b3942faf17a446a3d33bdf8f2edcfa0dd1c75b226c237a672c5ac6aa9832611a

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261017-tdxdrsas21
SHA256 b3942faf17a446a3d33bdf8f2edcfa0dd1c75b226c237a672c5ac6aa9832611a
MD5 643aceb0539581f8749e4d8dcdade5a7
SHA1 21b10e5191aac69bcc0dda8788f713da7ff5ba21
SHA512 5968d95916e18143414a1ec893d06b8919a45eafb87650b96f8d7f1769854cb35aa7d8b4afe143865b01a52fdff31d58857b2243855f7ac55a36a1ca1542876f
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T1A934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5056	CP.exe
4532	igaytnlfdx.exe
3468	CP.exe
3884	CP.exe
4540	i_igaytnlfdx.exe
4732	avsnlfdxvp.sys
4252	CP.exe
4024	pnifaxsqki.exe
3228	CP.exe
1192	CP.exe
4464	i_pnifaxsqki.exe
4816	nkfcxvpnhf.sys
4572	CP.exe
3076	fzxspkicau.exe
4116	CP.exe
4160	CP.exe
4368	i_fzxspkicau.exe
4744	hfzxrpkhca.sys
2556	CP.exe
4264	rmkecwupmh.exe
4948	CP.exe
4428	CP.exe
2368	i_rmkecwupmh.exe
4736	zusmkecwup.sys
1176	CP.exe
5084	pkecwuomhe.exe
5004	CP.exe
1524	CP.exe
3816	i_pkecwuomhe.exe
4608	jecwuomhez.sys
4168	CP.exe
5096	zwrpjebwuo.exe
2852	CP.exe
1180	CP.exe
2800	i_zwrpjebwuo.exe
3292	ztrljdbwto.sys
4368	CP.exe
4844	olgeywqoig.exe
4216	CP.exe
3432	CP.exe
4640	i_olgeywqoig.exe
4500	wqojgbytrl.sys
4444	CP.exe
2072	dyvqoigbyt.exe
4540	CP.exe
3288	CP.exe
3700	i_dyvqoigbyt.exe
3832	nigaytqljd.sys
3928	CP.exe
4524	dbvtnlfdyv.exe
2452	CP.exe
780	CP.exe
4464	i_dbvtnlfdyv.exe
4952	fdxvpnifay.sys
3028	CP.exe
4036	xvqnigaysn.exe
1984	CP.exe
2896	CP.exe
4200	i_xvqnigaysn.exe
5116	xsqkicausn.sys
728	CP.exe
4920	nkfzxspkic.exe
3968	CP.exe
4980	CP.exe

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnigaysn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnigaysn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjebwuo.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
8	ipconfig.exe
4120	ipconfig.exe
1272	ipconfig.exe
2936	ipconfig.exe
1664	ipconfig.exe
1092	ipconfig.exe
4000	ipconfig.exe
2900	ipconfig.exe
2980	ipconfig.exe
952	ipconfig.exe
3268	ipconfig.exe
4120	ipconfig.exe
2624	ipconfig.exe
3896	ipconfig.exe
2772	ipconfig.exe
4552	ipconfig.exe
4668	ipconfig.exe
3732	ipconfig.exe
4640	ipconfig.exe
1112	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca00000000020000000000106600000001000020000000b016448d0f25db792f40eb8aa680ccfeebcdc6c3738725e3f73fbe0614901339000000000e80000000020000200000007d21a2f68528b36f025d650312a258541f1129c0ab77f00b70bb6c6b1306f1eb200000006c727208bfd752e27bb22b35a57a0baa1b33c69fbe85ecb0c2704765f959795840000000f5c0af32d9119b3f94b6e8e71db33410acd37a5912094f1ae1e2bb8731afd33de56fe2ffa41c12e42f08375b03557f2f2a19542ed5fcb5efdde2298ea60f75a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7043e29c585edd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284816"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca000000000200000000001066000000010000200000000abd5119a8e3f2a5a2746b696180b879a7cebf4eca596a821944e5fd27e3b162000000000e8000000002000020000000abf9fe2c76e1a41875f8d84e5e4e169dddcb94d9b1ab8f9ac5987f315de99d7220000000f79521e8c7564e669d9a65944def01289c8b06224d02d7e0df56138c72ed07db40000000b2d3e3c3485e5b528ca221c887960c5e8799459c5628b3244e0ac2f2b1bfcd7e9887388b41f8f41736fcdea70cdfec1c840397a41177a138709fcef5ed3bd6dc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606fe99c585edd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "499017600"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{65BECED3-CA43-11F1-8F8C-CAA8D6BDFC74} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "977758066"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284816"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "986352000"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	i_igaytnlfdx.exe
Token: SeDebugPrivilege	4464	i_pnifaxsqki.exe
Token: SeDebugPrivilege	4368	i_fzxspkicau.exe
Token: SeDebugPrivilege	2368	i_rmkecwupmh.exe
Token: SeDebugPrivilege	3816	i_pkecwuomhe.exe
Token: SeDebugPrivilege	2800	i_zwrpjebwuo.exe
Token: SeDebugPrivilege	4640	i_olgeywqoig.exe
Token: SeDebugPrivilege	3700	i_dyvqoigbyt.exe
Token: SeDebugPrivilege	4464	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	4200	i_xvqnigaysn.exe
Token: SeDebugPrivilege	3604	i_nkfzxspkic.exe
Token: SeDebugPrivilege	2220	i_hfzxspkhca.exe
Token: SeDebugPrivilege	4704	i_hezxrpjhcz.exe
Token: SeDebugPrivilege	2156	i_ezwrpjhbzt.exe
Token: SeDebugPrivilege	3176	i_ywqojgbztr.exe
Token: SeDebugPrivilege	3352	i_jdbvtolgdy.exe
Token: SeDebugPrivilege	4408	i_lfdywqoigb.exe
Token: SeDebugPrivilege	4816	i_fdxvqnifay.exe
Token: SeDebugPrivilege	2828	i_xvpnhfaxsq.exe
Token: SeDebugPrivilege	3924	i_upnhfzxrpk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4056	iexplore.exe
4056	iexplore.exe
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 4056	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	86
PID 4056 wrote to memory of 3212	4056	iexplore.exe	87
PID 760 wrote to memory of 5056	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	91
PID 4532 wrote to memory of 3468	4532	igaytnlfdx.exe	96
PID 760 wrote to memory of 3884	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 760 wrote to memory of 4252	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 4024 wrote to memory of 3228	4024	pnifaxsqki.exe	109
PID 760 wrote to memory of 1192	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	112
PID 760 wrote to memory of 4572	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 3076 wrote to memory of 4116	3076	fzxspkicau.exe	119
PID 760 wrote to memory of 4160	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 760 wrote to memory of 2556	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 4264 wrote to memory of 4948	4264	rmkecwupmh.exe	128
PID 760 wrote to memory of 4428	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 760 wrote to memory of 1176	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 5084 wrote to memory of 5004	5084	pkecwuomhe.exe	139
PID 760 wrote to memory of 1524	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 760 wrote to memory of 4168	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 5096 wrote to memory of 2852	5096	zwrpjebwuo.exe	148
PID 760 wrote to memory of 1180	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 760 wrote to memory of 4368	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 4844 wrote to memory of 4216	4844	olgeywqoig.exe	157
PID 760 wrote to memory of 3432	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 760 wrote to memory of 4444	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 2072 wrote to memory of 4540	2072	dyvqoigbyt.exe	166
PID 760 wrote to memory of 3288	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 760 wrote to memory of 3928	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 4524 wrote to memory of 2452	4524	dbvtnlfdyv.exe	175
PID 760 wrote to memory of 780	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 760 wrote to memory of 3028	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 4036 wrote to memory of 1984	4036	xvqnigaysn.exe	184
PID 760 wrote to memory of 2896	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 760 wrote to memory of 728	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 4920 wrote to memory of 3968	4920	nkfzxspkic.exe	193
PID 760 wrote to memory of 4980	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	196
PID 760 wrote to memory of 4468	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	200
PID 360 wrote to memory of 2808	360	hfzxspkhca.exe	202
PID 760 wrote to memory of 1108	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	205
PID 760 wrote to memory of 1876	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	209
PID 3380 wrote to memory of 1572	3380	hezxrpjhcz.exe	211
PID 760 wrote to memory of 4852	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	214
PID 760 wrote to memory of 4716	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	218
PID 4636 wrote to memory of 1544	4636	ezwrpjhbzt.exe	220
PID 760 wrote to memory of 3312	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	223
PID 760 wrote to memory of 5060	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	227
PID 4184 wrote to memory of 3616	4184	ywqojgbztr.exe	229
PID 760 wrote to memory of 4020	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	232
PID 760 wrote to memory of 2860	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	236
PID 4484 wrote to memory of 4064	4484	jdbvtolgdy.exe	238
PID 760 wrote to memory of 4932	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	241
PID 760 wrote to memory of 1196	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	245
PID 1940 wrote to memory of 3932	1940	lfdywqoigb.exe	247
PID 760 wrote to memory of 1240	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	250
PID 760 wrote to memory of 1576	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	254
PID 4608 wrote to memory of 4680	4608	fdxvqnifay.exe	256
PID 760 wrote to memory of 4704	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	259
PID 760 wrote to memory of 3988	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	263
PID 4616 wrote to memory of 1112	4616	xvpnhfaxsq.exe	265
PID 760 wrote to memory of 2944	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	268
PID 760 wrote to memory of 3032	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	272
PID 2624 wrote to memory of 1256	2624	upnhfzxrpk.exe	274
PID 760 wrote to memory of 4640	760	2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe	277

C:\Users\Admin\AppData\Local\Temp\2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_643aceb0539581f8749e4d8dcdade5a7_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4056 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytnlfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5056
- - C:\Temp\igaytnlfdx.exe
    C:\Temp\igaytnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:8
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytnlfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3884
- - C:\Temp\i_igaytnlfdx.exe
    C:\Temp\i_igaytnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaxsqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4252
- - C:\Temp\pnifaxsqki.exe
    C:\Temp\pnifaxsqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaxsqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1192
- - C:\Temp\i_pnifaxsqki.exe
    C:\Temp\i_pnifaxsqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4572
- - C:\Temp\fzxspkicau.exe
    C:\Temp\fzxspkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4160
- - C:\Temp\i_fzxspkicau.exe
    C:\Temp\i_fzxspkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmkecwupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2556
- - C:\Temp\rmkecwupmh.exe
    C:\Temp\rmkecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmkecwupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4428
- - C:\Temp\i_rmkecwupmh.exe
    C:\Temp\i_rmkecwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkecwuomhe.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1176
- - C:\Temp\pkecwuomhe.exe
    C:\Temp\pkecwuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkecwuomhe.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1524
- - C:\Temp\i_pkecwuomhe.exe
    C:\Temp\i_pkecwuomhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrpjebwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4168
- - C:\Temp\zwrpjebwuo.exe
    C:\Temp\zwrpjebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrpjebwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1180
- - C:\Temp\i_zwrpjebwuo.exe
    C:\Temp\i_zwrpjebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4368
- - C:\Temp\olgeywqoig.exe
    C:\Temp\olgeywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3432
- - C:\Temp\i_olgeywqoig.exe
    C:\Temp\i_olgeywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4444
- - C:\Temp\dyvqoigbyt.exe
    C:\Temp\dyvqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3288
- - C:\Temp\i_dyvqoigbyt.exe
    C:\Temp\i_dyvqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnlfdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3928
- - C:\Temp\dbvtnlfdyv.exe
    C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:780
- - C:\Temp\i_dbvtnlfdyv.exe
    C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvqnigaysn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3028
- - C:\Temp\xvqnigaysn.exe
    C:\Temp\xvqnigaysn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvqnigaysn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2896
- - C:\Temp\i_xvqnigaysn.exe
    C:\Temp\i_xvqnigaysn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfzxspkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:728
- - C:\Temp\nkfzxspkic.exe
    C:\Temp\nkfzxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfzxspkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4980
- - C:\Temp\i_nkfzxspkic.exe
    C:\Temp\i_nkfzxspkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkhca.exe ups_run
  2⤵
  PID:4468
- - C:\Temp\hfzxspkhca.exe
    C:\Temp\hfzxspkhca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkhca.exe ups_ins
  2⤵
  PID:1108
- - C:\Temp\i_hfzxspkhca.exe
    C:\Temp\i_hfzxspkhca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezxrpjhcz.exe ups_run
  2⤵
  PID:1876
- - C:\Temp\hezxrpjhcz.exe
    C:\Temp\hezxrpjhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezxrpjhcz.exe ups_ins
  2⤵
  PID:4852
- - C:\Temp\i_hezxrpjhcz.exe
    C:\Temp\i_hezxrpjhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run
  2⤵
  PID:4716
- - C:\Temp\ezwrpjhbzt.exe
    C:\Temp\ezwrpjhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins
  2⤵
  PID:3312
- - C:\Temp\i_ezwrpjhbzt.exe
    C:\Temp\i_ezwrpjhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojgbztr.exe ups_run
  2⤵
  PID:5060
- - C:\Temp\ywqojgbztr.exe
    C:\Temp\ywqojgbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojgbztr.exe ups_ins
  2⤵
  PID:4020
- - C:\Temp\i_ywqojgbztr.exe
    C:\Temp\i_ywqojgbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtolgdy.exe ups_run
  2⤵
  PID:2860
- - C:\Temp\jdbvtolgdy.exe
    C:\Temp\jdbvtolgdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtolgdy.exe ups_ins
  2⤵
  PID:4932
- - C:\Temp\i_jdbvtolgdy.exe
    C:\Temp\i_jdbvtolgdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdywqoigb.exe ups_run
  2⤵
  PID:1196
- - C:\Temp\lfdywqoigb.exe
    C:\Temp\lfdywqoigb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdywqoigb.exe ups_ins
  2⤵
  PID:1240
- - C:\Temp\i_lfdywqoigb.exe
    C:\Temp\i_lfdywqoigb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnifay.exe ups_run
  2⤵
  PID:1576
- - C:\Temp\fdxvqnifay.exe
    C:\Temp\fdxvqnifay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnifay.exe ups_ins
  2⤵
  PID:4704
- - C:\Temp\i_fdxvqnifay.exe
    C:\Temp\i_fdxvqnifay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxsq.exe ups_run
  2⤵
  PID:3988
- - C:\Temp\xvpnhfaxsq.exe
    C:\Temp\xvpnhfaxsq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
  2⤵
  PID:2944
- - C:\Temp\i_xvpnhfaxsq.exe
    C:\Temp\i_xvpnhfaxsq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upnhfzxrpk.exe ups_run
  2⤵
  PID:3032
- - C:\Temp\upnhfzxrpk.exe
    C:\Temp\upnhfzxrpk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upnhfzxrpk.exe ups_ins
  2⤵
  PID:4640
- - C:\Temp\i_upnhfzxrpk.exe
    C:\Temp\i_upnhfzxrpk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3924

C:\Temp\avsnlfdxvp.sys
C:\Temp\avsnlfdxvp.sys
1⤵
- Executes dropped EXE
PID:4732

C:\Temp\nkfcxvpnhf.sys
C:\Temp\nkfcxvpnhf.sys
1⤵
- Executes dropped EXE
PID:4816

C:\Temp\hfzxrpkhca.sys
C:\Temp\hfzxrpkhca.sys
1⤵
- Executes dropped EXE
PID:4744

C:\Temp\zusmkecwup.sys
C:\Temp\zusmkecwup.sys
1⤵
- Executes dropped EXE
PID:4736

C:\Temp\jecwuomhez.sys
C:\Temp\jecwuomhez.sys
1⤵
- Executes dropped EXE
PID:4608

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:3292

C:\Temp\wqojgbytrl.sys
C:\Temp\wqojgbytrl.sys
1⤵
- Executes dropped EXE
PID:4500

C:\Temp\nigaytqljd.sys
C:\Temp\nigaytqljd.sys
1⤵
- Executes dropped EXE
PID:3832

C:\Temp\fdxvpnifay.sys
C:\Temp\fdxvpnifay.sys
1⤵
- Executes dropped EXE
PID:4952

C:\Temp\xsqkicausn.sys
C:\Temp\xsqkicausn.sys
1⤵
- Executes dropped EXE
PID:5116

C:\Temp\xupnhfzxsp.sys
C:\Temp\xupnhfzxsp.sys
1⤵
PID:4992

C:\Temp\rmkecwupmh.sys
C:\Temp\rmkecwupmh.sys
1⤵
PID:4340

C:\Temp\mjecwuomhe.sys
C:\Temp\mjecwuomhe.sys
1⤵
PID:4220

C:\Temp\jebwtomgey.sys
C:\Temp\jebwtomgey.sys
1⤵
PID:620

C:\Temp\lgeywrojhb.sys
C:\Temp\lgeywrojhb.sys
1⤵
PID:3924

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
PID:2736

C:\Temp\qkidavtnlf.sys
C:\Temp\qkidavtnlf.sys
1⤵
PID:316

C:\Temp\lfdxvpnifa.sys
C:\Temp\lfdxvpnifa.sys
1⤵
PID:4988

C:\Temp\kicausnkfc.sys
C:\Temp\kicausnkfc.sys
1⤵
PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsnlfdxvp.sys

Path C:\Temp\avsnlfdxvp.sys
Size 141KB
SHA256 9e679a67fa287403917c2b50926d2078d2fc2aded546e21796494877e606fb7f
MD5 ffa1e080c1b65d6a78539a48e3bd0de2
SHA1 8a641e4f929abd76494894183f14d235546d89c5
SHA512 59503bdcfe126fe8da9ec5bef0749d8a1fa669e108eeaf5ad0d58f12af4178c8e51d8e02d7dfb811116ce6e8fd1b80faf77e1da3772446d27ea808839c227cd8
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigbyt.exe

Path C:\Temp\dyvqoigbyt.exe
Size 226KB
SHA256 30854fccbcc4429692dbd9aad9a88a9ffbeaaad8fc884634a70c78cb6d7e0fea
MD5 73bd563e347cfacfbae4d0ece9df780f
SHA1 b579eb047dea95ff74d7a06d1c25871c3bfb411b
SHA512 ecd588b08db4ae44c3dae59d8b2f163a030af7456e42b21429baaff2ce80242265b7612242fb5fc3a377c99614d2de1bfc0eb983d8cf3b1eb9e439334054ed12
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T10434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkicau.exe

Path C:\Temp\fzxspkicau.exe
Size 226KB
SHA256 eeef24a67daee041fb3d583c9d40e0d8192e8202faed06356bd7c5fd5269747f
MD5 f99d3e81af47abb59ba5cff26a1dfe07
SHA1 053c4b32e0f183d0c2284ca5f869684b4e565676
SHA512 82bb687e6c5ba755b1e18ec94137aadc44b9ee7eb6f4f98699755b0160b09e161e07feec8a860dbb8349586700ff7c91676069b054eb88b334b0a1238c11a6c5
SSDEEP 3072:rGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:qXY4LK+a3lLNngoqRttA7
TLSH
T19934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpkhca.sys

Path C:\Temp\hfzxrpkhca.sys
Size 141KB
SHA256 a04e64f253482944437447c5c16084f210f1fcc9ed3d502a56374292ca3e6900
MD5 843a3c95bedba5b123564e6d32f81761
SHA1 54aab756eb95745ed0368aa20b6ff0313da3eae3
SHA512 42588761e11656ffa0b56ce39dd294292a6b7d2318988b3ea079c7f9fdd7b8d43a1b573e7351b32778b076904e1ed02587f079a01ba770c224c62bb6f8195d47
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T183E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkicau.exe

Path C:\Temp\i_fzxspkicau.exe
Size 226KB
SHA256 e5a9d642f3dfe1ea4013cba4f500505b681093a9a31208e3f195f2820e442d77
MD5 9e8df657cde911c6d6c505b81ad0c4f2
SHA1 d0d245a3c9214ce85845b4b95dfa7696f470fa00
SHA512 b01a7235858605961b0a9ff93da71b974c3a2411d90e1be87c769c8b327af6287dfe89d088cbff83e8ac0156d0bb3dcdb21fe12935daf7b30174af02508cbf14
SSDEEP 3072:pGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:YXY4LK+a3lLNngoqRttA7
TLSH
T18734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaytnlfdx.exe

Path C:\Temp\i_igaytnlfdx.exe
Size 226KB
SHA256 0cb451ba24b54f3feb9a083c35a47ed3b4e276075af3dd0af2e12f178d0e9faf
MD5 9528500fe7b1c1a66831df8c8f177db6
SHA1 3d50c23c5a87575a4620dc627743a73c675f8873
SHA512 9beebc19f3fc4e2ada631b3448e2eb1d4b580d01ef205466655b1298a4902749b452e406079b13a8ba2172ef93efe3c1d308aea6445a57f2428b68cb67d410ab
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T14934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeywqoig.exe

Path C:\Temp\i_olgeywqoig.exe
Size 226KB
SHA256 525bfd0c545101023811c1002dbc7a93dcfa4be72b62bdac8e94d78118d227f0
MD5 bdeca47b8b477749a6e645bfb76a9db8
SHA1 05193ca34eb5017a6c00689028d82634380f28e0
SHA512 960b62dc2d83e3b63ed50dc3ef18ea7bb14af1a1146130dcd5d03332ac4d3827013ee75c84af5f2263fbde11d8708b2b5219bd9e4f87d7edad668d799f5a7cec
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T13534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkecwuomhe.exe

Path C:\Temp\i_pkecwuomhe.exe
Size 226KB
SHA256 5de07b6e2a2975e802606d5cac2a170b397579d4948ce99374595d1644a76eb9
MD5 7ae187b277a154ddddb93a54d916dc4d
SHA1 8acae7ec6a7a2bd44b06ebcc96b90398cff57f95
SHA512 080953afdc4c80b6bda90dd114c8ae7a364c7e3c2e7408b1bc5978f5026b6fb2fc3a9f94dd1629af907864b788301156b4ba76bf6f6e912888a6de86f6d1c79d
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T15734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnifaxsqki.exe

Path C:\Temp\i_pnifaxsqki.exe
Size 226KB
SHA256 7007c687b181b7e4534f394a86f754dab65065419ec7dab72a69127be0e68b27
MD5 7da52dfca97224fbe2651b65456cbb1b
SHA1 03e119bbff178100a5686a5f4dbe7e647824fa3e
SHA512 9f4905d0a5e40e9b00b6b0d2c549cefe7901e682d65a25b4c36f31c80f40c6c2d3613ca5e54f59e6f95fb02e28d0c25f603bfc3c8e3ea50ac9e4309e2a6906c2
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T15D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmkecwupmh.exe

Path C:\Temp\i_rmkecwupmh.exe
Size 226KB
SHA256 ba4159789d01402016e5a96e33b1088c9fcc77f94160598ba17ed5144dccea63
MD5 16de917847243e4f19e177fb963bf603
SHA1 2da076a24daa42e83fc1bfd40d6373eefc7c2638
SHA512 4b1546e146113b20dc5675d348f7e31b8e9f5e870f920061352491a27732f12f2fb7578bdb3e14f0c364d76ef4753b60407f202110f26354aa60fe63805d1c51
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T15934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwrpjebwuo.exe

Path C:\Temp\i_zwrpjebwuo.exe
Size 226KB
SHA256 1ab6db8e086dd18ab19bf1bede19cfd8b78048d5c65a9515fbb6b29c2a508029
MD5 d5e569f87882288bed42cf26d674630b
SHA1 c63f9682c167728e01ca211a3c60cd2f25759143
SHA512 f4dfa5e286066e6ba5c69fb4510483165900ae67b24374950f3b4a6440104550ba7e42b87c42008f93729a4a4acf27779f9ccc9ad3d55d98a9b6c24a83e95eb8
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T16634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaytnlfdx.exe

Path C:\Temp\igaytnlfdx.exe
Size 226KB
SHA256 b15523a1b871c24168f3382f5dde14ae9d8ce0342621762e2b2bb24a8f69a435
MD5 91af00702cda52c1a6ba8c4463d687aa
SHA1 3f1a12acf471911994532af3a7d4c7e0c9e41389
SHA512 ce104aee7c9f2f12c08de9834f57b26f3981487d2e4df18f2519191d17ae10c6446ae2e9e13d8a671d3961d651f0ecadd9d08272a7b94ff4b10e8ff1ef98079c
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T10934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jecwuomhez.sys

Path C:\Temp\jecwuomhez.sys
Size 141KB
SHA256 5bd9a2d8bcfa87dd835a7226521cc21d6704a7c17c00f45cb7469bf320820934
MD5 58ca12c119c0685ba4a844147ad3b3ae
SHA1 7e1a505269ba5a7e34b6ad4fc56e236a5ce21d69
SHA512 211209d7766393f65b64df3660c091435a92aabb28705ff28d508df5c5db1eb97cb92483517c9bdc1881dcaa7e5be95e7e71aaf956ef006f04341f66bfb39faf
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T168E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcxvpnhf.sys

Path C:\Temp\nkfcxvpnhf.sys
Size 141KB
SHA256 1bafdfed0a1dcf8acdf08df94a1b0dca37a62085a7db9b1b535ed01732d425ea
MD5 2167c2e0ac03cc20867fc441403b29ff
SHA1 56bafd227a69599b3156b2043b2cc48f64623282
SHA512 d96a5a101579717f28f9527bd1ab697231d234045b870510e78b2fed367c5288150349520c161ab568df75323639f407ec0440a69b7d6e43d7e3c2a06823a537
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A5E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqoig.exe

Path C:\Temp\olgeywqoig.exe
Size 226KB
SHA256 6b171b2fc14cb2ca539334b01d7f629236d86952fce64004cb598a4d0983b55f
MD5 e09b710907333d4d76b8b01a2412b11b
SHA1 955de36389005db4ed758377414f13bcace6c9e4
SHA512 97fe95db6a6fa31e9885c35d3379ac1630857c511cc1ca66646050db2b7e82bb1b42c7a980449b20665c93f632eb0b0ca922f839d8426c408d561bb227b2a985
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T18934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkecwuomhe.exe

Path C:\Temp\pkecwuomhe.exe
Size 226KB
SHA256 c11ec9ac5321cc44f2792216fd9a7f1aa7766d496ffdbf644da5d52bd57efecc
MD5 1160d6fbed4b483f087d5b13106f60c6
SHA1 61747f695f67f241882acabd4a46d0c21a9a40c1
SHA512 679d46cd8c7ad5b64417117dad90860e9ffc687e65b8bcd298f8391540dd6930167f5aa2b07220382e8486fc8a177853778de0a139d7427fb21a11ae66c5d723
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T15834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnifaxsqki.exe

Path C:\Temp\pnifaxsqki.exe
Size 226KB
SHA256 9ffc15945f2b5add320837bc937469302c5df89f1361c95f7ffebd9f5abbf255
MD5 c6bd11310c3ffc8f0f31a8aa58bc77d4
SHA1 d4f1678214a0905328d4219ee5dcd3e0f3d0f65c
SHA512 f8f49f47fca7e469d3daad1cc965e8d2672cdd2f71109a60c561e77d0bd535e6becd4665831b58250a46d1010871e14281276dc931bf61415f91a6249fbb9e65
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T16534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmkecwupmh.exe

Path C:\Temp\rmkecwupmh.exe
Size 226KB
SHA256 b163b1ff58b6ed28efa28b1e89aec5fc4c3781df12bb838805e823208b937b48
MD5 19a2f581ebf2d2eefd9c504b7c01cf9a
SHA1 8965c406ba026fdc7ac8449ba22cab6a2217620c
SHA512 deaa7b37284de06f068c0022bbff94377b2840812401a35d677e3176e377e7977f83f7b150c7767216982bad7268c248aa3f665c81eea74ac2571172a66145eb
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T1B634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbytrl.sys

Path C:\Temp\wqojgbytrl.sys
Size 141KB
SHA256 dfd8fd18a7361792dbe77a45c47c6ebc609d63d5a0127fde4e712536b3feba70
MD5 0030152fe52d7a729c3458dfc80bd202
SHA1 ed2b038ab439e2e8753f3c37270dc804f182c9b6
SHA512 9a765eea50ddb6ac2159b668cc88b9881be8550e5d56755fbae201b155e7ee5f2afd999464d85ebcbe354f662ba0ebfd2b9f3762a84f5b1f035a1d3ee6e09f67
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T164E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.sys

Path C:\Temp\ztrljdbwto.sys
Size 141KB
SHA256 b5e9e0203390f1e234a18fe350b4ee79859697b319ebe98545e6e6a9601ac3ea
MD5 9b0a94f647d7774500cb75c0d0fe2d31
SHA1 a033b5d14987147d841c974d5b1f9e9522b5a662
SHA512 d6f35f4c788c51eb23bf8fc9f40769eeec46dcbf6dd853d2bc1950447f919b61a59b6cf7cdb7a645f89b0b7deddb1d69494a1c9d683308dc24eca0b3835beb95
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkecwup.sys

Path C:\Temp\zusmkecwup.sys
Size 141KB
SHA256 57cc70c375ab9913ec0e8fdde730c8962e054954fe14b042876a85160b180032
MD5 5c9cd41ed8ce930622579ff5195654bd
SHA1 8122f27df4abc9e3b340c5807a160470f2f6bdf5
SHA512 b8aa43cf639441aeca209c8e228133c7c061810bc20cda75cecf5b034cfda42c59d83bd548ac8db00a15feb4af03035d82024ad82a11b56cf42ca3300a0f8af7
SSDEEP 1536:Va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T156E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpjebwuo.exe

Path C:\Temp\zwrpjebwuo.exe
Size 226KB
SHA256 cb933c0edef90d3a953dc5735d15c0144f7f7efea202ab07f604ddfd8b9ec1f8
MD5 e0c10cd23a495a5460a879a1d722d23e
SHA1 1357b5d404ff0f8330fc657bda61f3c2a7331fc1
SHA512 64f31fd06215f005860b90ecc4dc4f9408c15e0a3b2001723942bbeb62a64bb4bad28bf01beb4f541f1cd2229d6c37036245da8c1ade63eb195e55cbc1a7b4b7
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T18334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 5ceb8021c1cbf290165ab01c3d9bedfca1c6a914f4b9ee921b471836f056bfde
MD5 b52dea6c890dc3d28d6e677af38e17b4
SHA1 ed7dcf52509b3ca3be045f42b607a3d34ef1f0ce
SHA512 9c3c22f351a46fc69633ba440a2d734cd06aab595f5b30932c675e850829125a5758a308e852cf6e72aca4a321c7aecbf25ba32c13d68e9d443fbd74837a12bc
TLSH
T14EF0DC8ED07EFCB14E42D9EC285C172C2E20E47508A42863213449E2873C3FB6DA9029
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 501cf2ab237fcc8c3401e6009cd42936fa5d3273f4bc9ce26578a259e758f01b
MD5 e7f483b04d3b89937130b175011b85c7
SHA1 5822c6c0246d080a6ac137bc3a5b438beef31a38
SHA512 b4ef727b8ba89a6963b7ffd0fa9fb39e6081caae070df20f70bb2cca85c2a9440def63bd3dfa291c8082c4c8d3b6869991141b41284f29a6eec5a559bba0697b
TLSH
T151E0C03825F6411EE0F4E03C47D4752295AAF027251892F83ED49B04F31A6009C03A35
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JAXEZ455\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/316-162-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/620-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2712-170-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2736-158-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3292-87-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3832-108-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3832-126-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3924-154-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4220-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4220-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4340-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4340-145-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4500-99-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4608-75-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4732-19-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4736-61-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4744-43-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4816-44-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4816-31-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4952-125-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4988-166-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4992-140-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4992-134-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5116-135-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5116-130-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads