b764d08952d48fbc7b39e0e89c6e417f67da5794f2e3bead15b8cf0e3d3abd38

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261002-xpppvax18k
SHA256 b764d08952d48fbc7b39e0e89c6e417f67da5794f2e3bead15b8cf0e3d3abd38
MD5 1aa03be950d671c10a418d942b6181f0
SHA1 b28693ea997862601d596f21622cfa3f20a58419
SHA512 51cd2408cc4ee24e5aabdb107255c7a52b84c3479177d75ebbde54ddd5f36dbb037c95cf36ea1813528661548befc7ee43f4df1e4f47cdf878d654750e279dbc
SSDEEP 3072:ZGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:IXY4LK+a3lLNngoqRttA7
TLSH
T1C034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2344	CP.exe
4396	tqljdbvtnl.exe
2980	CP.exe
1928	CP.exe
5016	i_tqljdbvtnl.exe
2592	lfdyvqniga.sys
1636	CP.exe
2924	aysqlidbvt.exe
632	CP.exe
2928	CP.exe
3740	i_aysqlidbvt.exe
4940	avpnifaxsq.sys
5092	CP.exe
3436	qnifaysqki.exe
4936	CP.exe
4560	CP.exe
4928	i_qnifaysqki.exe
3524	ysqkicavsn.sys
3624	CP.exe
4996	fcxvpnhfzx.exe
2260	CP.exe
4256	CP.exe
2292	i_fcxvpnhfzx.exe
4524	pkfcxupnhf.sys
4540	CP.exe
5072	fzxrpkhcau.exe
4508	CP.exe
564	CP.exe
1044	i_fzxrpkhcau.exe
1764	cxrpjhbzur.sys
3992	CP.exe
3224	smxrpkecwu.exe
1448	CP.exe
4104	CP.exe
4392	i_smxrpkecwu.exe
3148	ezxrpjhbzu.sys
2852	CP.exe
3648	trmjecwuom.exe
3308	CP.exe
3036	CP.exe
2328	i_trmjecwuom.exe
1028	zuomgeywro.sys
2620	CP.exe
3652	gbztrlgeyw.exe
1580	CP.exe
2368	CP.exe
3060	i_gbztrlgeyw.exe
4284	olgeywqoig.sys
4296	CP.exe
3832	gbytqljdbv.exe
2448	CP.exe
4088	CP.exe
4776	i_gbytqljdbv.exe
620	gdyvqoigay.sys
2936	CP.exe
3348	ysqlidbvtn.exe
1628	CP.exe
4272	CP.exe
2328	i_ysqlidbvtn.exe
1544	dxvqnigays.sys
3772	CP.exe
2864	sqkicavsnl.exe
3728	CP.exe
512	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smxrpkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrlgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smxrpkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrlgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcau.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1248	ipconfig.exe
1292	ipconfig.exe
1232	ipconfig.exe
3148	ipconfig.exe
3336	ipconfig.exe
4960	ipconfig.exe
4276	ipconfig.exe
880	ipconfig.exe
4312	ipconfig.exe
1248	ipconfig.exe
2628	ipconfig.exe
4632	ipconfig.exe
524	ipconfig.exe
3336	ipconfig.exe
1580	ipconfig.exe
3132	ipconfig.exe
1232	ipconfig.exe
524	ipconfig.exe
2464	ipconfig.exe
3124	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281824"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904ec0f4a852dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2454584468"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e000000000020000000000106600000001000020000000d04a00c4a89c802b7e72d919eca63f414b76760a24177f6ef52ff62f4c4bae77000000000e800000000200002000000010378f1aacbd8107271dc82708f9bc6112c144551f8a2af3c68b35f3945badae200000004487ba50bc637adaa8d2c18c4bab8f0d8fcda0b9d566211d96a472538f502ce040000000ea633a3d06ccfb2196a060a7e76ddeff1a5a00e0f233193abb8d9ff2fbf61859ad6e27037900d767cbca0de8d6a9673ae4542d7383c7b286c4b563518809b99f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BD824EAB-BE93-11F1-8007-768FA1516246} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e0000000000200000000001066000000010000200000004df59070576115917f4e64ccaf1e3732516d09e4a9eeeeea1a561305afeb646e000000000e800000000200002000000007d8400860d5b480f42feecda491caa6ac7b64928f8ff79df3fd08ee7a7dc3e520000000ee90fd0508d6b25995958955566484c614108f06a61a5789344d044497dfd3b040000000d05176310803620140757a7a1d3765e1ffcd2c5b9ec3a702c7341a76a2ac746125a3ddd8526946cefd0276cdd507e70f6e8f4bd123263885c9bb01526568083f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497732692"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281824"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807ac7f4a852dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2450990157"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	i_tqljdbvtnl.exe
Token: SeDebugPrivilege	3740	i_aysqlidbvt.exe
Token: SeDebugPrivilege	4928	i_qnifaysqki.exe
Token: SeDebugPrivilege	2292	i_fcxvpnhfzx.exe
Token: SeDebugPrivilege	1044	i_fzxrpkhcau.exe
Token: SeDebugPrivilege	4392	i_smxrpkecwu.exe
Token: SeDebugPrivilege	2328	i_trmjecwuom.exe
Token: SeDebugPrivilege	3060	i_gbztrlgeyw.exe
Token: SeDebugPrivilege	4776	i_gbytqljdbv.exe
Token: SeDebugPrivilege	2328	i_ysqlidbvtn.exe
Token: SeDebugPrivilege	4524	i_sqkicavsnl.exe
Token: SeDebugPrivilege	4680	i_snkfdxvpnh.exe
Token: SeDebugPrivilege	1124	i_nkfcxvpnhf.exe
Token: SeDebugPrivilege	1492	i_zusmkecwup.exe
Token: SeDebugPrivilege	4960	i_mhezxrpjhc.exe
Token: SeDebugPrivilege	2156	i_bwuomgezwr.exe
Token: SeDebugPrivilege	4920	i_wtomgeywro.exe
Token: SeDebugPrivilege	1068	i_oigbytnlgd.exe
Token: SeDebugPrivilege	2192	i_dxvqnigays.exe
Token: SeDebugPrivilege	1604	i_snkfdxvpni.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3376	iexplore.exe
3376	iexplore.exe
4336	IEXPLORE.EXE
4336	IEXPLORE.EXE
4336	IEXPLORE.EXE
4336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 3376	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 3376 wrote to memory of 4336	3376	iexplore.exe	88
PID 756 wrote to memory of 2344	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	92
PID 4396 wrote to memory of 2980	4396	tqljdbvtnl.exe	97
PID 756 wrote to memory of 1928	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 756 wrote to memory of 1636	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	109
PID 2924 wrote to memory of 632	2924	aysqlidbvt.exe	111
PID 756 wrote to memory of 2928	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 756 wrote to memory of 5092	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 3436 wrote to memory of 4936	3436	qnifaysqki.exe	120
PID 756 wrote to memory of 4560	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 756 wrote to memory of 3624	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 4996 wrote to memory of 2260	4996	fcxvpnhfzx.exe	129
PID 756 wrote to memory of 4256	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 756 wrote to memory of 4540	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 5072 wrote to memory of 4508	5072	fzxrpkhcau.exe	140
PID 756 wrote to memory of 564	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 756 wrote to memory of 3992	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 3224 wrote to memory of 1448	3224	smxrpkecwu.exe	155
PID 756 wrote to memory of 4104	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 756 wrote to memory of 2852	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 3648 wrote to memory of 3308	3648	trmjecwuom.exe	164
PID 756 wrote to memory of 3036	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 756 wrote to memory of 2620	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 3652 wrote to memory of 1580	3652	gbztrlgeyw.exe	173
PID 756 wrote to memory of 2368	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 756 wrote to memory of 4296	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 3832 wrote to memory of 2448	3832	gbytqljdbv.exe	182
PID 756 wrote to memory of 4088	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 756 wrote to memory of 2936	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	189
PID 3348 wrote to memory of 1628	3348	ysqlidbvtn.exe	191
PID 756 wrote to memory of 4272	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	194
PID 756 wrote to memory of 3772	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	200
PID 2864 wrote to memory of 3728	2864	sqkicavsnl.exe	202
PID 756 wrote to memory of 512	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	205
PID 756 wrote to memory of 828	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	209
PID 2836 wrote to memory of 3416	2836	snkfdxvpnh.exe	211
PID 756 wrote to memory of 4744	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	214
PID 756 wrote to memory of 4244	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	218
PID 2116 wrote to memory of 5012	2116	nkfcxvpnhf.exe	220
PID 756 wrote to memory of 2692	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	223
PID 756 wrote to memory of 1692	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	227
PID 1028 wrote to memory of 5104	1028	zusmkecwup.exe	229
PID 756 wrote to memory of 3244	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	232
PID 756 wrote to memory of 3524	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	236
PID 4652 wrote to memory of 3352	4652	mhezxrpjhc.exe	238
PID 756 wrote to memory of 4684	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	242
PID 756 wrote to memory of 3792	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	246
PID 2340 wrote to memory of 1644	2340	bwuomgezwr.exe	248
PID 756 wrote to memory of 1128	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	251
PID 756 wrote to memory of 3292	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	255
PID 4040 wrote to memory of 1544	4040	wtomgeywro.exe	257
PID 756 wrote to memory of 4448	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	260
PID 756 wrote to memory of 2808	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	264
PID 204 wrote to memory of 1612	204	oigbytnlgd.exe	266
PID 756 wrote to memory of 3300	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	269
PID 756 wrote to memory of 4768	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	273
PID 3636 wrote to memory of 1292	3636	dxvqnigays.exe	275
PID 756 wrote to memory of 5004	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	278
PID 756 wrote to memory of 1440	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	282
PID 2156 wrote to memory of 1880	2156	snkfdxvpni.exe	284
PID 756 wrote to memory of 772	756	2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe	287

C:\Users\Admin\AppData\Local\Temp\2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_1aa03be950d671c10a418d942b6181f0_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3376 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2344
- - C:\Temp\tqljdbvtnl.exe
    C:\Temp\tqljdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1928
- - C:\Temp\i_tqljdbvtnl.exe
    C:\Temp\i_tqljdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1636
- - C:\Temp\aysqlidbvt.exe
    C:\Temp\aysqlidbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2928
- - C:\Temp\i_aysqlidbvt.exe
    C:\Temp\i_aysqlidbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5092
- - C:\Temp\qnifaysqki.exe
    C:\Temp\qnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4560
- - C:\Temp\i_qnifaysqki.exe
    C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3624
- - C:\Temp\fcxvpnhfzx.exe
    C:\Temp\fcxvpnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4256
- - C:\Temp\i_fcxvpnhfzx.exe
    C:\Temp\i_fcxvpnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkhcau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4540
- - C:\Temp\fzxrpkhcau.exe
    C:\Temp\fzxrpkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:564
- - C:\Temp\i_fzxrpkhcau.exe
    C:\Temp\i_fzxrpkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smxrpkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3992
- - C:\Temp\smxrpkecwu.exe
    C:\Temp\smxrpkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smxrpkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4104
- - C:\Temp\i_smxrpkecwu.exe
    C:\Temp\i_smxrpkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2852
- - C:\Temp\trmjecwuom.exe
    C:\Temp\trmjecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3036
- - C:\Temp\i_trmjecwuom.exe
    C:\Temp\i_trmjecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrlgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2620
- - C:\Temp\gbztrlgeyw.exe
    C:\Temp\gbztrlgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrlgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2368
- - C:\Temp\i_gbztrlgeyw.exe
    C:\Temp\i_gbztrlgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytqljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4296
- - C:\Temp\gbytqljdbv.exe
    C:\Temp\gbytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytqljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4088
- - C:\Temp\i_gbytqljdbv.exe
    C:\Temp\i_gbytqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlidbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2936
- - C:\Temp\ysqlidbvtn.exe
    C:\Temp\ysqlidbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlidbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4272
- - C:\Temp\i_ysqlidbvtn.exe
    C:\Temp\i_ysqlidbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicavsnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3772
- - C:\Temp\sqkicavsnl.exe
    C:\Temp\sqkicavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicavsnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:512
- - C:\Temp\i_sqkicavsnl.exe
    C:\Temp\i_sqkicavsnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpnh.exe ups_run
  2⤵
  PID:828
- - C:\Temp\snkfdxvpnh.exe
    C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
  2⤵
  PID:4744
- - C:\Temp\i_snkfdxvpnh.exe
    C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcxvpnhf.exe ups_run
  2⤵
  PID:4244
- - C:\Temp\nkfcxvpnhf.exe
    C:\Temp\nkfcxvpnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcxvpnhf.exe ups_ins
  2⤵
  PID:2692
- - C:\Temp\i_nkfcxvpnhf.exe
    C:\Temp\i_nkfcxvpnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zusmkecwup.exe ups_run
  2⤵
  PID:1692
- - C:\Temp\zusmkecwup.exe
    C:\Temp\zusmkecwup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zusmkecwup.exe ups_ins
  2⤵
  PID:3244
- - C:\Temp\i_zusmkecwup.exe
    C:\Temp\i_zusmkecwup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezxrpjhc.exe ups_run
  2⤵
  PID:3524
- - C:\Temp\mhezxrpjhc.exe
    C:\Temp\mhezxrpjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezxrpjhc.exe ups_ins
  2⤵
  PID:4684
- - C:\Temp\i_mhezxrpjhc.exe
    C:\Temp\i_mhezxrpjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomgezwr.exe ups_run
  2⤵
  PID:3792
- - C:\Temp\bwuomgezwr.exe
    C:\Temp\bwuomgezwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomgezwr.exe ups_ins
  2⤵
  PID:1128
- - C:\Temp\i_bwuomgezwr.exe
    C:\Temp\i_bwuomgezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtomgeywro.exe ups_run
  2⤵
  PID:3292
- - C:\Temp\wtomgeywro.exe
    C:\Temp\wtomgeywro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtomgeywro.exe ups_ins
  2⤵
  PID:4448
- - C:\Temp\i_wtomgeywro.exe
    C:\Temp\i_wtomgeywro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytnlgd.exe ups_run
  2⤵
  PID:2808
- - C:\Temp\oigbytnlgd.exe
    C:\Temp\oigbytnlgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytnlgd.exe ups_ins
  2⤵
  PID:3300
- - C:\Temp\i_oigbytnlgd.exe
    C:\Temp\i_oigbytnlgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqnigays.exe ups_run
  2⤵
  PID:4768
- - C:\Temp\dxvqnigays.exe
    C:\Temp\dxvqnigays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqnigays.exe ups_ins
  2⤵
  PID:5004
- - C:\Temp\i_dxvqnigays.exe
    C:\Temp\i_dxvqnigays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpni.exe ups_run
  2⤵
  PID:1440
- - C:\Temp\snkfdxvpni.exe
    C:\Temp\snkfdxvpni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpni.exe ups_ins
  2⤵
  PID:772
- - C:\Temp\i_snkfdxvpni.exe
    C:\Temp\i_snkfdxvpni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1604

C:\Temp\lfdyvqniga.sys
C:\Temp\lfdyvqniga.sys
1⤵
- Executes dropped EXE
PID:2592

C:\Temp\avpnifaxsq.sys
C:\Temp\avpnifaxsq.sys
1⤵
- Executes dropped EXE
PID:4940

C:\Temp\ysqkicavsn.sys
C:\Temp\ysqkicavsn.sys
1⤵
- Executes dropped EXE
PID:3524

C:\Temp\pkfcxupnhf.sys
C:\Temp\pkfcxupnhf.sys
1⤵
- Executes dropped EXE
PID:4524

C:\Temp\cxrpjhbzur.sys
C:\Temp\cxrpjhbzur.sys
1⤵
- Executes dropped EXE
PID:1764

C:\Temp\ezxrpjhbzu.sys
C:\Temp\ezxrpjhbzu.sys
1⤵
- Executes dropped EXE
PID:3148

C:\Temp\zuomgeywro.sys
C:\Temp\zuomgeywro.sys
1⤵
- Executes dropped EXE
PID:1028

C:\Temp\olgeywqoig.sys
C:\Temp\olgeywqoig.sys
1⤵
- Executes dropped EXE
PID:4284

C:\Temp\gdyvqoigay.sys
C:\Temp\gdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:620

C:\Temp\dxvqnigays.sys
C:\Temp\dxvqnigays.sys
1⤵
- Executes dropped EXE
PID:1544

C:\Temp\igaysqkida.sys
C:\Temp\igaysqkida.sys
1⤵
PID:3068

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
PID:4668

C:\Temp\mhczusmkec.sys
C:\Temp\mhczusmkec.sys
1⤵
PID:1544

C:\Temp\wrpjhbzurm.sys
C:\Temp\wrpjhbzurm.sys
1⤵
PID:3184

C:\Temp\rmjebwuomg.sys
C:\Temp\rmjebwuomg.sys
1⤵
PID:4616

C:\Temp\geywrojgbz.sys
C:\Temp\geywrojgbz.sys
1⤵
PID:4276

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
PID:4928

C:\Temp\nlfdyvqoig.sys
C:\Temp\nlfdyvqoig.sys
1⤵
PID:4312

C:\Temp\lgaysqkida.sys
C:\Temp\lgaysqkida.sys
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avpnifaxsq.sys

Path C:\Temp\avpnifaxsq.sys
Size 141KB
SHA256 83b3ab36231180a491430fca44ef63b20f6aadf795918241979efbb31ff0c54f
MD5 745dbe6efc619b084ac4c6d7d4bd4f19
SHA1 e0b02b80c872748d539dcfc63619476f86b5debe
SHA512 5c0a9dc9ab08eb9cab9425f2b50c8599012a65852530cae496ec8516044eaf56c7c846400c354194cbf1980711ca7aabd56b77ab4785b35b8e18b85d8a2f86d6
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqlidbvt.exe

Path C:\Temp\aysqlidbvt.exe
Size 226KB
SHA256 d5bb3f512fb4969c2cb030bba7a792b17a227641d416032c0446117fb953c874
MD5 27efd63b46dd3b1ebd9de2d7a0e01f0d
SHA1 1dc305c9342c07b4e9c95c48de896190b22f9565
SHA512 91cb44a525969be0091af85c7824bfabeb8075000cd8355ef7116a2ebccd0eb6c9730a1a6f730d7febeb7ba25aa1e83db7832a4f55bb5015e676f5d2021d00bf
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T14234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxrpjhbzur.sys

Path C:\Temp\cxrpjhbzur.sys
Size 141KB
SHA256 6a583585c1030b35181eb227184154ea142ecf29e906ce81347d25786d7b9820
MD5 d46553f646f778c6cce1894d460614a7
SHA1 d979b6bcbbe83e215cd856978c9a3a7b6c8a3571
SHA512 f0f90da7d42078f2ee5a507f66e925460e75a2509e17fb0268cb9c8b80af36a7adcddb12051dcfcadcba305f1e08f08069c7ec2f4eda514c505096eacc843978
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DCE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezxrpjhbzu.sys

Path C:\Temp\ezxrpjhbzu.sys
Size 141KB
SHA256 eca759b448712bc4f86874acd60081a2579c0081fb0eed049dbac64a0969bcc2
MD5 96b96d1b2354feef751edb50cb8fa9c3
SHA1 dd3cf9826a858616e2087e4ddc97b112c8dff933
SHA512 7cf869111178b370f33b2cfc12e7229218e7fbdcbaadef3c627ddb1b092135712cb03c2eaeb8024cc4c2096ce235e8fac0950b1929f3d158864eef68d0355f42
SSDEEP 3072:iia3rV3dZPFvOAngoRUAFa1nxayHdXkb:iia3lLNngoqRt
TLSH
T1C2E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvpnhfzx.exe

Path C:\Temp\fcxvpnhfzx.exe
Size 226KB
SHA256 02dd0ff4c554cb8ba4371781040d6e0b9eb489362cd03220d09de68f591383a8
MD5 cadb90ac96dfaa3d808e60b772678f73
SHA1 71eb027c1e95cb5e5729402287ec7f1e7a66b357
SHA512 de8702441f2d57ef16b137a5599ad94d8fc64a62186dc532fc1e7fb3d4d0535fccc5efac0831b760a659a0ac07cb077d8bc12e482e224537b7df3c370d31803c
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T1CB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhcau.exe

Path C:\Temp\fzxrpkhcau.exe
Size 226KB
SHA256 d019731f3553b956af8329247244d55fd98b7970ed22992ad503bf893fef1098
MD5 266bf641ddbc138dc8b06a803eb75328
SHA1 b0d13e0a8a9597d8234c230436440e6acc678435
SHA512 454f9bcec2fff453a04ba896188d2ad69f26dbf74b871c2ee2e03d809243d53d659ac59b98b5212a9c2e8ff4aa457d234eb14227a3ade03915ef1e08ac8fd357
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T18734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrlgeyw.exe

Path C:\Temp\gbztrlgeyw.exe
Size 226KB
SHA256 34959c87a3560e8f76ec06bf9d468c362356c86140a922f213297044cb9af64d
MD5 d1a9f248308c18374ba5735dc43c8f47
SHA1 257aa7f65f1ded8c0c6cec030baa35cf9bd527da
SHA512 8b5cf7b3b567de1b099cdbe91fd592561632932ac6dc6e671e97a50d072cd1ffa736b3df2a41a297d64847048cc165d9e026ca7252c923dbc1b22450b5d6e532
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T14934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqlidbvt.exe

Path C:\Temp\i_aysqlidbvt.exe
Size 226KB
SHA256 09b3e21fc33fda6887c3ad896bc25ec9baef9240c377ab84bb6cd03370d92725
MD5 28c85326f0c9fdd72c2411c34cbad260
SHA1 0e8e166eb68795d0cda2ca4b2fe2f830c0f8104c
SHA512 9c82f589b8aa75dc23e8d3ef1ebd8c4acae47d724eed551b39c7af517aaa03815bf5ebc575d68a4fdd597292cbce3b408389407c79e6953b293d59ed8d21a5c2
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T15E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcxvpnhfzx.exe

Path C:\Temp\i_fcxvpnhfzx.exe
Size 226KB
SHA256 f15922e2b6b46c7809b0b2e84fe4685a9cf8e3273f46cc26eebc50097a5a275c
MD5 8cb721a692d4448c44a63f5078b3e02e
SHA1 90caebf8cd93b2d7b9adc062484ab5e2f1e03659
SHA512 f2da3f5830778d18bfa95d66d36345cd789731d115c54586541c54903729b220ac5939481469b4b52e0496679f98d3ea27ed5e74eeaa3f7dfab869c7166704a1
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T15834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpkhcau.exe

Path C:\Temp\i_fzxrpkhcau.exe
Size 226KB
SHA256 99c0682d0f41cc3c64eeecb26ecefad9b36ff2337cd419b2c983b2b653b1d3ef
MD5 19bce17c68ef9cbaacf058a56a689eba
SHA1 ade92f1cd99a6eef40d77472677f8d1eb455085b
SHA512 6aa940d5c5c913fd433481330dbf972f0923a2e9e84c407ec5a36e7c83759f9f17143833794551598f6274274c4305166bfa175dc907ef7e9ea976994fd0dcf0
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T16B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnifaysqki.exe

Path C:\Temp\i_qnifaysqki.exe
Size 226KB
SHA256 28083e474f2fdce9bb11fa0450ea9918517068e3b60f4f26a7659bf389be6e7f
MD5 aaaf67c4b72658b77f36339aded1bde6
SHA1 65f3106f48d56407c6d128c1e86221fd9d498504
SHA512 5749fc56f4f21061ad4e6a3b07353840d1bce2ce6b04bd2509101b4a341e4d0b9883221a7ee6e4c6291477d6bbd8d3a89c31c336ac84dc8f6bce659cadd26721
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T18634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smxrpkecwu.exe

Path C:\Temp\i_smxrpkecwu.exe
Size 226KB
SHA256 d571c8184980709cf350fea27349b611af73dce4feb0cd5895e99a8da5daaaab
MD5 9654c6bb8b0783a1e002989d551e86d0
SHA1 0227819bdd8db8cc160d4ac07f4e0858ea69cce0
SHA512 8f40fa46869116212b8a7574b36d3e5cb0cfa7e3f85bc1d37e8504ecc00fd4be28358515e9d52dd0ed08a590d8decbada975f0544ed662b70a01228bf1ec757e
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T1CF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqljdbvtnl.exe

Path C:\Temp\i_tqljdbvtnl.exe
Size 226KB
SHA256 e906cb12de83156cd447fb36e03bcba77de286c057e5b1b621b08a2b57c8d80c
MD5 0d45f07829d330a3a8704cd1bca1148a
SHA1 9b65999bedf9409545d385d7e9b09835b1103939
SHA512 93553cbab24c806c96ee00c70291c20fe8416fee8239f69b109640a2affb46a002df8f3ff3bc6d316b59933efb2233497ad17628227225b76c32886018016b46
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T18E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjecwuom.exe

Path C:\Temp\i_trmjecwuom.exe
Size 226KB
SHA256 0f7a89a76e7c6aa02f8cf2edcb498258a86143749b7582f9edab83b89b297111
MD5 6c4c8b6b077b67cba2f55163d1e9878e
SHA1 018bb39642b61c35bb2f16207181848a18374cbe
SHA512 703c7e2664685db9c2fa6ccfb3a90706a05b34860363ef296419787e4e804d01be92b1707a15f7216f69bf6e493a1a119150aef3c9d2b123b89ee0588d7b7741
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T15434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqniga.sys

Path C:\Temp\lfdyvqniga.sys
Size 141KB
SHA256 e5ca0d67ae3d4afd4c7de6128ff9891e227544eb121a987b3be77195b8238730
MD5 3708db3fbf38f53ffe78edcab19278b7
SHA1 d7b442b6267f89b4e0160cc824ed02e49e27c5b4
SHA512 cd0fb06f47b76aadc9ddac237bc98f85b7aa88a5f51bd6ac82204f9d2546b64a69847ad022f095852480ca293fc1073c35e61d18bbf3bf0703c3feb459f5488b
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17BE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkfcxupnhf.sys

Path C:\Temp\pkfcxupnhf.sys
Size 141KB
SHA256 baaa26c28027179f8d39532223e842d05b6110cfd920c5d7d2e68eb07de44186
MD5 efcd19a8af816ca64c0f5ccca5df3ad7
SHA1 b04b477a275741b3e1e7a21c87becd795df96f53
SHA512 ab548c835ce40a6166b62a52cb0f095a90b13c47ba95a390bb4236a07634799ceb0a3ce910f02e4975d3545f74bf7170d9e365eadccf055bd27f7c096d75d5c7
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T142E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifaysqki.exe

Path C:\Temp\qnifaysqki.exe
Size 226KB
SHA256 340e9bb683bf8ae0f90e953f2e674c3a251de65ecd043cc71b984dc53b2b0b6c
MD5 2b1467288c3c5b9ceb2b83b0e68327bc
SHA1 35ae7b92e1fe90b9c97fdc65970e39424a26b6f8
SHA512 65dd3340f150c53e4b7e03d74e34b6e0f6c821de7514af16d61cbc71ff4ea4c75c24e4762f48e06fd0cbae058f84a6bd543c86bdb70a9843058dc5d64422f04d
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T10634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smxrpkecwu.exe

Path C:\Temp\smxrpkecwu.exe
Size 226KB
SHA256 f28ec12c73389cfc9cd19d933166c84cbbeee876286cadb34b8eb2389c966a71
MD5 5a2d887ff44fb61b5eedf2641c6873b2
SHA1 035944ddf41f5f8b4c1681de7ebef11d4ad7eab9
SHA512 03402f97ce6e31a9a94eaf22599a40bcef7c952068159f69715207d5e38a535a89d60b3cabe0a281550895312e3360e4895a376858d9674c695ff6726580193e
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T18C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtnl.exe

Path C:\Temp\tqljdbvtnl.exe
Size 226KB
SHA256 4b3d1b0310eae80006bbe498a75c092fa48e294e951d7aab94b9c7004c2a1c35
MD5 d2e5937f62662cc9740ef5a087602ea2
SHA1 446c1c4c7cfdade4933970ce5eda8575bf1cb758
SHA512 09a8826449a8b2f7c4446dbaf76d69a4f8cb722dc28049bb966e9322a0b29cd8e588634c2edfa73ee4345e7256185d5aa842eaa22215d84fb30b28ed8ccd98a7
SSDEEP 3072:ZGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:IXY4LK+a3lLNngoqRttA7
TLSH
T11534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecwuom.exe

Path C:\Temp\trmjecwuom.exe
Size 226KB
SHA256 221c5d29ac70a903d5934ec16749c0ebf3ba05d02ea044b1e4bbbb9df05ec560
MD5 a866ed919becaa22f50a072eb05c0660
SHA1 c89c7d43d28510054ab4f314e600f303c30d1f9b
SHA512 f586b734267d13e85319d838069d782fdfd4f85492226a3e27faa8eff619d24945e01fa4758aae071061af5b4b2579eee2facc4965118aeba982235f886b9ccd
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T1C334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicavsn.sys

Path C:\Temp\ysqkicavsn.sys
Size 141KB
SHA256 31fb37c29182b84ba93a8fa1bcbed7b51ae5d4d607cf6036d58f85e67fc9c463
MD5 dcae00b156d1dbd3e5ecd234c7c9a0c7
SHA1 617d5152690c2ef1f2a2160738e67ffd68a174fb
SHA512 df837575baeddd549bf9595c96c450d2d091cf6f3051be79f2c29f1134627d91fd4c4c6f614571f7ee3d02a0024385181482ebc5235fe5e26296e4adfd5940cd
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T193E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuomgeywro.sys

Path C:\Temp\zuomgeywro.sys
Size 141KB
SHA256 5dcd138f7715668ca05199b8c8399f940f2694802207b254fad6d3e8e8758514
MD5 db848abb61cc407019111e148c36d5f5
SHA1 bc1592d74972ca87e9de7accf56ee3d6b9fa3a60
SHA512 3ca39966e5461c00f4b863057eda943bd32c2743dc64221810a33c98b1cafc144138884760cd3c940c82af0500e77563ef0c529776b74f61bc9c9f575230cd71
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T186E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 06fe9ecf09fe90f243a993c5257ff5eb95fd9e57c1e8774954d7e247ecc38a45
MD5 4193e41f442e7d04a7f3d0ebf4ba067c
SHA1 3469d96329436fd9f3a2f68cdcfbc1e2c5f5aef4
SHA512 40d5c9f3ff6db2369e45da7be83a62ce3f886ae4e62b4cf23b8744cf020077d8ee1f2047c08af2b3701ba6f10eedccc1388563f9b88282ab33951f1afbc82f23
TLSH
T111F0D4F341BDB8542FD164DC41BDD93E313194A7118342C1357D89E684593776F8E532
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 c5c9ca75ac9a39bc4e483f3a7248821c7c2c32514f3afa11ed6e06726e449423
MD5 a8838f91b2b0e154dd668502e2094f50
SHA1 7e43140dab94b57e616c1f3e8af7727fb3118ad3
SHA512 3a07ee20961e68ee6b8dbdd06f69a3d29bd26b1344cda7ed1e6393ff56a7dd32ff9db601626d66cb71c8dd87055fd375000abdde2cb8a970d9c7b6a4d9fa9c56
TLSH
T13AE0C03411F6415FE5F4D4358BDAB4318469F1220458A6B829C45B04B702A40EC03925
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0OIDP0T3\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CP.exe

Path C:\temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1028-98-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1544-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1544-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1764-74-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2592-19-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3068-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3148-86-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3184-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3524-43-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4276-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4284-107-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4312-165-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4312-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4500-164-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4524-60-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4616-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4668-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4928-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4940-31-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads