37d28663eb3bfa917bda4189029db0feb20ce03bd5da3665858ed8804685c3f1

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261002-eel7vssv6m
SHA256 37d28663eb3bfa917bda4189029db0feb20ce03bd5da3665858ed8804685c3f1
MD5 c103ce334cb2dd49aad5fc37e342625c
SHA1 f60265b8f68250833d0eb497cfa7d476650a3f30
SHA512 8f9a8b3f08da3bbf26a80cf5a83d271d2290fce726ff56275faffd2e191df14d876406da41a08448b31b3e4758dbb44eb4416733815d8df02b3a4dbab012257b
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T1C134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3748	CP.exe
3900	gbztrljdbw.exe
4260	CP.exe
2664	CP.exe
3728	i_gbztrljdbw.exe
2300	ywqojgbytr.sys
5112	CP.exe
4048	rljdbvtolg.exe
3628	CP.exe
1264	CP.exe
2260	i_rljdbvtolg.exe
436	ytnlgdywqo.sys
3500	CP.exe
2816	gaytqlidbv.exe
4788	CP.exe
4664	CP.exe
1716	i_gaytqlidbv.exe
4924	lidavtnlfd.sys
2464	CP.exe
2928	dxvqlfdxvq.exe
4388	CP.exe
924	CP.exe
3404	i_dxvqlfdxvq.exe
4016	dxvqnifays.sys
4956	CP.exe
2296	snkfdxvpni.exe
3980	CP.exe
4572	CP.exe
3724	i_snkfdxvpni.exe
4168	nhfaxspkic.sys
312	CP.exe
4268	cxvpnhfaxs.exe
848	CP.exe
2112	CP.exe
4508	i_cxvpnhfaxs.exe
684	cxupnhfzxr.sys
3600	CP.exe
1636	jhczusmkec.exe
904	CP.exe
3764	CP.exe
4776	i_jhczusmkec.exe
2420	usmkecwupm.sys
1820	CP.exe
2504	kecwrpbztr.exe
2236	CP.exe
3728	CP.exe
3132	i_kecwrpbztr.exe
4940	hbzurmjecw.sys
4648	CP.exe
2812	wrojhbztrl.exe
2716	CP.exe
748	CP.exe
4984	i_wrojhbztrl.exe
2412	tomgeywqoj.sys
1696	CP.exe
2768	jdbvtolgey.exe
2404	CP.exe
4236	CP.exe
3724	i_jdbvtolgey.exe
856	oigbytjdbv.sys
2472	CP.exe
3776	vtnlfdyvqo.exe
1644	CP.exe
1172	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwrpbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkeuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbwqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwrpbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkeuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbwqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbnlfdyvqo.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4448	ipconfig.exe
440	ipconfig.exe
4472	ipconfig.exe
3316	ipconfig.exe
4884	ipconfig.exe
1784	ipconfig.exe
3752	ipconfig.exe
3068	ipconfig.exe
4708	ipconfig.exe
3604	ipconfig.exe
4912	ipconfig.exe
4884	ipconfig.exe
2520	ipconfig.exe
2940	ipconfig.exe
5064	ipconfig.exe
4960	ipconfig.exe
2820	ipconfig.exe
3852	ipconfig.exe
5116	ipconfig.exe
4712	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b295b843b8043e4c891ba263e4e2576000000000020000000000106600000001000020000000f7c6b3a762d7435918f307b4ff6264f685e8b85466fa7a9dc1e482ba61f10589000000000e8000000002000020000000958f680ade661e312d66e4118e384a908864523f433bd10fb4a3e44cad6d9ebf2000000088809ec2bcbffe97e4017a0cf1dfc512ab9ff3bdc9ae5746f2528e73059fdd824000000037c448290e2dee8873ec2bddb9893bedcb68d7b8f4834a95071d43a49540d115a1a54976d9f39fa27565d7e1f14691be987e8184f64d44c61280ce61c3abbbd7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205130bd2952dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 107d37bd2952dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1524582643"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1524739065"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281697"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b295b843b8043e4c891ba263e4e2576000000000020000000000106600000001000020000000e4ad4ec46c4d39dbcccdd37a9ad07a54aa215f19e4f638d5874fcf91058a7f2f000000000e8000000002000020000000965c471fdfeee46dbc56bdfddd9761eefedfda4700f969b0d755e911d9a4bca220000000793e6fb6d09f45a72c9559aedd685319da293137d938b89949da92e8baed4b7a4000000087634ae7ed783d0814a380e405aba6e6a61e22cbe2d7862c251bb8c2ba4cbc298e00bb5312c18f660ae6b086a88845af0a0aff7b1b5d299695ddd43320d5a7c7	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8617924F-BE14-11F1-86D4-C6B1AE79E33D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281697"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497678053"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3728	i_gbztrljdbw.exe
Token: SeDebugPrivilege	2260	i_rljdbvtolg.exe
Token: SeDebugPrivilege	1716	i_gaytqlidbv.exe
Token: SeDebugPrivilege	3404	i_dxvqlfdxvq.exe
Token: SeDebugPrivilege	3724	i_snkfdxvpni.exe
Token: SeDebugPrivilege	4508	i_cxvpnhfaxs.exe
Token: SeDebugPrivilege	4776	i_jhczusmkec.exe
Token: SeDebugPrivilege	3132	i_kecwrpbztr.exe
Token: SeDebugPrivilege	4984	i_wrojhbztrl.exe
Token: SeDebugPrivilege	3724	i_jdbvtolgey.exe
Token: SeDebugPrivilege	4460	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	5088	i_ysqlavtnlf.exe
Token: SeDebugPrivilege	176	i_snlfdxvpni.exe
Token: SeDebugPrivilege	2940	i_nhfaxsqkic.exe
Token: SeDebugPrivilege	2328	i_hczusmkeuo.exe
Token: SeDebugPrivilege	992	i_bwuomgezwr.exe
Token: SeDebugPrivilege	4488	i_wrojhbwqoj.exe
Token: SeDebugPrivilege	1480	i_gbytrljdbv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1344	iexplore.exe
1344	iexplore.exe
4132	IEXPLORE.EXE
4132	IEXPLORE.EXE
4132	IEXPLORE.EXE
4132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1344	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 1344 wrote to memory of 4132	1344	iexplore.exe	88
PID 4372 wrote to memory of 3748	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	92
PID 3900 wrote to memory of 4260	3900	gbztrljdbw.exe	97
PID 4372 wrote to memory of 2664	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 4372 wrote to memory of 5112	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 4048 wrote to memory of 3628	4048	rljdbvtolg.exe	113
PID 4372 wrote to memory of 1264	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 4372 wrote to memory of 3500	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 2816 wrote to memory of 4788	2816	gaytqlidbv.exe	122
PID 4372 wrote to memory of 4664	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 4372 wrote to memory of 2464	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 2928 wrote to memory of 4388	2928	dxvqlfdxvq.exe	131
PID 4372 wrote to memory of 924	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 4372 wrote to memory of 4956	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 2296 wrote to memory of 3980	2296	snkfdxvpni.exe	147
PID 4372 wrote to memory of 4572	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 4372 wrote to memory of 312	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 4268 wrote to memory of 848	4268	cxvpnhfaxs.exe	157
PID 4372 wrote to memory of 2112	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 4372 wrote to memory of 3600	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 1636 wrote to memory of 904	1636	jhczusmkec.exe	166
PID 4372 wrote to memory of 3764	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 4372 wrote to memory of 1820	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 2504 wrote to memory of 2236	2504	kecwrpbztr.exe	175
PID 4372 wrote to memory of 3728	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 4372 wrote to memory of 4648	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 2812 wrote to memory of 2716	2812	wrojhbztrl.exe	184
PID 4372 wrote to memory of 748	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 4372 wrote to memory of 1696	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 2768 wrote to memory of 2404	2768	jdbvtolgey.exe	194
PID 4372 wrote to memory of 4236	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	197
PID 4372 wrote to memory of 2472	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	201
PID 3776 wrote to memory of 1644	3776	vtnlfdyvqo.exe	203
PID 4372 wrote to memory of 1172	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	206
PID 4372 wrote to memory of 1068	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	210
PID 2912 wrote to memory of 3256	2912	ysqlavtnlf.exe	212
PID 4372 wrote to memory of 5040	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	215
PID 4372 wrote to memory of 624	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	219
PID 3164 wrote to memory of 2420	3164	snlfdxvpni.exe	221
PID 4372 wrote to memory of 1112	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	224
PID 4372 wrote to memory of 3028	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	228
PID 2096 wrote to memory of 956	2096	nhfaxsqkic.exe	230
PID 4372 wrote to memory of 3492	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	233
PID 4372 wrote to memory of 3216	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	238
PID 3012 wrote to memory of 3080	3012	fcxupnhfzx.exe	240
PID 4372 wrote to memory of 3104	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	243
PID 4372 wrote to memory of 2412	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	245
PID 4820 wrote to memory of 4512	4820	hczusmkeuo.exe	247
PID 4372 wrote to memory of 2308	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	250
PID 4372 wrote to memory of 4252	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	254
PID 4360 wrote to memory of 3644	4360	bwuomgezwr.exe	256
PID 4372 wrote to memory of 628	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	259
PID 4372 wrote to memory of 2352	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	263
PID 2408 wrote to memory of 540	2408	wrojhbwqoj.exe	265
PID 4372 wrote to memory of 4148	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	268
PID 4372 wrote to memory of 3240	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	272
PID 4208 wrote to memory of 3436	4208	gbytrljdbv.exe	274
PID 4372 wrote to memory of 684	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	277
PID 4372 wrote to memory of 4796	4372	2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe	281
PID 4684 wrote to memory of 3752	4684	dbnlfdyvqo.exe	283

C:\Users\Admin\AppData\Local\Temp\2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_c103ce334cb2dd49aad5fc37e342625c_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1344 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3748
- - C:\Temp\gbztrljdbw.exe
    C:\Temp\gbztrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2664
- - C:\Temp\i_gbztrljdbw.exe
    C:\Temp\i_gbztrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbvtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5112
- - C:\Temp\rljdbvtolg.exe
    C:\Temp\rljdbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbvtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1264
- - C:\Temp\i_rljdbvtolg.exe
    C:\Temp\i_rljdbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqlidbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3500
- - C:\Temp\gaytqlidbv.exe
    C:\Temp\gaytqlidbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqlidbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4664
- - C:\Temp\i_gaytqlidbv.exe
    C:\Temp\i_gaytqlidbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqlfdxvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2464
- - C:\Temp\dxvqlfdxvq.exe
    C:\Temp\dxvqlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4388
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqlfdxvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:924
- - C:\Temp\i_dxvqlfdxvq.exe
    C:\Temp\i_dxvqlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\snkfdxvpni.exe
    C:\Temp\snkfdxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4572
- - C:\Temp\i_snkfdxvpni.exe
    C:\Temp\i_snkfdxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnhfaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:312
- - C:\Temp\cxvpnhfaxs.exe
    C:\Temp\cxvpnhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnhfaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2112
- - C:\Temp\i_cxvpnhfaxs.exe
    C:\Temp\i_cxvpnhfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhczusmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3600
- - C:\Temp\jhczusmkec.exe
    C:\Temp\jhczusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhczusmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3764
- - C:\Temp\i_jhczusmkec.exe
    C:\Temp\i_jhczusmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwrpbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1820
- - C:\Temp\kecwrpbztr.exe
    C:\Temp\kecwrpbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwrpbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3728
- - C:\Temp\i_kecwrpbztr.exe
    C:\Temp\i_kecwrpbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4648
- - C:\Temp\wrojhbztrl.exe
    C:\Temp\wrojhbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:748
- - C:\Temp\i_wrojhbztrl.exe
    C:\Temp\i_wrojhbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtolgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1696
- - C:\Temp\jdbvtolgey.exe
    C:\Temp\jdbvtolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtolgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4236
- - C:\Temp\i_jdbvtolgey.exe
    C:\Temp\i_jdbvtolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2472
- - C:\Temp\vtnlfdyvqo.exe
    C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1172
- - C:\Temp\i_vtnlfdyvqo.exe
    C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlavtnlf.exe ups_run
  2⤵
  PID:1068
- - C:\Temp\ysqlavtnlf.exe
    C:\Temp\ysqlavtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlavtnlf.exe ups_ins
  2⤵
  PID:5040
- - C:\Temp\i_ysqlavtnlf.exe
    C:\Temp\i_ysqlavtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run
  2⤵
  PID:624
- - C:\Temp\snlfdxvpni.exe
    C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins
  2⤵
  PID:1112
- - C:\Temp\i_snlfdxvpni.exe
    C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxsqkic.exe ups_run
  2⤵
  PID:3028
- - C:\Temp\nhfaxsqkic.exe
    C:\Temp\nhfaxsqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxsqkic.exe ups_ins
  2⤵
  PID:3492
- - C:\Temp\i_nhfaxsqkic.exe
    C:\Temp\i_nhfaxsqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxupnhfzx.exe ups_run
  2⤵
  PID:3216
- - C:\Temp\fcxupnhfzx.exe
    C:\Temp\fcxupnhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxupnhfzx.exe ups_ins
  2⤵
  PID:3104
- - C:\Temp\i_fcxupnhfzx.exe
    C:\Temp\i_fcxupnhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczusmkeuo.exe ups_run
  2⤵
  PID:2412
- - C:\Temp\hczusmkeuo.exe
    C:\Temp\hczusmkeuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczusmkeuo.exe ups_ins
  2⤵
  PID:2308
- - C:\Temp\i_hczusmkeuo.exe
    C:\Temp\i_hczusmkeuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomgezwr.exe ups_run
  2⤵
  PID:4252
- - C:\Temp\bwuomgezwr.exe
    C:\Temp\bwuomgezwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomgezwr.exe ups_ins
  2⤵
  PID:628
- - C:\Temp\i_bwuomgezwr.exe
    C:\Temp\i_bwuomgezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbwqoj.exe ups_run
  2⤵
  PID:2352
- - C:\Temp\wrojhbwqoj.exe
    C:\Temp\wrojhbwqoj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbwqoj.exe ups_ins
  2⤵
  PID:4148
- - C:\Temp\i_wrojhbwqoj.exe
    C:\Temp\i_wrojhbwqoj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdbv.exe ups_run
  2⤵
  PID:3240
- - C:\Temp\gbytrljdbv.exe
    C:\Temp\gbytrljdbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrljdbv.exe ups_ins
  2⤵
  PID:684
- - C:\Temp\i_gbytrljdbv.exe
    C:\Temp\i_gbytrljdbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbnlfdyvqo.exe ups_run
  2⤵
  PID:4796
- - C:\Temp\dbnlfdyvqo.exe
    C:\Temp\dbnlfdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2520

C:\Temp\ywqojgbytr.sys
C:\Temp\ywqojgbytr.sys
1⤵
- Executes dropped EXE
PID:2300

C:\Temp\ytnlgdywqo.sys
C:\Temp\ytnlgdywqo.sys
1⤵
- Executes dropped EXE
PID:436

C:\Temp\lidavtnlfd.sys
C:\Temp\lidavtnlfd.sys
1⤵
- Executes dropped EXE
PID:4924

C:\Temp\dxvqnifays.sys
C:\Temp\dxvqnifays.sys
1⤵
- Executes dropped EXE
PID:4016

C:\Temp\nhfaxspkic.sys
C:\Temp\nhfaxspkic.sys
1⤵
- Executes dropped EXE
PID:4168

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
- Executes dropped EXE
PID:684

C:\Temp\usmkecwupm.sys
C:\Temp\usmkecwupm.sys
1⤵
- Executes dropped EXE
PID:2420

C:\Temp\hbzurmjecw.sys
C:\Temp\hbzurmjecw.sys
1⤵
- Executes dropped EXE
PID:4940

C:\Temp\tomgeywqoj.sys
C:\Temp\tomgeywqoj.sys
1⤵
- Executes dropped EXE
PID:2412

C:\Temp\oigbytjdbv.sys
C:\Temp\oigbytjdbv.sys
1⤵
- Executes dropped EXE
PID:856

C:\Temp\jdbvtnlgdy.sys
C:\Temp\jdbvtnlgdy.sys
1⤵
PID:4936

C:\Temp\dxvqnigays.sys
C:\Temp\dxvqnigays.sys
1⤵
PID:3684

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
PID:8

C:\Temp\usmkfcxupf.sys
C:\Temp\usmkfcxupf.sys
1⤵
PID:972

C:\Temp\mhezxrpjhb.sys
C:\Temp\mhezxrpjhb.sys
1⤵
PID:1960

C:\Temp\ebwuomgezw.sys
C:\Temp\ebwuomgezw.sys
1⤵
PID:1532

C:\Temp\ebwtomgeyw.sys
C:\Temp\ebwtomgeyw.sys
1⤵
PID:3592

C:\Temp\oigbytrljd.sys
C:\Temp\oigbytrljd.sys
1⤵
PID:640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnhfzxr.sys

Path C:\Temp\cxupnhfzxr.sys
Size 141KB
SHA256 3a53817deb9a9d1d537198f9e949617c088088b703bb14506f60fbbb4b92964f
MD5 cb469d137d2b7e07089481b3a7c695fd
SHA1 573f9648a2f21986935758f940b4c40a1b9ccbf5
SHA512 1b8325d304b1b441d7d3d0c67e0d96627f378e7d64443ae1770b579e9cb9b2b052acb68cc15d2ed14ccdbadafa809b33298195a2690697203de772ad1d923d85
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T142E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpnhfaxs.exe

Path C:\Temp\cxvpnhfaxs.exe
Size 226KB
SHA256 c18c5c1231699012f0572ab9eaf9b509ece8c3a3498ca6255cd6b07fec643c40
MD5 c56ffe559e9bcbc990bd762f10c25b3d
SHA1 ac40545c594e3daf3b573bd1840c30756f60ea36
SHA512 535426013cc300367054e36445d8f887439478f8c0c272f6519796d85a2da3f447562aa623011a1cc1f812b793fe9de4b901db648550887bb9cca6a6b0abadd3
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T13B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqlfdxvq.exe

Path C:\Temp\dxvqlfdxvq.exe
Size 226KB
SHA256 307f2e2a8f7dce5ce653c89b6dfeb7063143e3ee6956da4e809173001eb54ddb
MD5 0dbcaeae783bae61fb88d81f75558e26
SHA1 463bc8357876af809570c639289fac3033159892
SHA512 49d587ad7d6c8c867dde5e096d1db75f8efdf4ba1d1251712efa9aad288a63a1ed5be9a47b6b993bf95f0b01257b2a9d93724eae3d6f148e6fe1c891dcf76c04
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T1AD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqnifays.sys

Path C:\Temp\dxvqnifays.sys
Size 141KB
SHA256 45c7fe9b89fd1c01374afcd6336f30a3ce396b632c3283622244137f170ef75b
MD5 24b4ae9856838f4fd1d0d8a07e2938d6
SHA1 70747f5e27cc70e1e708e6271c02daf413cde520
SHA512 a9a4e7425e7da42a23543baed49b54f04eb49df4fc2451f136cde3a24a6f41b6e089f3b6ebe595992973aa73447ace1a2dada1898c5b1bafd21de4ed5891996c
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqlidbv.exe

Path C:\Temp\gaytqlidbv.exe
Size 226KB
SHA256 46f10dc19504053a62f924d0a78aa2d2ecac70b7e99dbd901d5a97d8a2d2aa8a
MD5 2f3c71634b4e81f3d46d701deaf79d93
SHA1 95dac28de9ccfb6ebbc381a247c5b9223dedd08e
SHA512 f5074afe1549f7779fee3fe37f5331548b75e7494359905185f3151102f67c25f6c885e0a6b2f819f80fc44e295f0b22bab43acbe0cd851111137cab8df76e7b
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T1B034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrljdbw.exe

Path C:\Temp\gbztrljdbw.exe
Size 226KB
SHA256 67c1a12b939b03bfed55d3e7b51f370823589d37495b9253dcd5bf04853e5821
MD5 e9b7a10c7779f2e2df0ca048e46147d7
SHA1 448c95a00dda0e0086503556e05f6778d00ab316
SHA512 3798c8c183daec64a279a61bf048778e87d7789dafc5a3809eb6297ea9721946cabb369bc127728befc37046e9e2333a80cabbe8500df18ea6e774b4f184a0a7
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T1FF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvpnhfaxs.exe

Path C:\Temp\i_cxvpnhfaxs.exe
Size 226KB
SHA256 c7e7f495c42f63197fd467757f9d259e22b1f582b6423dbcddec4c4017e28506
MD5 68243e028985398f52ccf637127ed50b
SHA1 c6e6f6f709ac7e6057ce7dfbd4ff4500f95a6311
SHA512 16d39650bfc8e6ae1174da59eeb21cf72592f7bf280676cedd98cc70cb79ab642d714a0a91e41f57b43cfa8b3b107d0d4e18e972e265bb346d2689a2cc6b49af
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T12834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvqlfdxvq.exe

Path C:\Temp\i_dxvqlfdxvq.exe
Size 226KB
SHA256 18a3301e94b4ee5a08c89fbc240738c229bd5bd963880b35f5ce4630801adbab
MD5 5db82ec3125c0af41cc0debbd77b97cc
SHA1 9d01a27b8fc18b825151e91636d64f374b99f252
SHA512 bd2cecd2476ae1e6a8753f0e1fbcf68a1b4461225a8cb43b96fda0e32d1154ae6c8531238deabd534f1329cb254130697b57907e70fe4ea3b2a0191cbf074987
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T17734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqlidbv.exe

Path C:\Temp\i_gaytqlidbv.exe
Size 226KB
SHA256 7f6b4b5e64ebb2e47a3035eb1cc27c5c9c20281b28ca6672ae8c9f4ef61a58f8
MD5 7b4138dd7a06e7f3dc376a907295d05d
SHA1 40f14fa0a791f52b7f40278a5502490a80bbc0c1
SHA512 37298e153116c4548d64e149cdceeacfcc08bfe1331d38b5ed3a4615c7407f97f6d5e4655fd0d54d2490ab42b9856cd6a72e2a4c483678ce47e6a46c8abf8f8f
SSDEEP 3072:5GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:oXY4LK+a3lLNngoqRttA7
TLSH
T1E734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbztrljdbw.exe

Path C:\Temp\i_gbztrljdbw.exe
Size 226KB
SHA256 addfcf8694534ae8084fe2776caa4ee533e6da2f7e0d9ba56b50e8649418ed01
MD5 af1505e5d52ba355df6c858c1dcb425c
SHA1 25d309ddd40c6eaf22afb54f07c7b2bc9ec83851
SHA512 360437c18a33b584c98b6c37e36f56595e9bf222ec4c9cac18e286204fe8ed25f83cb4c344b252fe0e01e53e3ab9089c910d1a4ff4e7dc5cd4801ca332ed663f
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T13334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhczusmkec.exe

Path C:\Temp\i_jhczusmkec.exe
Size 226KB
SHA256 c11c2706b5fddbf4fe720a0bae4a0a5e6b255aed8362831e8f9a79ae67543967
MD5 f881cf1dcbff58b450c86f60bf8ace9a
SHA1 c7bfac54efd721fb5feb4fd773f551fb9d0cfb52
SHA512 d93f9f7dd0fec2796d7e53d64faa6f917b8f8b48884565980978ef64800312b71de5176a6488f5d63924a5f37b11975d7b97f630d1def2c89f7a506166ea7205
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T1F034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljdbvtolg.exe

Path C:\Temp\i_rljdbvtolg.exe
Size 226KB
SHA256 7f53c1e7b899f6df243bbb6c970f140a8b87afbcfad8a5a8468d87c2b9c7fc2c
MD5 94308b714788f5f6d8a04fcf1f998809
SHA1 9376522642fe6c2b755e1d44d096ec8e56032f5e
SHA512 256dfc0b151569aa1b46501e128c3e93b89d529a086717a445c136651349a34d3a07cb63785cc898ea7040ab2635a2c7e283ae7dc04211d35d1b0f4178bdaaaf
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T1B834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snkfdxvpni.exe

Path C:\Temp\i_snkfdxvpni.exe
Size 226KB
SHA256 a46ec8919aa5e56cfd7e3d276225b4ed3246090c9231c15e67ef57fce83bfa60
MD5 78db2beb49e187aaf80fe2145499ddff
SHA1 a7c06a1efc3f4b560ec50d79a78080136bb76e43
SHA512 5caaf040372fe32498cb80d7fa876db0844a7bfeb6da454d78c22999230034d71b74532d94050eec3a57fa70e930ba2df92356453b6fdc76aa0adb18adeb6fcd
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T1C934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczusmkec.exe

Path C:\Temp\jhczusmkec.exe
Size 226KB
SHA256 71599efe10caf01e0a6582f198ba7e705cbca968b9df269b52c0d9fc62097fe3
MD5 9bf71b02bbce97089cfd0d9464d7a7f2
SHA1 56208ede5a0ad3d21e878b90d8c9da23afc8d91a
SHA512 96bc67ac396849514383604fc1653ca458acc7e83cbaefa168a90675c0e7a290b28ef00ecd7ba9248f6efb1a1973e5a7084ba24ac6a53f3daaafc439817f2361
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T15C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwrpbztr.exe

Path C:\Temp\kecwrpbztr.exe
Size 226KB
SHA256 564b5dd86fa60c015597cc8114d467a636e16b8d6ccdf9c758ede9caada293a1
MD5 621a77c0fc82dcde792d0675db043406
SHA1 d220fc9cc80b5183280619c53935ad658a7c7749
SHA512 a52306abe4fdf5672995d97a839ec618ff00fd7531b5ced5372634ee2a110e5c2db85e01f7b233ac9bc3fe9c913d3050c751f91c7f24025a74785a27d7bc9dba
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T1ED34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavtnlfd.sys

Path C:\Temp\lidavtnlfd.sys
Size 141KB
SHA256 5c0292925f34b641940d1511dbc74c7b1377dc9225b60eac769b4fd3a8abdf90
MD5 3b8542d57cb1cc498c7db7e51f0dae33
SHA1 83e1a06c563e05d91ce13180cd745a46425e6b18
SHA512 9d0421907060b8c988113d62dc140ddd3cf744ff858afea99cd175381043fcafd29935883b82d2e438cb2d6be66efc37596011a364144d93ab36d9f92e9f7d8f
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T169E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxspkic.sys

Path C:\Temp\nhfaxspkic.sys
Size 141KB
SHA256 56deb38b45ca8eed65992ac2276c498a3ff8d7cea89d9ae1a959146aaa7646c5
MD5 62e911e7f2daff71ff8436f0eb5ccb2d
SHA1 3e88499fe2865395fd50934fd9315adc3a987bbd
SHA512 71daf667475518527b44e4df845cda710553cb28247afc872779e73f9033a0459b157a08b673493ad9f7d7ff48152737271a69514f7741a4baf4526ad905ae3c
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbvtolg.exe

Path C:\Temp\rljdbvtolg.exe
Size 226KB
SHA256 ea8dfb50457136aa4fbb1239076a78a7a6c1eeca1ddc35aca438c5f5b6b59860
MD5 c5c912f38b481ea04d42b2ab1c49da9c
SHA1 66cded2d94d74587ca45b770ff12926912edbd2f
SHA512 320f68a0c777c153438356645d86d9ddd20a357ce177f45afd04437fdc27d8a035144559b477063c37197d9207421ec218e4ef81b96369cbf21717dc02f18c78
SSDEEP 3072:pGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:YXY4LK+a3lLNngoqRttA7
TLSH
T18234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfdxvpni.exe

Path C:\Temp\snkfdxvpni.exe
Size 226KB
SHA256 825794db84e1f7f18943192dddf384b0b1677f9932bf2a7cf26e030e12bfe8c4
MD5 88f68c04340bfd50973db72bd0ae0429
SHA1 1b8cf0757e5202f0496c02903a5fdf87c66dfc95
SHA512 d4d058872a7bd9ab63b9686a177eeb8623bd622b99bb1561c7d74907b36fb9e1407cfe2cb9595d8d2727c86e5e1f36783f689c3ed35ce7eaa68163b1dd51c4ab
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T18734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecwupm.sys

Path C:\Temp\usmkecwupm.sys
Size 141KB
SHA256 057c7198e0b6f2068aa61f618702a8d5ccee27643ac369ab86656e3ae0395998
MD5 8076c898d9560fe85041fd6fd4b625ee
SHA1 de70a017bef353e21b8672b43bfb19948d1452a2
SHA512 41e4f30c8a73dfbb6e72ca844c4dc0cbb4fcdd8ac29ce48c6b1604ec54dd4ef14c933513b5f019acd5478f27f06998e5ec227c634c093bc5bdaff56fff139fa4
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T147E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytnlgdywqo.sys

Path C:\Temp\ytnlgdywqo.sys
Size 141KB
SHA256 280bf118fdd1f7f504c3787c8ea97d837db130e09e55ab6c3fed7c8e2e8cc2ae
MD5 a776f3bc32ffa86da876f1700a479fbb
SHA1 3516b0ff78959aba0e3f030ec6a52a6fe7781b02
SHA512 dc36acde5f5a5be10dacb91368cd7ecd0e315eea1b9e1087f68d1f4a7407df7e55d4619144eda0120b7d4a97bc6735d2b5e815ae8137c0f8988439e66f3a2943
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T184E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqojgbytr.sys

Path C:\Temp\ywqojgbytr.sys
Size 141KB
SHA256 06a970f93aa65387af31ba758e0daecc999a08c03771fb3a09481c9d299eb34a
MD5 b5223aa96b62f4e03ab9dc59d0e3725d
SHA1 c1c44de05b830f3d339ac074895cda31e0434635
SHA512 b37fa1741de17fa3b036955fa2d942a893767ce48af4976540a23685a470b689d67f00edf166e3abca00bc0e727c28b17a21ce4f234071502a8194574ed0f42e
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 06fe9ecf09fe90f243a993c5257ff5eb95fd9e57c1e8774954d7e247ecc38a45
MD5 4193e41f442e7d04a7f3d0ebf4ba067c
SHA1 3469d96329436fd9f3a2f68cdcfbc1e2c5f5aef4
SHA512 40d5c9f3ff6db2369e45da7be83a62ce3f886ae4e62b4cf23b8744cf020077d8ee1f2047c08af2b3701ba6f10eedccc1388563f9b88282ab33951f1afbc82f23
TLSH
T111F0D4F341BDB8542FD164DC41BDD93E313194A7118342C1357D89E684593776F8E532
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 3aa4f41b4cc986e632ab2b3bc0e7f3d030558d8058fb038796809968ba695003
MD5 18c7a0d424795427f68bbe3d585cc92e
SHA1 4e5ba5b29d04831a501d9afb6cfb5ad66f631b07
SHA512 c0e639d86bb89ca073ad7c7b6915c9e4fe4941ee453b39edf0c5f82bf170910541dc8293de389fd83163a1ad6a68c8c6bde910c1ca5114a23a7c1ecec4121ebf
TLSH
T160E0C03411F6415FE4F4D4348BEA7435E4B9F0220418A7B429C45B04A702E00FC03D25
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QXG0Z7Y9\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/436-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/640-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/684-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/856-123-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/972-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1532-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1532-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1960-151-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1960-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2300-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2412-119-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2420-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3592-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3592-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3684-131-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3684-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4016-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4168-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4924-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4936-127-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4940-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads