cf992e2647aa17e3d96bbb7fb5447820fcc43b9cde41e5c4a3958809ed775c19

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260913-ebt4astsdz
SHA256 cf992e2647aa17e3d96bbb7fb5447820fcc43b9cde41e5c4a3958809ed775c19
MD5 34922bff9c6e7ab0890678442787e15f
SHA1 c2a6b4b9b8f0a2a47b316beaa334457b40d16384
SHA512 2a628faf4b6e0f1c1256198dfec84f4464529fb18f4907b4c4d9eafba9e28d25f4fd6869c8efb1e18a0b9196424fe42b9e459634bc39ad8d3162e4930bf48dab
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T1DE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1548	CP.exe
568	aysicavsnl.exe
3272	CP.exe
5084	CP.exe
2212	i_aysicavsnl.exe
5108	cavsnkfdxv.sys
3804	CP.exe
712	sqkicavsnl.exe
3816	CP.exe
3976	CP.exe
4816	i_sqkicavsnl.exe
3528	kfzxspkhca.sys
3028	CP.exe
2680	ausmkfzxsp.exe
2984	CP.exe
116	CP.exe
1424	i_ausmkfzxsp.exe
3236	xrpkhcausm.sys
4400	CP.exe
4344	mhfzxrpjhc.exe
4000	CP.exe
3560	CP.exe
2168	i_mhfzxrpjhc.exe
4380	pjhbzurmke.sys
3216	CP.exe
2524	zuomheztrm.exe
4072	CP.exe
2952	CP.exe
1560	i_zuomheztrm.exe
4852	bztrmjecwu.sys
640	CP.exe
2116	rojhbztrlj.exe
1968	CP.exe
4672	CP.exe
2516	i_rojhbztrlj.exe
412	mgbytrljdb.sys
900	CP.exe
4596	bwtomgeywq.exe
2388	CP.exe
3492	CP.exe
3384	i_bwtomgeywq.exe
768	ywqoigaytq.sys
1412	CP.exe
4816	qlfdyvqoig.exe
3068	CP.exe
216	CP.exe
4532	i_qlfdyvqoig.exe
4692	tnlfdyvqni.sys
2856	CP.exe
3032	dyvqnigays.exe
3388	CP.exe
780	CP.exe
1888	i_dyvqnigays.exe
4568	lfdxvqniga.sys
2284	CP.exe
2128	avsnlfdxvp.exe
1036	CP.exe
5096	CP.exe
4412	i_avsnlfdxvp.exe
2268	xvpnhfaxsq.sys
4916	CP.exe
5060	pkfcxvpnhf.exe
4896	CP.exe
3628	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeytnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zuomheztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qcavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qcavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeytnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuomheztrm.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3524	ipconfig.exe
644	ipconfig.exe
2604	ipconfig.exe
2716	ipconfig.exe
3124	ipconfig.exe
3892	ipconfig.exe
4448	ipconfig.exe
4256	ipconfig.exe
2056	ipconfig.exe
4204	ipconfig.exe
204	ipconfig.exe
4828	ipconfig.exe
3008	ipconfig.exe
4140	ipconfig.exe
4440	ipconfig.exe
3908	ipconfig.exe
1664	ipconfig.exe
2056	ipconfig.exe
2008	ipconfig.exe
4044	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b868f1d543dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2397260082"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08c61f1d543dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2398197721"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "496102746"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae55000000000200000000001066000000010000200000009eae01efba609d766e71101c4a2cf8bdce267b10e9726803a712cdbb97e06988000000000e80000000020000200000001663d24e9048e4f8e369a6280e76a1f9b7ae61cc4873ba954c45847ee862e3fd200000009bbefc85cea8f1125dceb5a71ea60fdddb6b1dae6cf7f835697a363510288034400000001564c12526aeb6e9387e9ab46d3d533209311309a6d8a3262ba00981d8de8e6275d9cec67c13fb8ba13a50f44292ba0a7ea245b6fa8dd94b939fd054294636f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31278029"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae5500000000020000000000106600000001000020000000a296ce0a007ea8ff72dc936a4890446ce33cdf675d1af06469fdfaf36783bc13000000000e80000000020000200000005347d5a4917e9dca6e8ef7e02264f57ae70b4b05494533897ee57ff0c83307c120000000af61969fac2651caf53c4895b99adb7e5342dd4057de8d5b78f6c6b61013efe240000000ab41c8e975495baa4d78cd125ce758ffbde632888447d51cd171a33fbff2ace1f7fbac011278ef63fb10cde760b58df874fae623da98dc22015b3ef9ab53b158	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31278029"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BA07A035-AFC0-11F1-895E-C6B1AE79E33D} = "0"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	i_aysicavsnl.exe
Token: SeDebugPrivilege	4816	i_sqkicavsnl.exe
Token: SeDebugPrivilege	1424	i_ausmkfzxsp.exe
Token: SeDebugPrivilege	2168	i_mhfzxrpjhc.exe
Token: SeDebugPrivilege	1560	i_zuomheztrm.exe
Token: SeDebugPrivilege	2516	i_rojhbztrlj.exe
Token: SeDebugPrivilege	3384	i_bwtomgeywq.exe
Token: SeDebugPrivilege	4532	i_qlfdyvqoig.exe
Token: SeDebugPrivilege	1888	i_dyvqnigays.exe
Token: SeDebugPrivilege	4412	i_avsnlfdxvp.exe
Token: SeDebugPrivilege	5008	i_pkfcxvpnhf.exe
Token: SeDebugPrivilege	3640	i_ecxrpkhcau.exe
Token: SeDebugPrivilege	2172	i_uomhezwrpj.exe
Token: SeDebugPrivilege	2880	i_rmjecwuomg.exe
Token: SeDebugPrivilege	4676	i_hbztrljebw.exe
Token: SeDebugPrivilege	1448	i_lgeytnlgdy.exe
Token: SeDebugPrivilege	4044	i_dyvqoigavt.exe
Token: SeDebugPrivilege	3296	i_qcavsnlfdx.exe
Token: SeDebugPrivilege	3672	i_ausnkfcxvp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4276	iexplore.exe
4276	iexplore.exe
4856	IEXPLORE.EXE
4856	IEXPLORE.EXE
4856	IEXPLORE.EXE
4856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 4276	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	84
PID 4276 wrote to memory of 4856	4276	iexplore.exe	85
PID 772 wrote to memory of 1548	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	86
PID 568 wrote to memory of 3272	568	aysicavsnl.exe	89
PID 772 wrote to memory of 5084	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	92
PID 772 wrote to memory of 3804	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	96
PID 712 wrote to memory of 3816	712	sqkicavsnl.exe	98
PID 772 wrote to memory of 3976	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 772 wrote to memory of 3028	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 2680 wrote to memory of 2984	2680	ausmkfzxsp.exe	107
PID 772 wrote to memory of 116	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	110
PID 772 wrote to memory of 4400	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 4344 wrote to memory of 4000	4344	mhfzxrpjhc.exe	116
PID 772 wrote to memory of 3560	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 772 wrote to memory of 3216	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 2524 wrote to memory of 4072	2524	zuomheztrm.exe	127
PID 772 wrote to memory of 2952	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 772 wrote to memory of 640	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 2116 wrote to memory of 1968	2116	rojhbztrlj.exe	136
PID 772 wrote to memory of 4672	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 772 wrote to memory of 900	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 4596 wrote to memory of 2388	4596	bwtomgeywq.exe	145
PID 772 wrote to memory of 3492	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 772 wrote to memory of 1412	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 4816 wrote to memory of 3068	4816	qlfdyvqoig.exe	154
PID 772 wrote to memory of 216	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 772 wrote to memory of 2856	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 3032 wrote to memory of 3388	3032	dyvqnigays.exe	163
PID 772 wrote to memory of 780	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 772 wrote to memory of 2284	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 2128 wrote to memory of 1036	2128	avsnlfdxvp.exe	172
PID 772 wrote to memory of 5096	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 772 wrote to memory of 4916	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 5060 wrote to memory of 4896	5060	pkfcxvpnhf.exe	181
PID 772 wrote to memory of 3628	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	184
PID 772 wrote to memory of 1920	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	188
PID 4724 wrote to memory of 5020	4724	ecxrpkhcau.exe	190
PID 772 wrote to memory of 3728	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	193
PID 772 wrote to memory of 3516	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	197
PID 2120 wrote to memory of 3368	2120	uomhezwrpj.exe	199
PID 772 wrote to memory of 1076	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	202
PID 772 wrote to memory of 3988	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	206
PID 2104 wrote to memory of 4468	2104	rmjecwuomg.exe	208
PID 772 wrote to memory of 736	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	211
PID 772 wrote to memory of 4248	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	215
PID 4844 wrote to memory of 3044	4844	hbztrljebw.exe	217
PID 772 wrote to memory of 4808	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	220
PID 772 wrote to memory of 2156	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	224
PID 2008 wrote to memory of 2044	2008	lgeytnlgdy.exe	226
PID 772 wrote to memory of 3292	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	229
PID 772 wrote to memory of 3276	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	233
PID 2376 wrote to memory of 2672	2376	dyvqoigavt.exe	235
PID 772 wrote to memory of 3464	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	238
PID 772 wrote to memory of 4656	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	242
PID 3244 wrote to memory of 3860	3244	qcavsnlfdx.exe	244
PID 772 wrote to memory of 4176	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	247
PID 772 wrote to memory of 876	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	251
PID 4804 wrote to memory of 4156	4804	ausnkfcxvp.exe	253
PID 772 wrote to memory of 4080	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	256
PID 772 wrote to memory of 4056	772	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	260
PID 1516 wrote to memory of 656	1516	fzxrpkhczu.exe	262

C:\Users\Admin\AppData\Local\Temp\2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4276 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysicavsnl.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1548
- - C:\Temp\aysicavsnl.exe
    C:\Temp\aysicavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysicavsnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5084
- - C:\Temp\i_aysicavsnl.exe
    C:\Temp\i_aysicavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicavsnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3804
- - C:\Temp\sqkicavsnl.exe
    C:\Temp\sqkicavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicavsnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3976
- - C:\Temp\i_sqkicavsnl.exe
    C:\Temp\i_sqkicavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkfzxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3028
- - C:\Temp\ausmkfzxsp.exe
    C:\Temp\ausmkfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkfzxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:116
- - C:\Temp\i_ausmkfzxsp.exe
    C:\Temp\i_ausmkfzxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4400
- - C:\Temp\mhfzxrpjhc.exe
    C:\Temp\mhfzxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3560
- - C:\Temp\i_mhfzxrpjhc.exe
    C:\Temp\i_mhfzxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zuomheztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3216
- - C:\Temp\zuomheztrm.exe
    C:\Temp\zuomheztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zuomheztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2952
- - C:\Temp\i_zuomheztrm.exe
    C:\Temp\i_zuomheztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:640
- - C:\Temp\rojhbztrlj.exe
    C:\Temp\rojhbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4672
- - C:\Temp\i_rojhbztrlj.exe
    C:\Temp\i_rojhbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomgeywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:900
- - C:\Temp\bwtomgeywq.exe
    C:\Temp\bwtomgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2388
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtomgeywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3492
- - C:\Temp\i_bwtomgeywq.exe
    C:\Temp\i_bwtomgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlfdyvqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1412
- - C:\Temp\qlfdyvqoig.exe
    C:\Temp\qlfdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlfdyvqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:216
- - C:\Temp\i_qlfdyvqoig.exe
    C:\Temp\i_qlfdyvqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqnigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2856
- - C:\Temp\dyvqnigays.exe
    C:\Temp\dyvqnigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3388
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqnigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:780
- - C:\Temp\i_dyvqnigays.exe
    C:\Temp\i_dyvqnigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnlfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2284
- - C:\Temp\avsnlfdxvp.exe
    C:\Temp\avsnlfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnlfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5096
- - C:\Temp\i_avsnlfdxvp.exe
    C:\Temp\i_avsnlfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkfcxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4916
- - C:\Temp\pkfcxvpnhf.exe
    C:\Temp\pkfcxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkfcxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3628
- - C:\Temp\i_pkfcxvpnhf.exe
    C:\Temp\i_pkfcxvpnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxrpkhcau.exe ups_run
  2⤵
  PID:1920
- - C:\Temp\ecxrpkhcau.exe
    C:\Temp\ecxrpkhcau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxrpkhcau.exe ups_ins
  2⤵
  PID:3728
- - C:\Temp\i_ecxrpkhcau.exe
    C:\Temp\i_ecxrpkhcau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhezwrpj.exe ups_run
  2⤵
  PID:3516
- - C:\Temp\uomhezwrpj.exe
    C:\Temp\uomhezwrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhezwrpj.exe ups_ins
  2⤵
  PID:1076
- - C:\Temp\i_uomhezwrpj.exe
    C:\Temp\i_uomhezwrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run
  2⤵
  PID:3988
- - C:\Temp\rmjecwuomg.exe
    C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins
  2⤵
  PID:736
- - C:\Temp\i_rmjecwuomg.exe
    C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrljebw.exe ups_run
  2⤵
  PID:4248
- - C:\Temp\hbztrljebw.exe
    C:\Temp\hbztrljebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrljebw.exe ups_ins
  2⤵
  PID:4808
- - C:\Temp\i_hbztrljebw.exe
    C:\Temp\i_hbztrljebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeytnlgdy.exe ups_run
  2⤵
  PID:2156
- - C:\Temp\lgeytnlgdy.exe
    C:\Temp\lgeytnlgdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeytnlgdy.exe ups_ins
  2⤵
  PID:3292
- - C:\Temp\i_lgeytnlgdy.exe
    C:\Temp\i_lgeytnlgdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigavt.exe ups_run
  2⤵
  PID:3276
- - C:\Temp\dyvqoigavt.exe
    C:\Temp\dyvqoigavt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigavt.exe ups_ins
  2⤵
  PID:3464
- - C:\Temp\i_dyvqoigavt.exe
    C:\Temp\i_dyvqoigavt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qcavsnlfdx.exe ups_run
  2⤵
  PID:4656
- - C:\Temp\qcavsnlfdx.exe
    C:\Temp\qcavsnlfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qcavsnlfdx.exe ups_ins
  2⤵
  PID:4176
- - C:\Temp\i_qcavsnlfdx.exe
    C:\Temp\i_qcavsnlfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfcxvp.exe ups_run
  2⤵
  PID:876
- - C:\Temp\ausnkfcxvp.exe
    C:\Temp\ausnkfcxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4156
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfcxvp.exe ups_ins
  2⤵
  PID:4080
- - C:\Temp\i_ausnkfcxvp.exe
    C:\Temp\i_ausnkfcxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkhczu.exe ups_run
  2⤵
  PID:4056
- - C:\Temp\fzxrpkhczu.exe
    C:\Temp\fzxrpkhczu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2056

C:\Temp\cavsnkfdxv.sys
C:\Temp\cavsnkfdxv.sys
1⤵
- Executes dropped EXE
PID:5108

C:\Temp\kfzxspkhca.sys
C:\Temp\kfzxspkhca.sys
1⤵
- Executes dropped EXE
PID:3528

C:\Temp\xrpkhcausm.sys
C:\Temp\xrpkhcausm.sys
1⤵
- Executes dropped EXE
PID:3236

C:\Temp\pjhbzurmke.sys
C:\Temp\pjhbzurmke.sys
1⤵
- Executes dropped EXE
PID:4380

C:\Temp\bztrmjecwu.sys
C:\Temp\bztrmjecwu.sys
1⤵
- Executes dropped EXE
PID:4852

C:\Temp\mgbytrljdb.sys
C:\Temp\mgbytrljdb.sys
1⤵
- Executes dropped EXE
PID:412

C:\Temp\ywqoigaytq.sys
C:\Temp\ywqoigaytq.sys
1⤵
- Executes dropped EXE
PID:768

C:\Temp\tnlfdyvqni.sys
C:\Temp\tnlfdyvqni.sys
1⤵
- Executes dropped EXE
PID:4692

C:\Temp\lfdxvqniga.sys
C:\Temp\lfdxvqniga.sys
1⤵
- Executes dropped EXE
PID:4568

C:\Temp\xvpnhfaxsq.sys
C:\Temp\xvpnhfaxsq.sys
1⤵
- Executes dropped EXE
PID:2268

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
PID:4756

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
PID:4892

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
PID:4336

C:\Temp\omgeywrojg.sys
C:\Temp\omgeywrojg.sys
1⤵
PID:564

C:\Temp\wqoigbytql.sys
C:\Temp\wqoigbytql.sys
1⤵
PID:3332

C:\Temp\idbvtolgdy.sys
C:\Temp\idbvtolgdy.sys
1⤵
PID:4760

C:\Temp\xvqnifaysq.sys
C:\Temp\xvqnifaysq.sys
1⤵
PID:872

C:\Temp\kfdxvpnifa.sys
C:\Temp\kfdxvpnifa.sys
1⤵
PID:2332

C:\Temp\pkecxupnhf.sys
C:\Temp\pkecxupnhf.sys
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausmkfzxsp.exe

Path C:\Temp\ausmkfzxsp.exe
Size 226KB
SHA256 091504f2f4a5799ce2a28374e044b80f97fa9e65e42794129beb631f1741c824
MD5 65ce92964ec848f6c8c1474903aa5546
SHA1 34271ed794b8af53bf04a73ba40ccc23c3e1ea6d
SHA512 c749d7b8c6a2749ec640db20cdf270113a7e34a224e06c369867ae75b216ce47e9afe4d669847db3fe742520c8998527e422b73881951239d3901aaa2cfdee76
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T16234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysicavsnl.exe

Path C:\Temp\aysicavsnl.exe
Size 226KB
SHA256 f35611c14f423419a45c6a2a22bcc76c8359894a670bfcfa67f6810c1b13b852
MD5 2dbac34898b0bd9713d09829bd4715ba
SHA1 90974dd467af209e5c35f7845bc8c15a9e8e5592
SHA512 4c15d8a5b7f07c0bcbd8fd540e9e628c6b858f24ef1f942b9be9a754672e07cdfeba2823e8254863c24e96642cc61671da273b37be92e4d2063eb5fbc5fafa32
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T11C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtomgeywq.exe

Path C:\Temp\bwtomgeywq.exe
Size 226KB
SHA256 6d651dd4c88719e06f0610b6734c5f5b16aa67b280b6e7735abe88bf75048fc0
MD5 2dffc61dac4305c05e7a748fb53fa548
SHA1 551544a779dd09a87483bf64af45e132112dcd94
SHA512 db55d4cd2082ba3268b9ce7a46f198d7ccd16bd9f345c9d7e821c3029bfe5faec0b6093de51f9862e1bfdca82fb47c0e19f0b0f230cc132a7f61a5562f92804c
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T14D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjecwu.sys

Path C:\Temp\bztrmjecwu.sys
Size 141KB
SHA256 d6735faf2e7b580fb49fdb57fa19e89b08d42e67c249c4aa107aaed93a445eb1
MD5 09728a1060ac4e5937be818ba2e3da05
SHA1 91a267e790d377e90ff29aa0f9ebf42f307342fe
SHA512 e5813578633c441505ab79845e52830a12bc5e396ea92ccc0b47df4507190af07100f4cb8a2398ce6bf03aa255ec7fc0eb6cd82bd83515e626c2788c25a7ab8e
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T126E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsnkfdxv.sys

Path C:\Temp\cavsnkfdxv.sys
Size 141KB
SHA256 7e917ef2573b361f00625471ff5a52be9d0d84cf2bd90c33249a692cf4c67267
MD5 1608a9e9754b650228333967b0d4c0f1
SHA1 bd5d11f4974b563fe591f14a7814be6706b0baa0
SHA512 9141dc019099183225a758e95ecacc563183f571680b22ea37e125609888a1c54521693bc7f0530dbe6cc169d093d9f281a0568cbcdfad09ddca3ffe72f91f6f
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausmkfzxsp.exe

Path C:\Temp\i_ausmkfzxsp.exe
Size 226KB
SHA256 5c24b70affb042a9aec9927c85954056d0fe54914b2e19632b38c4c883ba4880
MD5 0889f3a8407c9b5b6925435ea2e8a9b7
SHA1 663a60d72a7000683a088be57265879cac116357
SHA512 f628fa8ae0c7b76eb85eccd86b8e59f756df8f8f16d1ae5a481858b5fca8a07f85705a06f47ac00e8df1ebad0a562be3f9a79822190cd05013dcb6d08e133dd0
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T17434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysicavsnl.exe

Path C:\Temp\i_aysicavsnl.exe
Size 226KB
SHA256 05a4065dcdb33cd5f15307011f9a38bf51766970c64b8b991852117e277662af
MD5 fc9df9e3fa18c837e450c2d124d6210b
SHA1 8ac0578cca6a163f06be91c1f914e3ba3d856c28
SHA512 3496717ac35f1ac9e50eb1255186b608a7d4d1c40519b7d60331acbc5f7c20990b198d8aa330aebac4367de93924fd87ab68fc18a6d6a3d985ae15fa4399080f
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T18334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtomgeywq.exe

Path C:\Temp\i_bwtomgeywq.exe
Size 226KB
SHA256 07d54c8dd61784c2882a18e23f5fc43a718ecf36ea87d52db88b9ce0af2e5ad8
MD5 3675bfcae0713867228b79010ff44bfc
SHA1 a28eba97fce7213e29717f41e8637ffc33172e5b
SHA512 a843e64d1d1c3a620a57ca8a72fb7961271050fc1a63e9a925214c9b072dc73054873811118cea3b2a09e5ebe51447f0e027653a06fa00f549d2c868e3585da4
SSDEEP 3072:5GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:oXY4LK+a3lLNngoqRttA7
TLSH
T11134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhfzxrpjhc.exe

Path C:\Temp\i_mhfzxrpjhc.exe
Size 226KB
SHA256 0b0d56fe0cc457b99720d4d117ed094404d3a815468168635fa728f1775270ea
MD5 f277c94368b00b823202bad07f0d208d
SHA1 088e57ff35c3d320337e786a369dd251d56aad09
SHA512 bdc1a2df23f2842da45832b74c6ea6d8e4d5d363086f3c8bfa2e727dcdf62a26b011b29ade6caf719dd7ded5a76920084a99e42129d07787b6c5741ed931f6f3
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T13434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojhbztrlj.exe

Path C:\Temp\i_rojhbztrlj.exe
Size 226KB
SHA256 1e58c055ca5a8673a073287c83812310cbd4c84e54d0426a02c4fe622bb41dd3
MD5 33d8db507fe3a52cab974df12cea0cb6
SHA1 5d2eb60a1f200da9a9250f1fc12ea2e54d885ac9
SHA512 a391d24eaca30dbc1ade5865a0e7c4362f65addbbc9bacc5ed8c1620e3a3d10a96c40e4a331079e4d6a0c3159e1d20f8904d6bfe29305b974588bdf9add00786
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T13534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicavsnl.exe

Path C:\Temp\i_sqkicavsnl.exe
Size 226KB
SHA256 4b3552a367da4969e03a18e3fc942a6390182b6ccfc9ba9452943b773287724a
MD5 a34d46781e34e913d614999f64951654
SHA1 9d2666c0c489c44662ca362a3d80f5144b8fa193
SHA512 05dcee6a4e094b3a22db890cba10fdc4e42afd96972ad0bd8d8beddffa6ea3a6cf612cfce376fac9ab95a5ff6843cdc89ec50265ac68813a89a0b601b098f11e
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T1BB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zuomheztrm.exe

Path C:\Temp\i_zuomheztrm.exe
Size 226KB
SHA256 6432e8e2a775f7fcea4a32502e0a470fa7c7fadaceea9f6c55b41660ec067bf1
MD5 4fb8d12569849915195a14920ea472d2
SHA1 2e5af18986655632c2d3ee43968c7f61d469195b
SHA512 39b38dbb85ec7333f2c87f1748c79a7a1ee39f77bfb5950f7761a37d73a3ec5e2ad127e319162aa1db119c98fb4419e96efecf85d20c8c15eeb4d05c426fd7db
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T19C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfzxspkhca.sys

Path C:\Temp\kfzxspkhca.sys
Size 141KB
SHA256 684f71bf6069ca6825352fe5ca85b09de029cf6b6d36a218073b0919578423de
MD5 6516a74764c8508f9b7d3d512583de11
SHA1 3d43effb221499aa3823e642d001493bd3b8f31b
SHA512 7c3a7a44c71aad772fc674cb4521a13cabd1ad037a6f5a9804bb9b0c61e84fbe48e2acd4098d68f3a33c9e4ad6c690c1108d6dcc785962b864875be4cf18d12f
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgbytrljdb.sys

Path C:\Temp\mgbytrljdb.sys
Size 141KB
SHA256 20b428209d746b5010c7bd884460dce2e06254700c81806bd867e2daba0db08f
MD5 850451607315cbd38478c0ca18418e4c
SHA1 26e4e3c7ec1520b52a6c4c525e69ac2f315ec72f
SHA512 642a0568a9c667006f5c2f4b0fadf6f9293c34b3ccce6ea721acef449c9d366d2c15e72593098ad552bae04a2033ac88a96b70c1df78ed40db4b090f143e2be1
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18DE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxrpjhc.exe

Path C:\Temp\mhfzxrpjhc.exe
Size 226KB
SHA256 8345d31fd4239ffc264de0e2fcf0285d2a8401976f0307db7a0cb59dc2517abb
MD5 0dbfb141bc8d8e7b500f67723e31697b
SHA1 624630a27cd4845b190c1ba3845932b4a0cf92e2
SHA512 2be799e927abfe4dce595d526f82a2edc8f4b4b4be97b45a386361deace33841fc58b9e261549a254f48ccf695b4f2469b41a96684c05677170becd2b7763180
SSDEEP 3072:fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:+XY4LK+a3lLNngoqRttA7
TLSH
T1BB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbzurmke.sys

Path C:\Temp\pjhbzurmke.sys
Size 141KB
SHA256 9582fdba15ef3f4f6cb370443c6b27e93c9871ecfe482017732402f02c1cf2b4
MD5 af8d92f32861cdfd9f039017170a5596
SHA1 75564581883d0be0d6c2ce24d5db415497c8e2e3
SHA512 bfdc4574bc4f3fdfdb31d1ad0f593612065e1dfac8f4ea9d9a4a94e9d61522a937c4f2baa47a7c6c69d1dadce2b10d63266fd71302adbe8be5c126ead7b9cc06
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlfdyvqoig.exe

Path C:\Temp\qlfdyvqoig.exe
Size 226KB
SHA256 0d582baf26b9f94eea27b524419cdd294435fcd213bf7b830f145f81949699c3
MD5 511d93650375da5dbb289bdd37c0df26
SHA1 847b69fe758a27bde37cd8b16274ad5b6acc698f
SHA512 62e92f2fe170ab01b5b12bad85e26a2adad462e05f94841a327c8fae207f4ccf8758ff36b3011abff405327819ea4c269ae6bb1a2d7abce53d8161987f14bcce
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T1D334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrlj.exe

Path C:\Temp\rojhbztrlj.exe
Size 226KB
SHA256 3db2281cb9dec37dad9f470acde4974b7ac09c484583a02b21cf6e4ef4f89151
MD5 f0886f51389b464b1b8078a927dcd2be
SHA1 67e0d70ae3123d7ba9c8c4429ffa18cb716a7aa3
SHA512 27e7f749c55f11a41cca995128f73f06d0bab6d6de76721b7891e14088fcceb2b884ea89717e51094a94ddc0cfd7c5d199d7742ef08e1b3251f11af115014564
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T1C934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnl.exe

Path C:\Temp\sqkicavsnl.exe
Size 226KB
SHA256 a90349a4d47d1e972bb935417f7a54f64d1cf14ee7446bac330346a9b58e8f9d
MD5 d35b3161ac174008e4baf15bbfbd86a4
SHA1 5bf6d18d36dcd72fbe44b6d864b933668dd106f2
SHA512 b8bb9c5ef57cea6846041e9a71e2d962575015cfcdd64f5e25d98766503abb437d7278dcaef85e829df19b857ea415e84b32d60a675613823c89f3c2ac4e8939
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T14E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpkhcausm.sys

Path C:\Temp\xrpkhcausm.sys
Size 141KB
SHA256 b8778892e205b428eb172e114309630993f5f93d10c7a0c0850909d06f480d35
MD5 9c399e3654eec80f6ac02b40c907121c
SHA1 587dd7ec5e9a5bc89c9cde67acc0acc6b189f6f8
SHA512 55297a7ca75a908e0110734a99fe1af8d3472487a7d889f71bcd04eb08f281ba9b1192c9cd85e8793a544c0c3c7b5e12a84ff1093c5f8af3b98e6d5b447fcb73
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigaytq.sys

Path C:\Temp\ywqoigaytq.sys
Size 141KB
SHA256 b20b0dab221e34477a9e0d8ce1afec98f6616d2f851965acb2b83c3e28078db6
MD5 d7a0e5a905681169c04faf5590802247
SHA1 718397be3a06b1238e4b198e13249d4f364c67bb
SHA512 f103ca86fb08fc33b90bde51b235c5df4adab645446b7f32cc741e30f36340d267f486ed993033e7c905cca27a46f1368981b67d4bc651bbf5d9f234c854830d
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T162E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuomheztrm.exe

Path C:\Temp\zuomheztrm.exe
Size 226KB
SHA256 b8998c256d31895a914dcc03abb086d3ac92ede64794b127bb7b435fae9bde87
MD5 8023953b317ce0ffec0fa80f645c3f6a
SHA1 df6e50c8115279718ed7d0c6f09970ec2dd5924c
SHA512 bf1889a83f6cb0f8f3b00aa8132640c9907c14a01e8d875a1a6ff358b363375e7b359586d16e71a7e8f5ea80599c4f02367e0e6012a11aa6205d744a1f7d8bca
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T1C534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 d81daa2d0c1e0cdc64b51894f9c4e7008a2e1f8c5c37b223f8b4ec6d45d9ff6a
MD5 b373daa43bbe7b7a3ac0e2083b31c07a
SHA1 063275ea9ee7cc6d1fbd8260a5a4d5e53bd65edb
SHA512 d35a4ce29b5ad7bbdc3032e89ed0ac6d091d96113457dfb2d77fa8a14bb79c05222ac57bbb154256f7f7633ba1458c76b6ca2b3e9708475d900957b483c54cc3
TLSH
T185F0DC6274BD94A0289629CC13EC4BFD3870F47F38A0469B71BC90E41E58BDBEA0906D
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 8550f1bd6dd75b70a345335afc847fc8f8507d572fb3bdc25f943b6a601d1b13
MD5 969afe5714cdcf33a609282522ec07b3
SHA1 66e88c85b103b68e00ad1e6949d0ab91b747d145
SHA512 e44d91418be53878cb7fb2bb4116bcdd7b04239817cef6d947b3bd5bd5338a651ec91241b810edf3b545463a8ed2b95365a1ffe5b974e618a191494892b86dda
TLSH
T141E0C02411FA411EE0E4D0354BC67525845BF1331438E3B43ED8DB04B703680EC12A29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T8UIQK7Y\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-83-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/564-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/768-95-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/872-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2268-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2332-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3236-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3332-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3528-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4336-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4336-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4380-57-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4568-115-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4692-116-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4692-104-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4756-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4760-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4852-71-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4892-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5108-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads