5db48c0d997a5fd1b54766
SHA512 d5034c62e2114507499264c5fa4e995129034f664a968f55020dd5749d21a42b53de1337e6b2ba5d4ad8657b1a349dfcc8512eaa1365575de4b58a7d765e0aaf
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T10534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqlidavtnl.exe

Path C:\Temp\i_sqlidavtnl.exe
Size 226KB
SHA256 e35a642f35df0c78d4682054b5bbed1e605d072796b15391ebe924c403ad456e
MD5 b17fa0ea576b0ad40110003e6d34f923
SHA1 697f0d133eb4cb211d0c8ea41c59a05b9f155ad6
SHA512 c8e6befaa593b6b9aa43995e8c01c4cc19721389dd6f664efb107e5d53014a1e3ef45c1b2169ad7b3bd542ed3ffdc03ecaefd471848196fdd889878c8f367b00
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T1E834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnhfzxsp.exe

Path C:\Temp\i_xvpnhfzxsp.exe
Size 226KB
SHA256 5e0af72134a314cab1cf9b12435fc8966a34501abbcfc8913a98b80f87c2eb85
MD5 4d1fcfe867b8b7246c427e25c3047f9d
SHA1 7da19d519930e0c4c212709d7eb63cc6c6b86235
SHA512 0e8dfd1cb9bb28b557d008d2d7682bc1fea01e948d3580f45c305fa7b074eac8377a10ed3ea8b3dc4608a747376d257e9e79126c6adbfff369add590ca3e7174
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T17634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtolge.exe

Path C:\Temp\ljdbvtolge.exe
Size 226KB
SHA256 c6363047386fe245a3f20d32d441c56cc40634d69949b5da05825597156944ed
MD5 e14e4dfef2f5ad6b8d58beeeec06853d
SHA1 d62ea53819a296f0edcad960ea8c116e79d1d7e7
SHA512 d950aed98a51d45c9ffdfdf7eeb40e14f2d7ad9034cdb380f92d0f283d0310e39b1bc939d3b544be463f0a4973a4c6f0f40f3201890151f27c18de33c2d0be59
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T1EE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhbztrljeb.sys

Path C:\Temp\mhbztrljeb.sys
Size 141KB
SHA256 418a3a7e79748f7bc809c74a49b4e78a1ee2d932d2f63d6ef982884413c3faf1
MD5 8393efca0de575f231855bf1e2696623
SHA1 ff59642eb305cbaed0c283c5193e6e88428db66a
SHA512 db72583ddbd3a6b3a11e85012c803566d6327fb69801d40c89d8b39124b59cd05d09eb2f2d0776bc80a8506783828f633f4d21209453f35aa4c181dd8854a764
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15AE37C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqoig.sys

Path C:\Temp\olgeywqoig.sys
Size 141KB
SHA256 64642f22e1672530078557583148fbbc6c84eb8b1c839680e1ae46893edbc751
MD5 1db777a46ca5337ec7fac6384f87e6c4
SHA1 33bea05bb430fa14e822427532ae0c3f0ee2e844
SHA512 ad0b640d907867cb5889e868c4ef010242e214dd75596a7e70d8e3e1e2655a57e6a085143feafc7ca976b831bce0bafb13de5342fae8c876156d54efcbdbf67b
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DDE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnkf.sys

Path C:\Temp\qkicavsnkf.sys
Size 141KB
SHA256 636fd4593f7e20af8cf7d466ff9a8de66f1caa0cb377fb5930a6cfd44dd1e8a3
MD5 d6a0996f73cb47029c7b45d5e156da40
SHA1 1718ed9042d701f544f3d83c0b8cfd54b56931af
SHA512 c019dd974a0eef1c709cef5e60a57ab5907f74f9539a71a6bba64e1c361197f34e55cd93eeaffadb5be268c1b5051c2d7d6ae50628b3b38d85ee414bee139fa4
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T194E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnlf.sys

Path C:\Temp\qkicavsnlf.sys
Size 141KB
SHA256 367610af5edd26f18dc87f232e8c7f68a01c2bc7ee9d54bed787b2913ffdac67
MD5 11b9e9c0cb27ac06b462bcdc2c9c2fff
SHA1 e5cd39953e0499059feaca244661c5fb01d2236e
SHA512 a656303e86319c434146a0fadde8a37fc745eaf86fcaeadb13c045b1589d7706c686afc9e68ebbc811219960eb7129ac47969983ec368426de9621732aecd069
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlidavtnl.exe

Path C:\Temp\sqlidavtnl.exe
Size 226KB
SHA256 cae0dead80540b94b6e6044d6a9b2a58d19fe8bef68d5031d45872d116782f87
MD5 36bdd7799f7480649e46c29cacb0804f
SHA1 fe9e93fd80c07e41f70b0b8c6b54269fee641dbf
SHA512 ad1ed704642eea0a1f69190690f6a838f31cedf8a120ae4d2c73b5fc5aad0ec67ae3403ba7061ea6898638eca4aacc8556a6e84c1822dbaa832fafabd7aa3d44
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T12134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfzxsph.exe

Path C:\Temp\vpnhfzxsph.exe
Size 226KB
SHA256 ee15534edacadb64acaa22e1daf137064ccc0f6d68a8c5c0dc273b460dbfb4e6
MD5 711b71bd4f9ac5c4dfb9abe486460081
SHA1 a7e6ba9d6a39359525d5b8c62309943ffdf56ba4
SHA512 597c2fad31665be49c230e0306afd3640dced5bfdc73fc109e49d72aad9657f80c58bea9ad27d687110e111cca61640ddd7513342d013bba660a5c0da1464480
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T1B234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfzxsp.exe

Path C:\Temp\xvpnhfzxsp.exe
Size 226KB
SHA256 119ef22c2513291bbe67e2950a23c63265979ec63f23cd87fcbf32445f5e1785
MD5 7a5d1d6f329d093314cb188e0e1001d5
SHA1 191dd6176078cd97ca710c626e502265e43b31a2
SHA512 a4db8340b2e027e7297aca858c4a42dfef65d537d87cbef3669510be9c67e69c4eeacb2387a2f63b6b1bbc51db3d4cb6e7eeeb9da879eca3824b959d2c48813e
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T1A134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 02d86874a829a0e98c14e434140948ac8f2d8ac925891d67163fdb4fda50d438
MD5 c03e8760591e9d9bd812ff0ea099b063
SHA1 c39d2afe939d7ba7e9f72fc708cd54ab09ff432f
SHA512 e5d6b7fbef76170679ec3ace7d6a73404fb2c353da818fad4aa80c7999723b77f02609a7a33ace9065c202ae74f06408c38f51d1509a99bd6dbe419079b88a60
TLSH
T1D5F0DC22F2F9FCB49D5550EC02A486383430FA2B61800BBCA0AC21E10B697A43A47870
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 69392661f7e7642b2af1d83f4262babfa8fa398913842affdc8a41dc58fe2707
MD5 41eea6652425e90ac1ba3e0a77235edd
SHA1 0f8c1f3306ff0db2e6d7a9e3e427db241a8e3ca0
SHA512 a26f8276d031afd8a2447675ce3e79a5b89dd3656d7fb830b22072faa5a59cd8ab46a24c9a44acd6f5d16a03e385cc5609df186571a52be09e16cd26023eda69
TLSH
T113E0C02421F7811EE8F4D4369BD97421989AF126081CD3F42ED84F08BB02740AC13B29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7EOZKXVE\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/644-125-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1036-79-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1100-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1204-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1376-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1404-95-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1920-121-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2812-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3412-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4148-104-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4380-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4608-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5028-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5112-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5132-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5420-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5420-162-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5752-53-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5992-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6124-67-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads